Function at 0x6ec7f0
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0x86bfec
call edi
sub esp, 4
test eax, eax
je 0x6eca2b
mov esi, eax
mov dword [esp + 4], str.RtlNtStatusToDosError
mov dword [esp], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
sub esp, 8
test eax, eax
mov dword [0x949284], eax
je 0x6eca15
mov dword [esp + 4], str.NtDeviceIoControlFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x949278], eax
je 0x6eca15
mov dword [esp + 4], str.NtQueryInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x94925c], eax
je 0x6eca15
mov dword [esp + 4], str.NtSetInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x949270], eax
je 0x6eca15
mov dword [esp + 4], str.NtQueryVolumeInformationFile
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x949258], eax
je 0x6eca15
mov dword [esp + 4], str.NtQueryDirectoryFile
mov dword [esp], esi
call ebx
mov dword [0x949240], eax
mov eax, dword [0x949258]
sub esp, 8
test eax, eax
je 0x6eca15
mov dword [esp + 4], str.NtQuerySystemInformation
mov dword [esp], esi
call ebx
sub esp, 8
test eax, eax
mov dword [0x949248], eax
je 0x6eca15
mov dword [esp], str.kernel32.dll
call edi
sub esp, 4
test eax, eax
mov esi, eax
je 0x6eca2b
mov dword [esp + 4], str.GetQueuedCompletionStatusEx
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x949264], eax
mov dword [esp + 4], str.SetFileCompletionNotificationModes
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x94926c], eax
mov dword [esp + 4], str.CreateSymbolicLinkW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949274], eax
mov dword [esp + 4], str.CancelIoEx
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x94927c], eax
mov dword [esp + 4], str.InitializeConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949244], eax
mov dword [esp + 4], str.SleepConditionVariableCS
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949268], eax
mov dword [esp + 4], str.SleepConditionVariableSRW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949260], eax
mov dword [esp + 4], str.WakeAllConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949250], eax
mov dword [esp + 4], str.WakeConditionVariable
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x94924c], eax
mov dword [esp + 4], str.CancelSynchronousIo
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949280], eax
mov dword [esp + 4], str.GetFinalPathNameByHandleW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x949288], eax
mov dword [esp], str.powrprof.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x6eca0e
mov dword [esp + 4], str.PowerRegisterSuspendResumeNotification
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x949254], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetProcAddress
mov dword [esp], eax
call dbg.uv_fatal_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.GetModuleHandleA
mov dword [esp], eax
call dbg.uv_fatal_error
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop