Function at 0x122a5606
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push str.NtCreateFile
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10d0], eax
push str.NtOpenFile
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10d4], eax
push str.NtClose
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10d8], eax
push str.NtReadFile
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10dc], eax
push str.NtWriteFile
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10e0], eax
push str.NtQueryObject
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10e4], eax
push str.NtQueryDirectoryFile
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10e8], eax
push str.NtQueryDirectoryFileEx
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10ec], eax
push str.NtQueryInformationFile
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10f0], eax
push str.NtSetInformationFile
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10f4], eax
push str.NtQuerySystemInformation
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10f8], eax
push str.NtDeleteFile
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b10fc], eax
push str.NtQueryVolumeInformationFile
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1100], eax
push str.NtDuplicateObject
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1104], eax
push str.RtlInitializeCriticalSection
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1108], eax
push str.RtlDeleteCriticalSection
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b110c], eax
push str.RtlEnterCriticalSection
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1110], eax
push str.RtlLeaveCriticalSection
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1114], eax
push str.RtlTryEnterCriticalSection
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1118], eax
push str.NtOpenDirectoryObject
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b111c], eax
push str.NtQueryDirectoryObject
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1120], eax
push str.NtOpenSymbolicLinkObject
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1124], eax
push str.NtQuerySymbolicLinkObject
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1128], eax
push str.NtCreateKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b112c], eax
push str.NtOpenKey
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1130], eax
push str.NtQueryKey
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1134], eax
push str.NtQueryValueKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1138], eax
push str.NtQueryMultipleValueKey
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b113c], eax
push str.NtEnumerateKey
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1140], eax
push str.NtEnumerateValueKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1144], eax
push str.NtFlushKey
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1148], eax
push str.NtDeleteKey
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b114c], eax
push str.NtDeleteValueKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1150], eax
push str.NtSetInformationKey
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1154], eax
push str.NtSetValueKey
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1158], eax
push str.NtNotifyChangeKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b115c], eax
push str.NtNotifyChangeMultipleKeys
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1160], eax
push str.NtCreateProcess
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1164], eax
push str.NtCreateProcessEx
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1168], eax
push str.NtOpenProcess
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b116c], eax
push str.NtTerminateProcess
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1170], eax
push str.LdrShutdownProcess
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1174], eax
push str.NtQueryInformationProcess
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1178], eax
push str.NtSetInformationProcess
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b117c], eax
push str.NtCreateThread
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1180], eax
push str.NtOpenThread
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1184], eax
push str.NtSuspendThread
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1188], eax
push str.NtResumeThread
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b118c], eax
push str.NtTerminateThread
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1190], eax
push str.LdrShutdownThread
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1194], eax
push str.NtQueryInformationThread
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b1198], eax
push str.NtSetInformationThread
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b119c], eax
push str.RtlInitUnicodeString
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11a0], eax
push str.RtlFreeUnicodeString
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11a4], eax
push str.RtlDosPathNameToNtPathName_U
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11a8], eax
push str.NtQueryAttributesFile
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11ac], eax
push str.NtQueryFullAttributesFile
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11b0], eax
push str.RtlConvertSidToUnicodeString
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11b4], eax
push str.RtlCreateSecurityDescriptor
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11b8], eax
push str.RtlSetDaclSecurityDescriptor
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11bc], eax
push str.RtlInitializeSid
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11c0], eax
push str.RtlSubAuthoritySid
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11c4], eax
push str.RtlCreateAcl
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11c8], eax
push str.RtlAddAccessAllowedAceEx
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11cc], eax
push str.RtlGetCurrentDirectory_U
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11d0], eax
push str.RtlSetCurrentDirectory_U
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11d4], eax
push str.RtlGetFullPathName_U
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11d8], eax
push str.RtlFormatCurrentUserKeyPath
mov ecx, dword [0x123b11e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11dc], eax
push str.NtRenameKey
mov edx, dword [0x123b11e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11e0], eax
push str.NtCreateDirectoryObject
mov eax, dword [0x123b11e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x123b11e4], eax
pop ebp
ret