Function at 0x1000a470
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x1002b254
push str.Kernel32.dll
mov dword [0x1013bcd8], eax
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002b260
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002b26c
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002b280
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002b290
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002b2a8
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push 0x1002afc8
push str.Kernel32.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000a59e
push 0x1002afc8
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000a58f
xor eax, eax
jmp 0x1000a59e
push 0x1002afc8
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push str.ZwOpenProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000a5ec
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000a5dd
xor eax, eax
jmp 0x1000a5ec
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push str.ZwTerminateProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000a63a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000a62b
xor eax, eax
jmp 0x1000a63a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push str.ZwSuspendProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000a688
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000a679
xor eax, eax
jmp 0x1000a688
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
push str.ZwSuspendThread
push str.Ntdll.dll
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000a6c3
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000a6c7
xor eax, eax
jmp 0x1000a6d6
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1013bdf8]
pop edi
pop esi
mov dword [ecx*4 + 0x1013bcf8], eax
inc ecx
mov dword [0x1013bdf8], ecx
jmp fcn.1000a700