Function at 0x100453e0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x100af2d0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtOpenFile
push ecx
mov dword [0x100af1c8], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtClose
push edx
mov dword [0x100af1cc], eax
call esi
mov dword [0x100af1d0], eax
mov eax, dword [0x100af2d0]
push str.NtReadFile
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtWriteFile
push ecx
mov dword [0x100af1d4], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtQueryObject
push edx
mov dword [0x100af1d8], eax
call esi
mov dword [0x100af1dc], eax
mov eax, dword [0x100af2d0]
push str.NtQueryDirectoryFile
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtQueryInformationFile
push ecx
mov dword [0x100af1e0], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtSetInformationFile
push edx
mov dword [0x100af1e4], eax
call esi
mov dword [0x100af1e8], eax
mov eax, dword [0x100af2d0]
push str.NtQuerySystemInformation
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtDeleteFile
push ecx
mov dword [0x100af1ec], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtQueryVolumeInformationFile
push edx
mov dword [0x100af1f0], eax
call esi
mov dword [0x100af1f4], eax
mov eax, dword [0x100af2d0]
push str.NtDuplicateObject
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlInitializeCriticalSection
push ecx
mov dword [0x100af1f8], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlDeleteCriticalSection
push edx
mov dword [0x100af1fc], eax
call esi
mov dword [0x100af200], eax
mov eax, dword [0x100af2d0]
push str.RtlEnterCriticalSection
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlLeaveCriticalSection
push ecx
mov dword [0x100af204], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlTryEnterCriticalSection
push edx
mov dword [0x100af208], eax
call esi
mov dword [0x100af20c], eax
mov eax, dword [0x100af2d0]
push str.NtOpenDirectoryObject
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtQueryDirectoryObject
push ecx
mov dword [0x100af210], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtOpenSymbolicLinkObject
push edx
mov dword [0x100af214], eax
call esi
mov dword [0x100af218], eax
mov eax, dword [0x100af2d0]
push str.NtQuerySymbolicLinkObject
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtCreateKey
push ecx
mov dword [0x100af21c], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtOpenKey
push edx
mov dword [0x100af220], eax
call esi
mov dword [0x100af224], eax
mov eax, dword [0x100af2d0]
push str.NtQueryKey
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtQueryValueKey
push ecx
mov dword [0x100af228], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtQueryMultipleValueKey
push edx
mov dword [0x100af22c], eax
call esi
mov dword [0x100af230], eax
mov eax, dword [0x100af2d0]
push str.NtEnumerateKey
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtEnumerateValueKey
push ecx
mov dword [0x100af234], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtFlushKey
push edx
mov dword [0x100af238], eax
call esi
mov dword [0x100af23c], eax
mov eax, dword [0x100af2d0]
push str.NtDeleteKey
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtSetInformationKey
push ecx
mov dword [0x100af240], eax
call esi
mov dword [0x100af244], eax
mov edx, dword [0x100af2d0]
push str.NtSetValueKey
push edx
call esi
mov dword [0x100af248], eax
mov eax, dword [0x100af2d0]
push str.NtNotifyChangeKey
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtNotifyChangeMultipleKeys
push ecx
mov dword [0x100af24c], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtCreateProcess
push edx
mov dword [0x100af250], eax
call esi
mov dword [0x100af254], eax
mov eax, dword [0x100af2d0]
push str.NtCreateProcessEx
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtOpenProcess
push ecx
mov dword [0x100af258], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtTerminateProcess
push edx
mov dword [0x100af25c], eax
call esi
mov dword [0x100af260], eax
mov eax, dword [0x100af2d0]
push str.LdrShutdownProcess
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtQueryInformationProcess
push ecx
mov dword [0x100af264], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtSetInformationProcess
push edx
mov dword [0x100af268], eax
call esi
mov dword [0x100af26c], eax
mov eax, dword [0x100af2d0]
push str.NtCreateThread
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtOpenThread
push ecx
mov dword [0x100af270], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtSuspendThread
push edx
mov dword [0x100af274], eax
call esi
mov dword [0x100af278], eax
mov eax, dword [0x100af2d0]
push str.NtResumeThread
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtTerminateThread
push ecx
mov dword [0x100af27c], eax
call esi
mov edx, dword [0x100af2d0]
push str.LdrShutdownThread
push edx
mov dword [0x100af280], eax
call esi
mov dword [0x100af284], eax
push str.NtQueryInformationThread
mov eax, dword [0x100af2d0]
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.NtSetInformationThread
push ecx
mov dword [0x100af288], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlInitUnicodeString
push edx
mov dword [0x100af28c], eax
call esi
mov dword [0x100af290], eax
mov eax, dword [0x100af2d0]
push str.RtlFreeUnicodeString
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlDosPathNameToNtPathName_U
push ecx
mov dword [0x100af294], eax
call esi
mov edx, dword [0x100af2d0]
push str.NtQueryAttributesFile
push edx
mov dword [0x100af298], eax
call esi
mov dword [0x100af29c], eax
mov eax, dword [0x100af2d0]
push str.NtQueryFullAttributesFile
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlConvertSidToUnicodeString
push ecx
mov dword [0x100af2a0], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlCreateSecurityDescriptor
push edx
mov dword [0x100af2a4], eax
call esi
mov dword [0x100af2a8], eax
mov eax, dword [0x100af2d0]
push str.RtlSetDaclSecurityDescriptor
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlInitializeSid
push ecx
mov dword [0x100af2ac], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlSubAuthoritySid
push edx
mov dword [0x100af2b0], eax
call esi
mov dword [0x100af2b4], eax
mov eax, dword [0x100af2d0]
push str.RtlCreateAcl
push eax
call esi
mov ecx, dword [0x100af2d0]
push str.RtlAddAccessAllowedAceEx
push ecx
mov dword [0x100af2b8], eax
call esi
mov edx, dword [0x100af2d0]
push str.RtlGetCurrentDirectory_U
push edx
mov dword [0x100af2bc], eax
call esi
mov dword [0x100af2c0], eax
mov eax, dword [0x100af2d0]
push str.RtlSetCurrentDirectory_U
push eax
call esi
mov ecx, dword [0x100af2d0]
mov dword [0x100af2c4], eax
push str.RtlGetFullPathName_U
push ecx
call esi
mov edx, dword [0x100af2d0]
push str.NtDeleteValueKey
push edx
mov dword [0x100af2c8], eax
call esi
mov dword [0x100af2cc], eax
pop esi
ret