Function at 0x1800b96d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenFile
mov qword [0x180173678], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtClose
mov qword [0x180173680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtReadFile
mov qword [0x180173688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtWriteFile
mov qword [0x180173690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryObject
mov qword [0x180173698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1801736a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryDirectoryFileEx
mov qword [0x1801736a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryInformationFile
mov qword [0x1801736b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSetInformationFile
mov qword [0x1801736b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQuerySystemInformation
mov qword [0x1801736c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtDeleteFile
mov qword [0x1801736c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x1801736d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtDuplicateObject
mov qword [0x1801736d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x1801736e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x1801736e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x1801736f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x1801736f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x180173700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x180173708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x180173710], rax
mov rcx, qword [0x1801738b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x180173718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x180173720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateKey
mov qword [0x180173728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenKey
mov qword [0x180173730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryKey
mov qword [0x180173738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryValueKey
mov qword [0x180173740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x180173748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtEnumerateKey
mov qword [0x180173750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtEnumerateValueKey
mov qword [0x180173758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtFlushKey
mov qword [0x180173760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtDeleteKey
mov qword [0x180173768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtDeleteValueKey
mov qword [0x180173770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSetInformationKey
mov qword [0x180173778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSetValueKey
mov qword [0x180173780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtNotifyChangeKey
mov qword [0x180173788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x180173790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateProcess
mov qword [0x180173798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateProcessEx
mov qword [0x1801737a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenProcess
mov qword [0x1801737a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
mov qword [0x1801737b0], rax
lea rdx, str.NtTerminateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.LdrShutdownProcess
mov qword [0x1801737b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryInformationProcess
mov qword [0x1801737c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSetInformationProcess
mov qword [0x1801737c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateThread
mov qword [0x1801737d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtOpenThread
mov qword [0x1801737d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSuspendThread
mov qword [0x1801737e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtResumeThread
mov qword [0x1801737e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtTerminateThread
mov qword [0x1801737f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.LdrShutdownThread
mov qword [0x1801737f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryInformationThread
mov qword [0x180173800], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtSetInformationThread
mov qword [0x180173808], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlInitUnicodeString
mov qword [0x180173810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x180173818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x180173820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryAttributesFile
mov qword [0x180173828], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x180173830], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x180173838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x180173840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x180173848], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlInitializeSid
mov qword [0x180173850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x180173858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlCreateAcl
mov qword [0x180173860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x180173868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x180173870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x180173878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x180173880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x180173888], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtRenameKey
mov qword [0x180173890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateDirectoryObject
mov qword [0x180173898], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801738b0]
lea rdx, str.NtCreateToken
mov qword [0x1801738a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801738a8], rax
add rsp, 0x28
ret