Function at 0x18001c970
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x180038d88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x18001c997
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.RtlInitAnsiString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d98], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrGetProcedureAddress
mov rcx, rbx
call fcn.180004ef0
mov qword [0x180047da0], rax
test rax, rax
jne 0x18001c9f2
lea rdx, str.LdrGetProcedureAddress
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047da0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlAnsiStringToUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d90], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d88], rax
test rax, rax
je 0x18001ce1b
lea rdx, [0x18003cc80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d80], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d78], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtOpenKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d70], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtCreateKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d68], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtSetValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d60], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtQueryValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d58], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtDeleteValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d50], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtDeleteKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d48], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtNotifyChangeKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d40], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d38], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrQueryProcessModuleInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d30], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrGetDllHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d28], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d20], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d18], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlGetVersion
mov rcx, rbx
call fcn.180004ef0
mov qword [0x180047d10], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.swprintf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800477f0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlAdjustPrivilege
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047ce8], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlCreateAcl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047ce0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cd8], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cd0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cc8], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlSetOwnerSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cc0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlSetGroupSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cb8], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlAbsoluteToSelfRelativeSD
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cb0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlInitializeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047ca8], rax
test rax, rax
je 0x18001ce1b
lea rdx, [0x18003ced0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047ca0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlRandom
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047c98], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrLockLoaderLock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cf8], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrUnlockLoaderLock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047cf0], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.RtlImageNtHeader
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047c90], rax
test rax, rax
je 0x18001ce1b
lea rdx, str.LdrRegisterDllNotification
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LdrUnregisterDllNotification
mov rcx, rbx
mov qword [0x180047d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047d00], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x7f
add rsp, 0x20
pop rbx
ret