Function at 0x10020e20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.100f53a0
test eax, eax
jne 0x10020e30
pop edi
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x10020e3f
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 8]
inc ecx
mov eax, ecx
mov dword [esi + 8], ecx
cmp eax, 0x64
jbe 0x10020e52
pop edi
xor eax, eax
pop esi
ret
push str.tsysdrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x10020e67
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x10020e7f
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.RemoveTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x10020e94
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StartTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x10020ea9
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.StopTSysDrv
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x10020ebe
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.InstallAndStartTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x10020ed3
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StopAndRemoveTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x10020ee8
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.THideProcess
push edx
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x10020efd
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TUnHideProcess
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x10020f12
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TUnHideAllProcess
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x10020f27
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TWaitSSDTMutex
push edx
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x10020f3c
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TReleaseSSDTMutex
push eax
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x10020f51
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TBackupSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x10020f66
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddr
push edx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x10020f7b
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddrAll
push eax
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x10020f90
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
jne 0x10020fa5
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRecoverSSDTFunction
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x10020fba
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TBackupAndSetRealSSDTShadow
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x10020fcf
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDTShadow
push ecx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x10020fe4
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TGetCurrentShadowSST
push edx
call edi
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x10020ff9
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TGetCurrentNtoskrnlSST
push eax
call edi
test eax, eax
mov dword [esi + 0x70], eax
jne 0x1002100e
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TGetModuleInfo
push ecx
call edi
test eax, eax
mov dword [esi + 0x74], eax
jne 0x10021023
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHCloseHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x78], eax
jne 0x10021038
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TOHRMCloseHandleProc
push eax
call edi
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x1002104d
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TOHQueryHandle
push ecx
call edi
test eax, eax
mov dword [esi + 0x80], eax
jne 0x10021065
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHQueryFileHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x84], eax
jne 0x1002107d
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TPrintDbgInfo
push eax
call edi
test eax, eax
mov dword [esi + 0x88], eax
jne 0x10021095
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TEnableProtected
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x100210aa
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TDisableProtected
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x100210bf
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TAddRegKey
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x100210d4
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRemoveRegKey
push ecx
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x100210e9
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRemoveAllRegKeys
push edx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x100210fe
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.Init
push eax
call edi
test eax, eax
mov dword [esi + 0x8c], eax
jne 0x10021116
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.GetPortVal
push ecx
call edi
test eax, eax
mov dword [esi + 0x90], eax
jne 0x1002112e
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.SetPortVal
push edx
call edi
test eax, eax
mov dword [esi + 0x94], eax
jne 0x10021146
pop edi
pop esi
ret
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret