Function at 0x10060c00
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtQuerySystemInformation
push str.Ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x100abbec
push str.Kernel32.dll
mov dword [0x101d95b0], eax
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push 0x100abc0c
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push 0x100abbf8
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push str.CreateThread
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push 0x100abc18
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push 0x100abc50
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push 0x100abc40
push str.Kernel32.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10060d2e
push 0x100abc40
push str.Kernel32.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10060d1f
xor eax, eax
jmp 0x10060d2e
push 0x100abc40
push str.Kernel32.dll
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push str.ZwOpenProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10060d7c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10060d6d
xor eax, eax
jmp 0x10060d7c
push str.ZwOpenProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push str.ZwTerminateProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10060dca
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10060dbb
xor eax, eax
jmp 0x10060dca
push str.ZwTerminateProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push str.ZwSuspendProcess
push str.Ntdll.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10060e18
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10060e09
xor eax, eax
jmp 0x10060e18
push str.ZwSuspendProcess
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
push str.ZwSuspendThread
push str.Ntdll.dll
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
call esi
push eax
call edi
test eax, eax
je 0x10060e53
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
cmp byte [eax], 0xe9
jne 0x10060e57
xor eax, eax
jmp 0x10060e66
push str.ZwSuspendThread
push str.Ntdll.dll
call esi
push eax
call edi
mov ecx, dword [0x101d9758]
pop edi
pop esi
mov dword [ecx*4 + 0x101d9658], eax
inc ecx
mov dword [0x101d9758], ecx
jmp fcn.10060e90