Function at 0x1305ca60
Capabilities:
Link many functions at runtime
Rebuild import table

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.130729d0
test eax, eax
jne 0x1305ca70
pop edi
pop esi
ret
call fcn.130728f0
test eax, eax
je 0x1305ca7e
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x1305ca8d
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 8]
inc ecx
mov eax, ecx
mov dword [esi + 8], ecx
cmp eax, 0x64
jbe 0x1305caa0
pop edi
xor eax, eax
pop esi
ret
push str.tsysdrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x1305cab5
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x1305cacd
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.RemoveTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x1305cae2
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StartTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x1305caf7
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.StopTSysDrv
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x1305cb0c
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.InstallAndStartTSysDrv
push eax
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x1305cb21
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.StopAndRemoveTSysDrv
push ecx
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x1305cb36
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.THideProcess
push edx
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x1305cb4b
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TUnHideProcess
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x1305cb60
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TUnHideAllProcess
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x1305cb75
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TWaitSSDTMutex
push edx
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x1305cb8a
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TReleaseSSDTMutex
push eax
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x1305cb9f
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TBackupSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x1305cbb4
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddr
push edx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x1305cbc9
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TSetRealSSDTFuncAddrAll
push eax
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x1305cbde
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDT
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
jne 0x1305cbf3
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRecoverSSDTFunction
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x1305cc08
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TBackupAndSetRealSSDTShadow
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x1305cc1d
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRecoverSSDTShadow
push ecx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x1305cc32
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TGetCurrentShadowSST
push edx
call edi
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x1305cc47
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TGetCurrentNtoskrnlSST
push eax
call edi
test eax, eax
mov dword [esi + 0x70], eax
jne 0x1305cc5c
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TGetModuleInfo
push ecx
call edi
test eax, eax
mov dword [esi + 0x74], eax
jne 0x1305cc71
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHCloseHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x78], eax
jne 0x1305cc86
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TOHRMCloseHandleProc
push eax
call edi
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x1305cc9b
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TOHQueryHandle
push ecx
call edi
test eax, eax
mov dword [esi + 0x80], eax
jne 0x1305ccb3
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TOHQueryFileHandle
push edx
call edi
test eax, eax
mov dword [esi + 0x84], eax
jne 0x1305cccb
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TPrintDbgInfo
push eax
call edi
test eax, eax
mov dword [esi + 0x88], eax
jne 0x1305cce3
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TEnableProtected
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x1305ccf8
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TDisableProtected
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x1305cd0d
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.TAddRegKey
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x1305cd22
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.TRemoveRegKey
push ecx
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x1305cd37
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.TRemoveAllRegKeys
push edx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x1305cd4c
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
push str.Init
push eax
call edi
test eax, eax
mov dword [esi + 0x8c], eax
jne 0x1305cd64
pop edi
pop esi
ret
mov ecx, dword [esi + 0xc]
push str.GetPortVal
push ecx
call edi
test eax, eax
mov dword [esi + 0x90], eax
jne 0x1305cd7c
pop edi
pop esi
ret
mov edx, dword [esi + 0xc]
push str.SetPortVal
push edx
call edi
test eax, eax
mov dword [esi + 0x94], eax
jne 0x1305cd94
pop edi
pop esi
ret
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret