Function at 0x11bf5b30
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x11c0615c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtOpenFile
push ecx
mov dword [0x11c06048], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtClose
push edx
mov dword [0x11c0604c], eax
call esi
mov dword [0x11c06050], eax
mov eax, dword [0x11c0615c]
push str.NtReadFile
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtWriteFile
push ecx
mov dword [0x11c06054], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtQueryObject
push edx
mov dword [0x11c06058], eax
call esi
mov dword [0x11c0605c], eax
mov eax, dword [0x11c0615c]
push str.NtQueryDirectoryFile
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtQueryInformationFile
push ecx
mov dword [0x11c06060], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtSetInformationFile
push edx
mov dword [0x11c06064], eax
call esi
mov dword [0x11c06068], eax
mov eax, dword [0x11c0615c]
push str.NtQuerySystemInformation
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtDeleteFile
push ecx
mov dword [0x11c0606c], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtQueryVolumeInformationFile
push edx
mov dword [0x11c06070], eax
call esi
mov dword [0x11c06074], eax
mov eax, dword [0x11c0615c]
push str.NtDuplicateObject
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.RtlInitializeCriticalSection
push ecx
mov dword [0x11c06078], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlDeleteCriticalSection
push edx
mov dword [0x11c0607c], eax
call esi
mov dword [0x11c06080], eax
mov eax, dword [0x11c0615c]
push str.RtlEnterCriticalSection
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.RtlLeaveCriticalSection
push ecx
mov dword [0x11c06084], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlTryEnterCriticalSection
push edx
mov dword [0x11c06088], eax
call esi
mov dword [0x11c0608c], eax
mov eax, dword [0x11c0615c]
push str.NtOpenDirectoryObject
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtQueryDirectoryObject
push ecx
mov dword [0x11c06090], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtOpenSymbolicLinkObject
push edx
mov dword [0x11c06094], eax
call esi
mov dword [0x11c06098], eax
mov eax, dword [0x11c0615c]
push str.NtQuerySymbolicLinkObject
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtCreateKey
push ecx
mov dword [0x11c0609c], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtOpenKey
push edx
mov dword [0x11c060a0], eax
call esi
mov dword [0x11c060a4], eax
mov eax, dword [0x11c0615c]
push str.NtQueryKey
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtQueryValueKey
push ecx
mov dword [0x11c060a8], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtQueryMultipleValueKey
push edx
mov dword [0x11c060ac], eax
call esi
mov dword [0x11c060b0], eax
mov eax, dword [0x11c0615c]
push str.NtEnumerateKey
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtEnumerateValueKey
push ecx
mov dword [0x11c060b4], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtFlushKey
push edx
mov dword [0x11c060b8], eax
call esi
mov dword [0x11c060bc], eax
mov eax, dword [0x11c0615c]
push str.NtDeleteKey
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtDeleteValueKey
push ecx
mov dword [0x11c060c0], eax
call esi
mov dword [0x11c060c4], eax
mov edx, dword [0x11c0615c]
push str.NtSetInformationKey
push edx
call esi
mov dword [0x11c060c8], eax
mov eax, dword [0x11c0615c]
push str.NtSetValueKey
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtNotifyChangeKey
push ecx
mov dword [0x11c060cc], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtNotifyChangeMultipleKeys
push edx
mov dword [0x11c060d0], eax
call esi
mov dword [0x11c060d4], eax
mov eax, dword [0x11c0615c]
push str.NtCreateProcess
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtCreateProcessEx
push ecx
mov dword [0x11c060d8], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtOpenProcess
push edx
mov dword [0x11c060dc], eax
call esi
mov dword [0x11c060e0], eax
mov eax, dword [0x11c0615c]
push str.NtTerminateProcess
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.LdrShutdownProcess
push ecx
mov dword [0x11c060e4], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtQueryInformationProcess
push edx
mov dword [0x11c060e8], eax
call esi
mov dword [0x11c060ec], eax
mov eax, dword [0x11c0615c]
push str.NtSetInformationProcess
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtCreateThread
push ecx
mov dword [0x11c060f0], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtOpenThread
push edx
mov dword [0x11c060f4], eax
call esi
mov dword [0x11c060f8], eax
mov eax, dword [0x11c0615c]
push str.NtSuspendThread
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtResumeThread
push ecx
mov dword [0x11c060fc], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtTerminateThread
push edx
mov dword [0x11c06100], eax
call esi
mov dword [0x11c06104], eax
push str.LdrShutdownThread
mov eax, dword [0x11c0615c]
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtQueryInformationThread
push ecx
mov dword [0x11c06108], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtSetInformationThread
push edx
mov dword [0x11c0610c], eax
call esi
mov dword [0x11c06110], eax
mov eax, dword [0x11c0615c]
push str.RtlInitUnicodeString
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.RtlFreeUnicodeString
push ecx
mov dword [0x11c06114], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlDosPathNameToNtPathName_U
push edx
mov dword [0x11c06118], eax
call esi
mov dword [0x11c0611c], eax
mov eax, dword [0x11c0615c]
push str.NtQueryAttributesFile
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtQueryFullAttributesFile
push ecx
mov dword [0x11c06120], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlConvertSidToUnicodeString
push edx
mov dword [0x11c06124], eax
call esi
mov dword [0x11c06128], eax
mov eax, dword [0x11c0615c]
push str.RtlCreateSecurityDescriptor
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.RtlSetDaclSecurityDescriptor
push ecx
mov dword [0x11c0612c], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlInitializeSid
push edx
mov dword [0x11c06130], eax
call esi
mov dword [0x11c06134], eax
mov eax, dword [0x11c0615c]
push str.RtlSubAuthoritySid
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.RtlCreateAcl
push ecx
mov dword [0x11c06138], eax
call esi
mov edx, dword [0x11c0615c]
push str.RtlAddAccessAllowedAceEx
push edx
mov dword [0x11c0613c], eax
call esi
mov dword [0x11c06140], eax
mov eax, dword [0x11c0615c]
push str.RtlGetCurrentDirectory_U
push eax
call esi
mov ecx, dword [0x11c0615c]
mov dword [0x11c06144], eax
push str.RtlSetCurrentDirectory_U
push ecx
call esi
mov edx, dword [0x11c0615c]
push str.RtlGetFullPathName_U
push edx
mov dword [0x11c06148], eax
call esi
mov dword [0x11c0614c], eax
mov eax, dword [0x11c0615c]
push str.RtlFormatCurrentUserKeyPath
push eax
call esi
mov ecx, dword [0x11c0615c]
push str.NtRenameKey
push ecx
mov dword [0x11c06150], eax
call esi
mov edx, dword [0x11c0615c]
push str.NtCreateDirectoryObject
push edx
mov dword [0x11c06154], eax
call esi
mov dword [0x11c06158], eax
pop esi
ret