Function at 0x180004440
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180001a30
test eax, eax
jne 0x18000445a
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp dword [rbx + 8], 0
jne 0x180004813
inc dword [rbx + 0xc]
cmp dword [rbx + 0xc], 0x64
ja 0x180004452
lea rcx, str.TSysDrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180004452
lea rdx, str.InstallTSysDrv
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.RemoveTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.StartTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.StopTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.InstallAndStartTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.StopAndRemoveTSysDrv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.THideProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TUnHideProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TUnHideAllProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TWaitSSDTMutex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TReleaseSSDTMutex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TBackupSSDT
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TSetRealSSDTFuncAddr
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TSetRealSSDTFuncAddrAll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDT
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDTFunction
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TBackupAndSetRealSSDTShadow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRecoverSSDTShadow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetCurrentShadowSST
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetCurrentNtoskrnlSST
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TGetModuleInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TOHRMCloseHandleProc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf0], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TPrintDbgInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf8], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TEnableProtected
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TDisableProtected
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TAddRegKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRemoveRegKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x180004452
mov rcx, qword [rbx + 0x10]
lea rdx, str.TRemoveAllRegKeys
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x180004452
mov dword [rbx + 8], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret