Function at 0x1000a8e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQuerySystemInformation
push str.Ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x10018ecc
push str.Kernel32.dll
mov dword [0x10126b88], eax
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018ed8
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018ee4
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018ef8
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018f08
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018f20
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push 0x10018a58
inc ecx
push str.Kernel32.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000aa0e
push 0x10018a58
push str.Kernel32.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000a9ff
xor eax, eax
jmp 0x1000aa0e
push 0x10018a58
push str.Kernel32.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.ZwOpenProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000aa5c
push str.ZwOpenProcess
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000aa4d
xor eax, eax
jmp 0x1000aa5c
push str.ZwOpenProcess
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.ZwTerminateProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000aaaa
push str.ZwTerminateProcess
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000aa9b
xor eax, eax
jmp 0x1000aaaa
push str.ZwTerminateProcess
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.ZwSuspendProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000aaf8
push str.ZwSuspendProcess
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000aae9
xor eax, eax
jmp 0x1000aaf8
push str.ZwSuspendProcess
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.ZwSuspendThread
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000ab46
push str.ZwSuspendThread
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000ab37
xor eax, eax
jmp 0x1000ab46
push str.ZwSuspendThread
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ecx*4 + 0x10126c38], eax
push str.RtlUserThreadStart
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000ab9a
push str.RtlUserThreadStart
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000ab8b
xor eax, eax
jmp 0x1000ab9a
push str.RtlUserThreadStart
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.NtCreateThread
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000abe8
push str.NtCreateThread
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000abd9
xor eax, eax
jmp 0x1000abe8
push str.NtCreateThread
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.NtCreateThreadEx
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000ac36
push str.NtCreateThreadEx
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000ac27
xor eax, eax
jmp 0x1000ac36
push str.NtCreateThreadEx
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
push str.RtlCreateUserThread
inc ecx
push str.Ntdll.dll
mov dword [0x10126c30], ecx
call edi
push eax
call esi
test eax, eax
je 0x1000ac71
push str.RtlCreateUserThread
push str.Ntdll.dll
call edi
push eax
call esi
cmp byte [eax], 0xe9
jne 0x1000ac75
xor eax, eax
jmp 0x1000ac84
push str.RtlCreateUserThread
push str.Ntdll.dll
call edi
push eax
call esi
mov ecx, dword [0x10126c30]
mov dword [ecx*4 + 0x10126c38], eax
inc ecx
pop edi
mov dword [0x10126c30], ecx
pop esi
jmp fcn.1000aca0