Function at 0x10053d80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], ebx
cmp dword [0x1008f8bc], ebx
jne 0x10053dc5
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053dc5
push str.NtQueryInformationProcess
push esi
call edi
mov dword [0x1008f8bc], eax
cmp eax, ebx
jne 0x10053dc5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1008f8c0], ebx
je 0x10053dd5
cmp dword [0x1008f8c4], ebx
jne 0x10053e13
push 0x1005f384
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053e13
push str.CreateRemoteThread
push esi
call edi
push str.IsWow64Process
push esi
mov dword [0x1008f8c0], eax
call edi
mov dword [0x1008f8c4], eax
cmp dword [0x1008f8c0], ebx
jne 0x10053e13
cmp eax, ebx
jne 0x10053e13
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1008f8c8], ebx
je 0x10053e23
cmp dword [0x1008f8cc], ebx
jne 0x10053e6d
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053e6d
push str.EnumProcessModules
push esi
call edi
push str.GetModuleBaseNameW
push esi
mov dword [0x1008f8c8], eax
call edi
mov dword [0x1008f8cc], eax
cmp dword [0x1008f8c8], ebx
je 0x10053e5a
cmp eax, ebx
jne 0x10053e6d
push esi
mov dword [0x1008f8c8], ebx
mov dword [0x1008f8cc], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1008f8d0], ebx
je 0x10053e85
cmp dword [0x1008f8d4], ebx
je 0x10053e85
cmp dword [0x1008f8d8], ebx
jne 0x10053eea
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053eea
push 0x1007bae8
push esi
call edi
push 0x1007bad4
push esi
mov dword [0x1008f8d0], eax
call edi
push 0x1007bac0
push esi
mov dword [0x1008f8d4], eax
call edi
mov dword [0x1008f8d8], eax
cmp dword [0x1008f8d0], ebx
je 0x10053ed1
cmp dword [0x1008f8d4], ebx
je 0x10053ed1
cmp eax, ebx
jne 0x10053eea
push esi
mov dword [0x1008f8d0], ebx
mov dword [0x1008f8d4], ebx
mov dword [0x1008f8d8], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1008f8dc], ebx
jne 0x10053f1b
push 0x1005f384
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053f1b
push str.GetProcessTimes
push esi
call edi
mov dword [0x1008f8dc], eax
cmp eax, ebx
jne 0x10053f1b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1005f384
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053f75
push str.CreateToolhelp32Snapshot
push esi
call edi
push str.Process32FirstW
push esi
mov ebx, eax
call edi
push str.Process32NextW
push esi
mov dword [ebp - 8], eax
call edi
test ebx, ebx
je 0x10053f66
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10053f66
test eax, eax
je 0x10053f66
push eax
push ecx
push ebx
call fcn.10053970
add esp, 0xc
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 4], 0
jne 0x10053fa5
xor ebx, ebx
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053fa5
push str.EnumProcesses
push esi
call edi
cmp eax, ebx
je 0x10053f9e
push eax
call fcn.10053790
add esp, 4
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret