Function at 0x10061080
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x100acc14
push str.Kernel32.dll
mov dword [0x101da5b0], eax
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push 0x100acc34
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push 0x100acc20
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push str.CreateThread
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push 0x100acc40
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push 0x100acc78
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push 0x100acc68
push str.Kernel32.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
test eax, eax
je 0x100611ae
push 0x100acc68
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1006119f
xor eax, eax
jmp 0x100611ae
push 0x100acc68
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push str.ZwOpenProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
test eax, eax
je 0x100611fc
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x100611ed
xor eax, eax
jmp 0x100611fc
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push str.ZwTerminateProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
test eax, eax
je 0x1006124a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1006123b
xor eax, eax
jmp 0x1006124a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push str.ZwSuspendProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10061298
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10061289
xor eax, eax
jmp 0x10061298
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101da758]
push str.ZwSuspendThread
push str.Ntdll.dll
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
call esi
push eax
call edi
test eax, eax
je 0x100612d3
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x100612d7
xor eax, eax
jmp 0x100612e6
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101da758]
pop edi
pop esi
mov dword [ecx*4 + 0x101da658], eax
inc ecx
mov dword [0x101da758], ecx
jmp fcn.10061310