Function at 0x10029f66
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push str.NtCreateFile
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3818], eax
push str.NtOpenFile
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f381c], eax
push str.NtClose
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3820], eax
push str.NtReadFile
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3824], eax
push str.NtWriteFile
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3828], eax
push str.NtQueryObject
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f382c], eax
push str.NtQueryDirectoryFile
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3830], eax
push str.NtQueryDirectoryFileEx
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3834], eax
push str.NtQueryInformationFile
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3838], eax
push str.NtSetInformationFile
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f383c], eax
push str.NtQuerySystemInformation
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3840], eax
push str.NtDeleteFile
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3844], eax
push str.NtQueryVolumeInformationFile
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3848], eax
push str.NtDuplicateObject
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f384c], eax
push str.RtlInitializeCriticalSection
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3850], eax
push str.RtlDeleteCriticalSection
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3854], eax
push str.RtlEnterCriticalSection
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3858], eax
push str.RtlLeaveCriticalSection
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f385c], eax
push str.RtlTryEnterCriticalSection
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3860], eax
push str.NtOpenDirectoryObject
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3864], eax
push str.NtQueryDirectoryObject
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3868], eax
push str.NtOpenSymbolicLinkObject
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f386c], eax
push str.NtQuerySymbolicLinkObject
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3870], eax
push str.NtCreateKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3874], eax
push str.NtOpenKey
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3878], eax
push str.NtQueryKey
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f387c], eax
push str.NtQueryValueKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3880], eax
push str.NtQueryMultipleValueKey
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3884], eax
push str.NtEnumerateKey
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3888], eax
push str.NtEnumerateValueKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f388c], eax
push str.NtFlushKey
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3890], eax
push str.NtDeleteKey
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3894], eax
push str.NtDeleteValueKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3898], eax
push str.NtSetInformationKey
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f389c], eax
push str.NtSetValueKey
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38a0], eax
push str.NtNotifyChangeKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38a4], eax
push str.NtNotifyChangeMultipleKeys
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38a8], eax
push str.NtCreateProcess
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38ac], eax
push str.NtCreateProcessEx
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38b0], eax
push str.NtOpenProcess
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38b4], eax
push str.NtTerminateProcess
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38b8], eax
push str.LdrShutdownProcess
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38bc], eax
push str.NtQueryInformationProcess
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38c0], eax
push str.NtSetInformationProcess
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38c4], eax
push str.NtCreateThread
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38c8], eax
push str.NtOpenThread
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38cc], eax
push str.NtSuspendThread
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38d0], eax
push str.NtResumeThread
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38d4], eax
push str.NtTerminateThread
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38d8], eax
push str.LdrShutdownThread
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38dc], eax
push str.NtQueryInformationThread
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38e0], eax
push str.NtSetInformationThread
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38e4], eax
push str.RtlInitUnicodeString
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38e8], eax
push str.RtlFreeUnicodeString
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38ec], eax
push str.RtlDosPathNameToNtPathName_U
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38f0], eax
push str.NtQueryAttributesFile
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38f4], eax
push str.NtQueryFullAttributesFile
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38f8], eax
push str.RtlConvertSidToUnicodeString
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f38fc], eax
push str.RtlCreateSecurityDescriptor
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3900], eax
push str.RtlSetDaclSecurityDescriptor
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3904], eax
push str.RtlInitializeSid
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3908], eax
push str.RtlSubAuthoritySid
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f390c], eax
push str.RtlCreateAcl
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3910], eax
push str.RtlAddAccessAllowedAceEx
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3914], eax
push str.RtlGetCurrentDirectory_U
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3918], eax
push str.RtlSetCurrentDirectory_U
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f391c], eax
push str.RtlGetFullPathName_U
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3920], eax
push str.RtlFormatCurrentUserKeyPath
mov ecx, dword [0x100f3930]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3924], eax
push str.NtRenameKey
mov edx, dword [0x100f3930]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3928], eax
push str.NtCreateDirectoryObject
mov eax, dword [0x100f3930]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f392c], eax
pop ebp
ret