Function at 0xa68300
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
mov eax, dword [0xaf572c]
push esi
test eax, eax
jne 0xa685bd
push ebx
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.NtAllocateVirtualMemory
push esi
call edi
push str.NtClose
push esi
mov dword [0xaf5714], eax
call edi
push str.NtCreateProcess
push esi
mov dword [0xaf571c], eax
call edi
push str.NtCreateSection
push esi
mov dword [0xaf56cc], eax
call edi
push str.NtCreateThread
push esi
mov dword [0xaf56e4], eax
call edi
push str.NtOpenFile
push esi
mov dword [0xaf5718], eax
call edi
push str.NtProtectVirtualMemory
push esi
mov dword [0xaf5710], eax
call edi
push str.NtQueryInformationProcess
push esi
mov dword [0xaf56d0], eax
call edi
push str.NtQuerySection
push esi
mov dword [0xaf56f4], eax
call edi
push str.NtResumeThread
push esi
mov dword [0xaf56fc], eax
call edi
push str.NtTerminateProcess
push esi
mov dword [0xaf56e8], eax
call edi
push str.NtWriteVirtualMemory
push esi
mov dword [0xaf56d8], eax
call edi
push str.RtlCreateProcessParameters
push esi
mov dword [0xaf56dc], eax
call edi
push str.RtlDestroyProcessParameters
push esi
mov dword [0xaf570c], eax
call edi
push str.RtlDosPathNameToNtPathName_U
push esi
mov dword [0xaf5704], eax
call edi
push str.RtlFreeUnicodeString
push esi
mov dword [0xaf5708], eax
call edi
push str.RtlInitUnicodeString
push esi
mov dword [0xaf56e0], eax
call edi
push str.RtlNtStatusToDosError
push esi
mov dword [0xaf5720], eax
call edi
push str.CsrAllocateCaptureBuffer
push esi
mov dword [0xaf5728], eax
call edi
push str.CsrAllocateMessagePointer
push esi
mov dword [0xaf56f8], eax
call edi
push str.CsrFreeCaptureBuffer
push esi
mov dword [0xaf5724], eax
call edi
push str.CsrClientCallServer
push esi
mov dword [0xaf56ec], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0xaf56f0], eax
call ebx
cmp al, 6
jb 0xa6845a
push str.RtlGetThreadPreferredUILanguages
push esi
call edi
mov dword [0xaf5700], eax
mov eax, dword [0xaf5714]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf571c]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56cc]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56e4]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5718]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5710]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56d0]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56f4]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56fc]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56e8]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56d8]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56dc]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf570c]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5704]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5708]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56e0]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5720]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5728]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56f8]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf5724]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56ec]
test eax, eax
je 0xa6854a
mov eax, dword [0xaf56f0]
mov dword [0xaf572c], 1
test eax, eax
jne 0xa68554
mov dword [0xaf572c], 0
call ebx
pop edi
cmp al, 6
mov eax, dword [0xaf572c]
pop ebx
jb 0xa68577
test eax, eax
je 0xa6857b
mov ecx, dword [0xaf5700]
xor eax, eax
test ecx, ecx
setne al
mov dword [0xaf572c], eax
test eax, eax
jne 0xa685bd
mov esi, dword [esp + 8]
test esi, esi
je 0xa685bd
mov eax, str._Some_NTDLL_exports_not_found__
test eax, eax
je 0xa685a9
push eax
call fcn.00a7e07a
add esp, 4
mov ecx, esi
push eax
push str._Some_NTDLL_exports_not_found__
call fcn.00a15880
mov eax, dword [0xaf572c]
pop esi
ret
xor eax, eax
mov ecx, esi
push eax
push str._Some_NTDLL_exports_not_found__
call fcn.00a15880
mov eax, dword [0xaf572c]
pop esi
ret