Function at 0x10065340
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x1009eab8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtOpenFile
push ecx
mov dword [0x1009e9b0], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtClose
push edx
mov dword [0x1009e9b4], eax
call esi
mov dword [0x1009e9b8], eax
mov eax, dword [0x1009eab8]
push str.NtReadFile
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtWriteFile
push ecx
mov dword [0x1009e9bc], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtQueryObject
push edx
mov dword [0x1009e9c0], eax
call esi
mov dword [0x1009e9c4], eax
mov eax, dword [0x1009eab8]
push str.NtQueryDirectoryFile
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtQueryInformationFile
push ecx
mov dword [0x1009e9c8], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtSetInformationFile
push edx
mov dword [0x1009e9cc], eax
call esi
mov dword [0x1009e9d0], eax
mov eax, dword [0x1009eab8]
push str.NtQuerySystemInformation
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtDeleteFile
push ecx
mov dword [0x1009e9d4], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtQueryVolumeInformationFile
push edx
mov dword [0x1009e9d8], eax
call esi
mov dword [0x1009e9dc], eax
mov eax, dword [0x1009eab8]
push str.NtDuplicateObject
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlInitializeCriticalSection
push ecx
mov dword [0x1009e9e0], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlDeleteCriticalSection
push edx
mov dword [0x1009e9e4], eax
call esi
mov dword [0x1009e9e8], eax
mov eax, dword [0x1009eab8]
push str.RtlEnterCriticalSection
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlLeaveCriticalSection
push ecx
mov dword [0x1009e9ec], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlTryEnterCriticalSection
push edx
mov dword [0x1009e9f0], eax
call esi
mov dword [0x1009e9f4], eax
mov eax, dword [0x1009eab8]
push str.NtOpenDirectoryObject
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtQueryDirectoryObject
push ecx
mov dword [0x1009e9f8], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtOpenSymbolicLinkObject
push edx
mov dword [0x1009e9fc], eax
call esi
mov dword [0x1009ea00], eax
mov eax, dword [0x1009eab8]
push str.NtQuerySymbolicLinkObject
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtCreateKey
push ecx
mov dword [0x1009ea04], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtOpenKey
push edx
mov dword [0x1009ea08], eax
call esi
mov dword [0x1009ea0c], eax
mov eax, dword [0x1009eab8]
push str.NtQueryKey
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtQueryValueKey
push ecx
mov dword [0x1009ea10], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtQueryMultipleValueKey
push edx
mov dword [0x1009ea14], eax
call esi
mov dword [0x1009ea18], eax
mov eax, dword [0x1009eab8]
push str.NtEnumerateKey
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtEnumerateValueKey
push ecx
mov dword [0x1009ea1c], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtFlushKey
push edx
mov dword [0x1009ea20], eax
call esi
mov dword [0x1009ea24], eax
mov eax, dword [0x1009eab8]
push str.NtDeleteKey
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtSetInformationKey
push ecx
mov dword [0x1009ea28], eax
call esi
mov dword [0x1009ea2c], eax
mov edx, dword [0x1009eab8]
push str.NtSetValueKey
push edx
call esi
mov dword [0x1009ea30], eax
mov eax, dword [0x1009eab8]
push str.NtNotifyChangeKey
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtNotifyChangeMultipleKeys
push ecx
mov dword [0x1009ea34], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtCreateProcess
push edx
mov dword [0x1009ea38], eax
call esi
mov dword [0x1009ea3c], eax
mov eax, dword [0x1009eab8]
push str.NtCreateProcessEx
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtOpenProcess
push ecx
mov dword [0x1009ea40], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtTerminateProcess
push edx
mov dword [0x1009ea44], eax
call esi
mov dword [0x1009ea48], eax
mov eax, dword [0x1009eab8]
push str.LdrShutdownProcess
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtQueryInformationProcess
push ecx
mov dword [0x1009ea4c], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtSetInformationProcess
push edx
mov dword [0x1009ea50], eax
call esi
mov dword [0x1009ea54], eax
mov eax, dword [0x1009eab8]
push str.NtCreateThread
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtOpenThread
push ecx
mov dword [0x1009ea58], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtSuspendThread
push edx
mov dword [0x1009ea5c], eax
call esi
mov dword [0x1009ea60], eax
mov eax, dword [0x1009eab8]
push str.NtResumeThread
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtTerminateThread
push ecx
mov dword [0x1009ea64], eax
call esi
mov edx, dword [0x1009eab8]
push str.LdrShutdownThread
push edx
mov dword [0x1009ea68], eax
call esi
mov dword [0x1009ea6c], eax
push str.NtQueryInformationThread
mov eax, dword [0x1009eab8]
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.NtSetInformationThread
push ecx
mov dword [0x1009ea70], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlInitUnicodeString
push edx
mov dword [0x1009ea74], eax
call esi
mov dword [0x1009ea78], eax
mov eax, dword [0x1009eab8]
push str.RtlFreeUnicodeString
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlDosPathNameToNtPathName_U
push ecx
mov dword [0x1009ea7c], eax
call esi
mov edx, dword [0x1009eab8]
push str.NtQueryAttributesFile
push edx
mov dword [0x1009ea80], eax
call esi
mov dword [0x1009ea84], eax
mov eax, dword [0x1009eab8]
push str.NtQueryFullAttributesFile
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlConvertSidToUnicodeString
push ecx
mov dword [0x1009ea88], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlCreateSecurityDescriptor
push edx
mov dword [0x1009ea8c], eax
call esi
mov dword [0x1009ea90], eax
mov eax, dword [0x1009eab8]
push str.RtlSetDaclSecurityDescriptor
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlInitializeSid
push ecx
mov dword [0x1009ea94], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlSubAuthoritySid
push edx
mov dword [0x1009ea98], eax
call esi
mov dword [0x1009ea9c], eax
mov eax, dword [0x1009eab8]
push str.RtlCreateAcl
push eax
call esi
mov ecx, dword [0x1009eab8]
push str.RtlAddAccessAllowedAceEx
push ecx
mov dword [0x1009eaa0], eax
call esi
mov edx, dword [0x1009eab8]
push str.RtlGetCurrentDirectory_U
push edx
mov dword [0x1009eaa4], eax
call esi
mov dword [0x1009eaa8], eax
mov eax, dword [0x1009eab8]
push str.RtlSetCurrentDirectory_U
push eax
call esi
mov ecx, dword [0x1009eab8]
mov dword [0x1009eaac], eax
push str.RtlGetFullPathName_U
push ecx
call esi
mov edx, dword [0x1009eab8]
push str.NtDeleteValueKey
push edx
mov dword [0x1009eab0], eax
call esi
mov dword [0x1009eab4], eax
pop esi
ret