Function at 0x18006e200
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180122be0]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtOpenFile
mov qword [0x1801229d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtClose
mov qword [0x1801229d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtReadFile
mov qword [0x1801229e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtWriteFile
mov qword [0x1801229e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryObject
mov qword [0x1801229f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1801229f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryInformationFile
mov qword [0x180122a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSetInformationFile
mov qword [0x180122a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQuerySystemInformation
mov qword [0x180122a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtDeleteFile
mov qword [0x180122a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x180122a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtDuplicateObject
mov qword [0x180122a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x180122a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x180122a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x180122a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x180122a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x180122a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x180122a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x180122a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x180122a68], rax
mov rcx, qword [0x180122be0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x180122a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtCreateKey
mov qword [0x180122a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtOpenKey
mov qword [0x180122a80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryKey
mov qword [0x180122a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryValueKey
mov qword [0x180122a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x180122a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtEnumerateKey
mov qword [0x180122aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtEnumerateValueKey
mov qword [0x180122aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtFlushKey
mov qword [0x180122ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtDeleteKey
mov qword [0x180122ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSetInformationKey
mov qword [0x180122ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSetValueKey
mov qword [0x180122ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtNotifyChangeKey
mov qword [0x180122ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x180122ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtCreateProcess
mov qword [0x180122ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtCreateProcessEx
mov qword [0x180122ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtOpenProcess
mov qword [0x180122af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtTerminateProcess
mov qword [0x180122af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.LdrShutdownProcess
mov qword [0x180122b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
mov qword [0x180122b08], rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSetInformationProcess
mov qword [0x180122b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtCreateThread
mov qword [0x180122b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtOpenThread
mov qword [0x180122b20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSuspendThread
mov qword [0x180122b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtResumeThread
mov qword [0x180122b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtTerminateThread
mov qword [0x180122b38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.LdrShutdownThread
mov qword [0x180122b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryInformationThread
mov qword [0x180122b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtSetInformationThread
mov qword [0x180122b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlInitUnicodeString
mov qword [0x180122b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x180122b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x180122b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryAttributesFile
mov qword [0x180122b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x180122b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x180122b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x180122b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x180122b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlInitializeSid
mov qword [0x180122b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x180122ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlCreateAcl
mov qword [0x180122ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x180122bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x180122bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x180122bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x180122bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180122be0]
lea rdx, str.NtDeleteValueKey
mov qword [0x180122bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180122bd8], rax
add rsp, 0x28
ret