Function at 0x340959d6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push str.NtCreateFile
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55d0], eax
push str.NtOpenFile
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55d4], eax
push str.NtClose
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55d8], eax
push str.NtReadFile
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55dc], eax
push str.NtWriteFile
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55e0], eax
push str.NtQueryObject
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55e4], eax
push str.NtQueryDirectoryFile
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55e8], eax
push str.NtQueryDirectoryFileEx
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55ec], eax
push str.NtQueryInformationFile
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55f0], eax
push str.NtSetInformationFile
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55f4], eax
push str.NtQuerySystemInformation
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55f8], eax
push str.NtDeleteFile
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a55fc], eax
push str.NtQueryVolumeInformationFile
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5600], eax
push str.NtDuplicateObject
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5604], eax
push str.RtlInitializeCriticalSection
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5608], eax
push str.RtlDeleteCriticalSection
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a560c], eax
push str.RtlEnterCriticalSection
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5610], eax
push str.RtlLeaveCriticalSection
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5614], eax
push str.RtlTryEnterCriticalSection
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5618], eax
push str.NtOpenDirectoryObject
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a561c], eax
push str.NtQueryDirectoryObject
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5620], eax
push str.NtOpenSymbolicLinkObject
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5624], eax
push str.NtQuerySymbolicLinkObject
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5628], eax
push str.NtCreateKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a562c], eax
push str.NtOpenKey
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5630], eax
push str.NtQueryKey
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5634], eax
push str.NtQueryValueKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5638], eax
push str.NtQueryMultipleValueKey
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a563c], eax
push str.NtEnumerateKey
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5640], eax
push str.NtEnumerateValueKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5644], eax
push str.NtFlushKey
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5648], eax
push str.NtDeleteKey
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a564c], eax
push str.NtDeleteValueKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5650], eax
push str.NtSetInformationKey
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5654], eax
push str.NtSetValueKey
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5658], eax
push str.NtNotifyChangeKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a565c], eax
push str.NtNotifyChangeMultipleKeys
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5660], eax
push str.NtCreateProcess
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5664], eax
push str.NtCreateProcessEx
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5668], eax
push str.NtOpenProcess
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a566c], eax
push str.NtTerminateProcess
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5670], eax
push str.LdrShutdownProcess
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5674], eax
push str.NtQueryInformationProcess
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5678], eax
push str.NtSetInformationProcess
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a567c], eax
push str.NtCreateThread
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5680], eax
push str.NtOpenThread
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5684], eax
push str.NtSuspendThread
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5688], eax
push str.NtResumeThread
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a568c], eax
push str.NtTerminateThread
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5690], eax
push str.LdrShutdownThread
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5694], eax
push str.NtQueryInformationThread
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a5698], eax
push str.NtSetInformationThread
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a569c], eax
push str.RtlInitUnicodeString
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56a0], eax
push str.RtlFreeUnicodeString
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56a4], eax
push str.RtlDosPathNameToNtPathName_U
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56a8], eax
push str.NtQueryAttributesFile
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56ac], eax
push str.NtQueryFullAttributesFile
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56b0], eax
push str.RtlConvertSidToUnicodeString
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56b4], eax
push str.RtlCreateSecurityDescriptor
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56b8], eax
push str.RtlSetDaclSecurityDescriptor
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56bc], eax
push str.RtlInitializeSid
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56c0], eax
push str.RtlSubAuthoritySid
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56c4], eax
push str.RtlCreateAcl
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56c8], eax
push str.RtlAddAccessAllowedAceEx
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56cc], eax
push str.RtlGetCurrentDirectory_U
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56d0], eax
push str.RtlSetCurrentDirectory_U
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56d4], eax
push str.RtlGetFullPathName_U
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56d8], eax
push str.RtlFormatCurrentUserKeyPath
mov ecx, dword [0x341a56e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56dc], eax
push str.NtRenameKey
mov edx, dword [0x341a56e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56e0], eax
push str.NtCreateDirectoryObject
mov eax, dword [0x341a56e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a56e4], eax
pop ebp
ret