Function at 0x1000ef20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x1001a084
push str.Kernel32.dll
mov dword [0x10d7b348], eax
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push str.ExitProcess
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push 0x1001a09c
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push 0x1001a0b0
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push 0x1001a0c0
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push 0x1001a0d8
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push 0x10019a9c
push str.Kernel32.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000f04e
push 0x10019a9c
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000f03f
xor eax, eax
jmp 0x1000f04e
push 0x10019a9c
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push str.ZwOpenProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000f09c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000f08d
xor eax, eax
jmp 0x1000f09c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push str.ZwTerminateProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000f0ea
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000f0db
xor eax, eax
jmp 0x1000f0ea
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push str.ZwSuspendProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000f138
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000f129
xor eax, eax
jmp 0x1000f138
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
push str.ZwSuspendThread
push str.Ntdll.dll
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
call esi
push eax
call edi
test eax, eax
je 0x1000f173
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x1000f177
xor eax, eax
jmp 0x1000f186
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x10d7b36c]
pop edi
pop esi
mov dword [ecx*4 + 0x10d7b370], eax
inc ecx
mov dword [0x10d7b36c], ecx
jmp fcn.1000f1b0