Function at 0x10124000
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x1013f0ec
push str.Kernel32.dll
mov dword [0x10a76ce0], eax
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x1013f0f8
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x1013f104
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x1013f118
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x1013f128
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x1013f140
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push 0x10135edc
inc ecx
push str.Kernel32.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
test eax, eax
je 0x1012412e
push 0x10135edc
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1012411f
xor eax, eax
jmp 0x1012412e
push 0x10135edc
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push str.ZwOpenProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
test eax, eax
je 0x1012417c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1012416d
xor eax, eax
jmp 0x1012417c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push str.ZwTerminateProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
test eax, eax
je 0x101241ca
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x101241bb
xor eax, eax
jmp 0x101241ca
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push str.ZwSuspendProcess
inc ecx
push str.Ntdll.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
test eax, eax
je 0x10124218
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10124209
xor eax, eax
jmp 0x10124218
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
push str.ZwSuspendThread
inc ecx
push str.Ntdll.dll
mov dword [0x10a772ac], ecx
call esi
push eax
call edi
test eax, eax
je 0x10124253
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10124257
xor eax, eax
jmp 0x10124266
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10a772ac]
mov dword [ecx*4 + 0x10a772b0], eax
inc ecx
pop edi
mov dword [0x10a772ac], ecx
pop esi
jmp fcn.10124290