Function at 0x401307
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x41ae00
push esi
push edi
mov esi, ecx
call fcn.0045d9d0
test eax, eax
jne 0x41ae10
pop edi
pop esi
ret
call fcn.0045d8f0
test eax, eax
je 0x41ae1e
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x41ae2d
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 8]
inc ecx
mov eax, ecx
mov dword [esi + 8], ecx
cmp eax, 0x64
jbe 0x41ae40
pop edi
xor eax, eax
pop esi
ret
push str.tsysdrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x41ae55
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x41ae6d
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.RemoveTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x41ae82
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StartTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x41ae97
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.StopTSysDrv
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x41aeac
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.InstallAndStartTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x41aec1
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StopAndRemoveTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x41aed6
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.THideProcess
push edx
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x41aeeb
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TUnHideProcess
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x41af00
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TUnHideAllProcess
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x41af15
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TWaitSSDTMutex
push edx
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x41af2a
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TReleaseSSDTMutex
push eax
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x41af3f
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TBackupSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x41af54
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddr
push edx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x41af69
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddrAll
push eax
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x41af7e
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
jne 0x41af93
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRecoverSSDTFunction
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x41afa8
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TBackupAndSetRealSSDTShadow
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x41afbd
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDTShadow
push ecx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x41afd2
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TGetCurrentShadowSST
push edx
call edi
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x41afe7
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TGetCurrentNtoskrnlSST
push eax
call edi
test eax, eax
mov dword [esi + 0x70], eax
jne 0x41affc
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TGetModuleInfo
push ecx
call edi
test eax, eax
mov dword [esi + 0x74], eax
jne 0x41b011
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHCloseHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x78], eax
jne 0x41b026
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TOHRMCloseHandleProc
push eax
call edi
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x41b03b
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TOHQueryHandle
push ecx
call edi
test eax, eax
mov dword [esi + 0x80], eax
jne 0x41b053
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHQueryFileHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x84], eax
jne 0x41b06b
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TPrintDbgInfo
push eax
call edi
test eax, eax
mov dword [esi + 0x88], eax
jne 0x41b083
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TEnableProtected
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x41b098
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TDisableProtected
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x41b0ad
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TAddRegKey
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x41b0c2
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRemoveRegKey
push ecx
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x41b0d7
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRemoveAllRegKeys
push edx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x41b0ec
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.Init
push eax
call edi
test eax, eax
mov dword [esi + 0x8c], eax
jne 0x41b104
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.GetPortVal
push ecx
call edi
test eax, eax
mov dword [esi + 0x90], eax
jne 0x41b11c
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.SetPortVal
push edx
call edi
test eax, eax
mov dword [esi + 0x94], eax
jne 0x41b134
pop edi
pop esi
ret
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret