Function at 0x40ef80
Capabilities:
Link many functions at runtime
Rebuild import table

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00438130
test eax, eax
jne 0x40ef90
pop edi
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x40ef9f
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 8]
inc ecx
mov eax, ecx
mov dword [esi + 8], ecx
cmp eax, 0x64
jbe 0x40efb2
pop edi
xor eax, eax
pop esi
ret
push str.tsysdrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40efc7
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x40efdf
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.RemoveTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x40eff4
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StartTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x40f009
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.StopTSysDrv
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x40f01e
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.InstallAndStartTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x40f033
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StopAndRemoveTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x40f048
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.THideProcess
push edx
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x40f05d
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TUnHideProcess
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x40f072
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TUnHideAllProcess
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x40f087
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TWaitSSDTMutex
push edx
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x40f09c
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TReleaseSSDTMutex
push eax
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x40f0b1
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TBackupSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x40f0c6
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddr
push edx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x40f0db
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddrAll
push eax
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x40f0f0
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
jne 0x40f105
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRecoverSSDTFunction
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x40f11a
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TBackupAndSetRealSSDTShadow
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x40f12f
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDTShadow
push ecx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x40f144
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TGetCurrentShadowSST
push edx
call edi
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x40f159
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TGetCurrentNtoskrnlSST
push eax
call edi
test eax, eax
mov dword [esi + 0x70], eax
jne 0x40f16e
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TGetModuleInfo
push ecx
call edi
test eax, eax
mov dword [esi + 0x74], eax
jne 0x40f183
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHCloseHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x78], eax
jne 0x40f198
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TOHRMCloseHandleProc
push eax
call edi
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x40f1ad
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TOHQueryHandle
push ecx
call edi
test eax, eax
mov dword [esi + 0x80], eax
jne 0x40f1c5
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHQueryFileHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x84], eax
jne 0x40f1dd
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TPrintDbgInfo
push eax
call edi
test eax, eax
mov dword [esi + 0x88], eax
jne 0x40f1f5
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TEnableProtected
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x40f20a
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TDisableProtected
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x40f21f
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TAddRegKey
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x40f234
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRemoveRegKey
push ecx
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x40f249
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRemoveAllRegKeys
push edx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x40f25e
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.Init
push eax
call edi
test eax, eax
mov dword [esi + 0x8c], eax
jne 0x40f276
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.GetPortVal
push ecx
call edi
test eax, eax
mov dword [esi + 0x90], eax
jne 0x40f28e
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.SetPortVal
push edx
call edi
test eax, eax
mov dword [esi + 0x94], eax
jne 0x40f2a6
pop edi
pop esi
ret
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret