Function at 0x1000ee50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x48], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], str.FSEIFlt.dll
mov edx, dword [ebp - 4]
push edx
call fcn.1000f920
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x1000f0f9
push str.FLT_Initial
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
push str.MON_AddAccessPolicy
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
push str.MON_ClearAccessPolicy
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
push str.MON_DelAccessPolicy
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
push str.MON_AddProtectProcess
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x1c], eax
push str.MON_DelProtectProcess
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
push str.MON_StopProtectProcess
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], eax
push str.MON_AddAccessPassProcess
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
push str.MON_DelAccessPassProcess
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
push str.MON_AddProtectReg
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
push str.MON_StopProtectReg
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x34], eax
push str.MON_AddPassByProtectReg
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
push str.MON_DelPassByProtectReg
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x3c], eax
push str.MON_AddPassByPathProtect
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x40], eax
push str.MON_DelPassByPathProtect
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], eax
push str.MON_StopPathProtect
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x48], eax
push str.MON_FileProtectAdd
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
push str.MON_FileProtectDel
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
push str.MON_SetIceSword
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret