Function at 0x1001a2c0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x1004efd8
push str.Kernel32.dll
mov dword [0x10174964], eax
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004efe4
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004eff0
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004f004
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004f014
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004f02c
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push 0x1004e1fc
inc ecx
push str.Kernel32.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1001a3ee
push 0x1004e1fc
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1001a3df
xor eax, eax
jmp 0x1001a3ee
push 0x1004e1fc
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push str.ZwOpenProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1001a43c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1001a42d
xor eax, eax
jmp 0x1001a43c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push str.ZwTerminateProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1001a48a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1001a47b
xor eax, eax
jmp 0x1001a48a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push str.ZwSuspendProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1001a4d8
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1001a4c9
xor eax, eax
jmp 0x1001a4d8
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
push str.ZwSuspendThread
inc ecx
push str.Ntdll.dll
mov dword [0x1017659c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1001a513
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1001a517
xor eax, eax
jmp 0x1001a526
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1017659c]
mov dword [ecx*4 + 0x101765a0], eax
inc ecx
pop edi
mov dword [0x1017659c], ecx
pop esi
jmp fcn.1001a550