Function at 0x14000fbd0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400fc3f8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov rdx, qword [str.NtClose]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rsi, [0x1401040c8]
xor ebx, ebx
test rax, rax
je 0x140010038
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd370], rax
test dl, dl
jne 0x14000fc53
test rcx, rcx
je 0x14000fc53
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtCreateKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x14001005f
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd2f0], rax
test dl, dl
jne 0x14000fca8
test rcx, rcx
je 0x14000fca8
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtOpenKeyEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140010086
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd340], rax
test dl, dl
jne 0x14000fcfd
test rcx, rcx
je 0x14000fcfd
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtQueryKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x1400100ad
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd360], rax
test dl, dl
jne 0x14000fd52
test rcx, rcx
je 0x14000fd52
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtQueryValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x1400100d4
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd390], rax
test dl, dl
jne 0x14000fda7
test rcx, rcx
je 0x14000fda7
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtSetValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x1400100fb
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd310], rax
test dl, dl
jne 0x14000fdfc
test rcx, rcx
je 0x14000fdfc
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtDeleteValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140010122
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd320], rax
test dl, dl
jne 0x14000fe51
test rcx, rcx
je 0x14000fe51
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtDeleteKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140010149
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd300], rax
test dl, dl
jne 0x14000fea6
test rcx, rcx
je 0x14000fea6
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtEnumerateKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140010170
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd3a0], rax
test dl, dl
jne 0x14000fefb
test rcx, rcx
je 0x14000fefb
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtEnumerateValueKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140010197
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd380], rax
test dl, dl
jne 0x14000ff50
test rcx, rcx
je 0x14000ff50
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtRenameKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x1400101be
mov dl, 1
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], dl
mov rax, rbx
cmp dl, 1
cmove rax, r8
mov qword [0x1400fd350], rax
test dl, dl
jne 0x14000ffa5
test rcx, rcx
je 0x14000ffa5
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rdx, qword [str.NtNotifyChangeMultipleKeys]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
test rax, rax
je 0x140010014
mov al, 1
mov qword [rbp - 0x30], rdx
mov rcx, qword [rbp - 0x20]
mov byte [rbp - 0x18], al
cmp al, 1
cmove rbx, rdx
mov qword [0x1400fd330], rbx
test al, al
jne 0x14000fff2
test rcx, rcx
je 0x14000fff2
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008a6c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor al, al
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov rdx, qword [rbp - 0x30]
jmp 0x14000ffc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fc24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fc79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fcce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fd23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fd78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fdcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fe22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fe77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000fecc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000ff21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
xor dl, dl
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm0
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8, qword [rbp - 0x30]
jmp 0x14000ff76