Function at 0x18000e140
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18001c870
test eax, eax
jne 0x18000e15a
xor eax, eax
add rsp, 0x20
pop rbx
ret
call fcn.18001c770
test eax, eax
jne 0x18000e152
cmp dword [rbx + 8], eax
jne 0x18000e5c4
inc dword [rbx + 0xc]
cmp dword [rbx + 0xc], 0x64
ja 0x18000e152
lea rcx, str.tsysdrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18000e152
lea rdx, str.InstallTSysDrv
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.RemoveTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.StartTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.StopTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.InstallAndStartTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.StopAndRemoveTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.THideProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TUnHideProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TUnHideAllProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TWaitSSDTMutex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TReleaseSSDTMutex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TBackupSSDT
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TSetRealSSDTFuncAddr
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TSetRealSSDTFuncAddrAll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDT
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDTFunction
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TBackupAndSetRealSSDTShadow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDTShadow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetCurrentShadowSST
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetCurrentNtoskrnlSST
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetModuleInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHRMCloseHandleProc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf0], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHQueryHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf8], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHQueryFileHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x100], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TPrintDbgInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x108], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TEnableProtected
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TDisableProtected
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TAddRegKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRemoveRegKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRemoveAllRegKeys
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.Init
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x110], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.GetPortVal
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x118], rax
test rax, rax
je 0x18000e152
mov rcx, qword [rbx + 0x10]
lea rdx, str.SetPortVal
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x120], rax
test rax, rax
je 0x18000e152
mov dword [rbx + 8], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret