Function at 0x4012fd
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x41b230
push esi
push edi
mov esi, ecx
call fcn.0045de00
test eax, eax
jne 0x41b240
pop edi
pop esi
ret
call fcn.0045dd20
test eax, eax
je 0x41b24e
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x41b25d
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 8]
inc ecx
mov eax, ecx
mov dword [esi + 8], ecx
cmp eax, 0x64
jbe 0x41b270
pop edi
xor eax, eax
pop esi
ret
push str.tsysdrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x41b285
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x41b29d
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.RemoveTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x41b2b2
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StartTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x41b2c7
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.StopTSysDrv
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x41b2dc
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.InstallAndStartTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x41b2f1
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StopAndRemoveTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x41b306
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.THideProcess
push edx
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x41b31b
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TUnHideProcess
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x41b330
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TUnHideAllProcess
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x41b345
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TWaitSSDTMutex
push edx
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x41b35a
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TReleaseSSDTMutex
push eax
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x41b36f
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TBackupSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x41b384
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddr
push edx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x41b399
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddrAll
push eax
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x41b3ae
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
jne 0x41b3c3
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRecoverSSDTFunction
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x41b3d8
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TBackupAndSetRealSSDTShadow
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x41b3ed
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDTShadow
push ecx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x41b402
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TGetCurrentShadowSST
push edx
call edi
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x41b417
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TGetCurrentNtoskrnlSST
push eax
call edi
test eax, eax
mov dword [esi + 0x70], eax
jne 0x41b42c
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TGetModuleInfo
push ecx
call edi
test eax, eax
mov dword [esi + 0x74], eax
jne 0x41b441
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHCloseHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x78], eax
jne 0x41b456
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TOHRMCloseHandleProc
push eax
call edi
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x41b46b
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TOHQueryHandle
push ecx
call edi
test eax, eax
mov dword [esi + 0x80], eax
jne 0x41b483
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHQueryFileHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x84], eax
jne 0x41b49b
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TPrintDbgInfo
push eax
call edi
test eax, eax
mov dword [esi + 0x88], eax
jne 0x41b4b3
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TEnableProtected
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x41b4c8
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TDisableProtected
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x41b4dd
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TAddRegKey
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x41b4f2
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRemoveRegKey
push ecx
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x41b507
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRemoveAllRegKeys
push edx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x41b51c
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.Init
push eax
call edi
test eax, eax
mov dword [esi + 0x8c], eax
jne 0x41b534
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.GetPortVal
push ecx
call edi
test eax, eax
mov dword [esi + 0x90], eax
jne 0x41b54c
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.SetPortVal
push edx
call edi
test eax, eax
mov dword [esi + 0x94], eax
jne 0x41b564
pop edi
pop esi
ret
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret