Function at 0x11ed1310
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x12134a60]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1203be14
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x1203be08
push ecx
mov dword [0x12134944], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cc46c
push edx
mov dword [0x12134948], eax
call esi
mov dword [0x1213494c], eax
mov eax, dword [0x12134a60]
push str.NtReadFile
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cc2f0
push ecx
mov dword [0x12134950], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cc374
push edx
mov dword [0x12134954], eax
call esi
mov dword [0x12134958], eax
mov eax, dword [0x12134a60]
push 0x120cc35c
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtQueryDirectoryFileEx
push ecx
mov dword [0x1213495c], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cc384
push edx
mov dword [0x12134960], eax
call esi
mov dword [0x12134964], eax
mov eax, dword [0x12134a60]
push 0x120cc32c
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtQuerySystemInformation
push ecx
mov dword [0x12134968], eax
call esi
mov edx, dword [0x12134a60]
push str.NtDeleteFile
push edx
mov dword [0x1213496c], eax
call esi
mov dword [0x12134970], eax
mov eax, dword [0x12134a60]
push str.NtQueryVolumeInformationFile
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtDuplicateObject
push ecx
mov dword [0x12134974], eax
call esi
mov edx, dword [0x12134a60]
push str.RtlInitializeCriticalSection
push edx
mov dword [0x12134978], eax
call esi
mov dword [0x1213497c], eax
mov eax, dword [0x12134a60]
push str.RtlDeleteCriticalSection
push eax
call esi
mov ecx, dword [0x12134a60]
push str.RtlEnterCriticalSection
push ecx
mov dword [0x12134980], eax
call esi
mov edx, dword [0x12134a60]
push str.RtlLeaveCriticalSection
push edx
mov dword [0x12134984], eax
call esi
mov dword [0x12134988], eax
mov eax, dword [0x12134a60]
push str.RtlTryEnterCriticalSection
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtOpenDirectoryObject
push ecx
mov dword [0x1213498c], eax
call esi
mov edx, dword [0x12134a60]
push str.NtQueryDirectoryObject
push edx
mov dword [0x12134990], eax
call esi
mov dword [0x12134994], eax
mov eax, dword [0x12134a60]
push str.NtOpenSymbolicLinkObject
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtQuerySymbolicLinkObject
push ecx
mov dword [0x12134998], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cbe1c
push edx
mov dword [0x1213499c], eax
call esi
mov dword [0x121349a0], eax
mov eax, dword [0x12134a60]
push 0x120cbe10
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cbdec
push ecx
mov dword [0x121349a4], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cbd54
push edx
mov dword [0x121349a8], eax
call esi
mov dword [0x121349ac], eax
mov eax, dword [0x12134a60]
push 0x120cbd3c
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cbddc
push ecx
mov dword [0x121349b0], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cbd28
push edx
mov dword [0x121349b4], eax
call esi
mov dword [0x121349b8], eax
mov eax, dword [0x12134a60]
push str.NtFlushKey
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cbdf8
push ecx
mov dword [0x121349bc], eax
call esi
mov dword [0x121349c0], eax
mov edx, dword [0x12134a60]
push 0x120cbd74
push edx
call esi
mov dword [0x121349c4], eax
mov eax, dword [0x12134a60]
push str.NtSetInformationKey
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cbd64
push ecx
mov dword [0x121349c8], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cbdc8
push edx
mov dword [0x121349cc], eax
call esi
mov dword [0x121349d0], eax
mov eax, dword [0x12134a60]
push 0x120cbdac
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtCreateProcess
push ecx
mov dword [0x121349d4], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cc8f0
push edx
mov dword [0x121349d8], eax
call esi
mov dword [0x121349dc], eax
mov eax, dword [0x12134a60]
push str.NtOpenProcess
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtTerminateProcess
push ecx
mov dword [0x121349e0], eax
call esi
mov edx, dword [0x12134a60]
push str.LdrShutdownProcess
push edx
mov dword [0x121349e4], eax
call esi
mov dword [0x121349e8], eax
mov eax, dword [0x12134a60]
push str.NtQueryInformationProcess
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtSetInformationProcess
push ecx
mov dword [0x121349ec], eax
call esi
mov edx, dword [0x12134a60]
push str.NtCreateThread
push edx
mov dword [0x121349f0], eax
call esi
mov dword [0x121349f4], eax
mov eax, dword [0x12134a60]
push str.NtOpenThread
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtSuspendThread
push ecx
mov dword [0x121349f8], eax
call esi
mov edx, dword [0x12134a60]
push str.NtResumeThread
push edx
mov dword [0x121349fc], eax
call esi
mov dword [0x12134a00], eax
push str.NtTerminateThread
mov eax, dword [0x12134a60]
push eax
call esi
mov ecx, dword [0x12134a60]
push str.LdrShutdownThread
push ecx
mov dword [0x12134a04], eax
call esi
mov edx, dword [0x12134a60]
push str.NtQueryInformationThread
push edx
mov dword [0x12134a08], eax
call esi
mov dword [0x12134a0c], eax
mov eax, dword [0x12134a60]
push str.NtSetInformationThread
push eax
call esi
mov ecx, dword [0x12134a60]
push str.RtlInitUnicodeString
push ecx
mov dword [0x12134a10], eax
call esi
mov edx, dword [0x12134a60]
push str.RtlFreeUnicodeString
push edx
mov dword [0x12134a14], eax
call esi
mov dword [0x12134a18], eax
mov eax, dword [0x12134a60]
push str.RtlDosPathNameToNtPathName_U
push eax
call esi
mov ecx, dword [0x12134a60]
push 0x120cc39c
push ecx
mov dword [0x12134a1c], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cc3b4
push edx
mov dword [0x12134a20], eax
call esi
mov dword [0x12134a24], eax
mov eax, dword [0x12134a60]
push str.RtlConvertSidToUnicodeString
push eax
call esi
mov ecx, dword [0x12134a60]
push str.RtlCreateSecurityDescriptor
push ecx
mov dword [0x12134a28], eax
call esi
mov edx, dword [0x12134a60]
push str.RtlSetDaclSecurityDescriptor
push edx
mov dword [0x12134a2c], eax
call esi
mov dword [0x12134a30], eax
mov eax, dword [0x12134a60]
push str.RtlInitializeSid
push eax
call esi
mov ecx, dword [0x12134a60]
push str.RtlSubAuthoritySid
push ecx
mov dword [0x12134a34], eax
call esi
mov edx, dword [0x12134a60]
push str.RtlCreateAcl
push edx
mov dword [0x12134a38], eax
call esi
mov dword [0x12134a3c], eax
mov eax, dword [0x12134a60]
push str.RtlAddAccessAllowedAceEx
push eax
call esi
mov ecx, dword [0x12134a60]
mov dword [0x12134a40], eax
push str.RtlGetCurrentDirectory_U
push ecx
call esi
mov edx, dword [0x12134a60]
push str.RtlSetCurrentDirectory_U
push edx
mov dword [0x12134a44], eax
call esi
mov dword [0x12134a48], eax
mov eax, dword [0x12134a60]
push str.RtlGetFullPathName_U
push eax
call esi
mov ecx, dword [0x12134a60]
push str.RtlFormatCurrentUserKeyPath
push ecx
mov dword [0x12134a4c], eax
call esi
mov edx, dword [0x12134a60]
push 0x120cbd88
push edx
mov dword [0x12134a50], eax
call esi
mov dword [0x12134a54], eax
mov eax, dword [0x12134a60]
push str.NtCreateDirectoryObject
push eax
call esi
mov ecx, dword [0x12134a60]
push str.NtCreateToken
push ecx
mov dword [0x12134a58], eax
call esi
mov dword [0x12134a5c], eax
pop esi
ret