Function at 0x10015d50
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10025978
push str.Kernel32.dll
mov dword [0x1015809c], eax
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x10027294
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x100272a0
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x100272b4
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x100272c4
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x100272dc
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push 0x10024a60
inc ecx
push str.Kernel32.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
test eax, eax
je 0x10015e7e
push 0x10024a60
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10015e6f
xor eax, eax
jmp 0x10015e7e
push 0x10024a60
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push str.ZwOpenProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
test eax, eax
je 0x10015ecc
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10015ebd
xor eax, eax
jmp 0x10015ecc
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push str.ZwTerminateProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
test eax, eax
je 0x10015f1a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10015f0b
xor eax, eax
jmp 0x10015f1a
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push str.ZwSuspendProcess
inc ecx
push str.Ntdll.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
test eax, eax
je 0x10015f68
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10015f59
xor eax, eax
jmp 0x10015f68
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
push str.ZwSuspendThread
inc ecx
push str.Ntdll.dll
mov dword [0x1015d244], ecx
call esi
push eax
call edi
test eax, eax
je 0x10015fa3
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10015fa7
xor eax, eax
jmp 0x10015fb6
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x1015d244]
mov dword [ecx*4 + 0x1015d248], eax
inc ecx
pop edi
mov dword [0x1015d244], ecx
pop esi
jmp fcn.10015fe0