Function at 0x479f20
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0x54864c
call edi
sub esp, 4
test eax, eax
je 0x47a15b
mov esi, eax
mov dword [esp + 4], str.RtlNtStatusToDosError
mov dword [esp], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
sub esp, 8
test eax, eax
mov dword [0x5779ec], eax
je 0x47a145
mov dword [esp + 4], str.NtDeviceIoControlFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x5779fc], eax
je 0x47a145
mov dword [esp + 4], str.NtQueryInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x577a0c], eax
je 0x47a145
mov dword [esp + 4], str.NtSetInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x5779f0], eax
je 0x47a145
mov dword [esp + 4], str.NtQueryVolumeInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x5779dc], eax
je 0x47a145
mov dword [esp + 4], str.NtQueryDirectoryFile
mov dword [esp], esi
call ebx
mov dword [0x577a04], eax
mov eax, dword [0x5779dc]
sub esp, 8
test eax, eax
je 0x47a145
mov dword [esp + 4], str.NtQuerySystemInformation
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x5779e0], eax
je 0x47a145
mov dword [esp], str.kernel32.dll
call edi
sub esp, 4
test eax, eax
mov esi, eax
je 0x47a15b
mov dword [esp + 4], str.GetQueuedCompletionStatusEx
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x5779f8], eax
mov dword [esp + 4], str.SetFileCompletionNotificationModes
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x577a10], eax
mov dword [esp + 4], str.CreateSymbolicLinkW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x577a14], eax
mov dword [esp + 4], str.CancelIoEx
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779d8], eax
mov dword [esp + 4], str.InitializeConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779f4], eax
mov dword [esp + 4], str.SleepConditionVariableCS
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779d0], eax
mov dword [esp + 4], str.SleepConditionVariableSRW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779d4], eax
mov dword [esp + 4], str.WakeAllConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779e8], eax
mov dword [esp + 4], str.WakeConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x577a00], eax
mov dword [esp + 4], str.CancelSynchronousIo
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x577a18], eax
mov dword [esp + 4], str.GetFinalPathNameByHandleW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x5779e4], eax
mov dword [esp], str.powrprof.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x47a13e
mov dword [esp + 4], str.PowerRegisterSuspendResumeNotification
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x577a08], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetProcAddress
mov dword [esp], eax
call fcn.00458810
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetModuleHandleA
mov dword [esp], eax
call fcn.00458810
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop