Function at 0x3b5696d0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x3b59a538]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtOpenFile
push ecx
mov dword [0x3b59a424], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtClose
push edx
mov dword [0x3b59a428], eax
call esi
mov dword [0x3b59a42c], eax
mov eax, dword [0x3b59a538]
push str.NtReadFile
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtWriteFile
push ecx
mov dword [0x3b59a430], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtQueryObject
push edx
mov dword [0x3b59a434], eax
call esi
mov dword [0x3b59a438], eax
mov eax, dword [0x3b59a538]
push str.NtQueryDirectoryFile
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtQueryInformationFile
push ecx
mov dword [0x3b59a43c], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtSetInformationFile
push edx
mov dword [0x3b59a440], eax
call esi
mov dword [0x3b59a444], eax
mov eax, dword [0x3b59a538]
push str.NtQuerySystemInformation
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtDeleteFile
push ecx
mov dword [0x3b59a448], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtQueryVolumeInformationFile
push edx
mov dword [0x3b59a44c], eax
call esi
mov dword [0x3b59a450], eax
mov eax, dword [0x3b59a538]
push str.NtDuplicateObject
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.RtlInitializeCriticalSection
push ecx
mov dword [0x3b59a454], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlDeleteCriticalSection
push edx
mov dword [0x3b59a458], eax
call esi
mov dword [0x3b59a45c], eax
mov eax, dword [0x3b59a538]
push str.RtlEnterCriticalSection
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.RtlLeaveCriticalSection
push ecx
mov dword [0x3b59a460], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlTryEnterCriticalSection
push edx
mov dword [0x3b59a464], eax
call esi
mov dword [0x3b59a468], eax
mov eax, dword [0x3b59a538]
push str.NtOpenDirectoryObject
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtQueryDirectoryObject
push ecx
mov dword [0x3b59a46c], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtOpenSymbolicLinkObject
push edx
mov dword [0x3b59a470], eax
call esi
mov dword [0x3b59a474], eax
mov eax, dword [0x3b59a538]
push str.NtQuerySymbolicLinkObject
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtCreateKey
push ecx
mov dword [0x3b59a478], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtOpenKey
push edx
mov dword [0x3b59a47c], eax
call esi
mov dword [0x3b59a480], eax
mov eax, dword [0x3b59a538]
push str.NtQueryKey
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtQueryValueKey
push ecx
mov dword [0x3b59a484], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtQueryMultipleValueKey
push edx
mov dword [0x3b59a488], eax
call esi
mov dword [0x3b59a48c], eax
mov eax, dword [0x3b59a538]
push str.NtEnumerateKey
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtEnumerateValueKey
push ecx
mov dword [0x3b59a490], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtFlushKey
push edx
mov dword [0x3b59a494], eax
call esi
mov dword [0x3b59a498], eax
mov eax, dword [0x3b59a538]
push str.NtDeleteKey
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtDeleteValueKey
push ecx
mov dword [0x3b59a49c], eax
call esi
mov dword [0x3b59a4a0], eax
mov edx, dword [0x3b59a538]
push str.NtSetInformationKey
push edx
call esi
mov dword [0x3b59a4a4], eax
mov eax, dword [0x3b59a538]
push str.NtSetValueKey
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtNotifyChangeKey
push ecx
mov dword [0x3b59a4a8], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtNotifyChangeMultipleKeys
push edx
mov dword [0x3b59a4ac], eax
call esi
mov dword [0x3b59a4b0], eax
mov eax, dword [0x3b59a538]
push str.NtCreateProcess
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtCreateProcessEx
push ecx
mov dword [0x3b59a4b4], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtOpenProcess
push edx
mov dword [0x3b59a4b8], eax
call esi
mov dword [0x3b59a4bc], eax
mov eax, dword [0x3b59a538]
push str.NtTerminateProcess
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.LdrShutdownProcess
push ecx
mov dword [0x3b59a4c0], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtQueryInformationProcess
push edx
mov dword [0x3b59a4c4], eax
call esi
mov dword [0x3b59a4c8], eax
mov eax, dword [0x3b59a538]
push str.NtSetInformationProcess
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtCreateThread
push ecx
mov dword [0x3b59a4cc], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtOpenThread
push edx
mov dword [0x3b59a4d0], eax
call esi
mov dword [0x3b59a4d4], eax
mov eax, dword [0x3b59a538]
push str.NtSuspendThread
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtResumeThread
push ecx
mov dword [0x3b59a4d8], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtTerminateThread
push edx
mov dword [0x3b59a4dc], eax
call esi
mov dword [0x3b59a4e0], eax
push str.LdrShutdownThread
mov eax, dword [0x3b59a538]
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtQueryInformationThread
push ecx
mov dword [0x3b59a4e4], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtSetInformationThread
push edx
mov dword [0x3b59a4e8], eax
call esi
mov dword [0x3b59a4ec], eax
mov eax, dword [0x3b59a538]
push str.RtlInitUnicodeString
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.RtlFreeUnicodeString
push ecx
mov dword [0x3b59a4f0], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlDosPathNameToNtPathName_U
push edx
mov dword [0x3b59a4f4], eax
call esi
mov dword [0x3b59a4f8], eax
mov eax, dword [0x3b59a538]
push str.NtQueryAttributesFile
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtQueryFullAttributesFile
push ecx
mov dword [0x3b59a4fc], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlConvertSidToUnicodeString
push edx
mov dword [0x3b59a500], eax
call esi
mov dword [0x3b59a504], eax
mov eax, dword [0x3b59a538]
push str.RtlCreateSecurityDescriptor
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.RtlSetDaclSecurityDescriptor
push ecx
mov dword [0x3b59a508], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlInitializeSid
push edx
mov dword [0x3b59a50c], eax
call esi
mov dword [0x3b59a510], eax
mov eax, dword [0x3b59a538]
push str.RtlSubAuthoritySid
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.RtlCreateAcl
push ecx
mov dword [0x3b59a514], eax
call esi
mov edx, dword [0x3b59a538]
push str.RtlAddAccessAllowedAceEx
push edx
mov dword [0x3b59a518], eax
call esi
mov dword [0x3b59a51c], eax
mov eax, dword [0x3b59a538]
push str.RtlGetCurrentDirectory_U
push eax
call esi
mov ecx, dword [0x3b59a538]
mov dword [0x3b59a520], eax
push str.RtlSetCurrentDirectory_U
push ecx
call esi
mov edx, dword [0x3b59a538]
push str.RtlGetFullPathName_U
push edx
mov dword [0x3b59a524], eax
call esi
mov dword [0x3b59a528], eax
mov eax, dword [0x3b59a538]
push str.RtlFormatCurrentUserKeyPath
push eax
call esi
mov ecx, dword [0x3b59a538]
push str.NtRenameKey
push ecx
mov dword [0x3b59a52c], eax
call esi
mov edx, dword [0x3b59a538]
push str.NtCreateDirectoryObject
push edx
mov dword [0x3b59a530], eax
call esi
mov dword [0x3b59a534], eax
pop esi
ret