Function at 0x5b9bd8
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5b9be0
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ba1de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 3
call fcn.00403430
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040ddb8
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00403430
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
call fcn.004df4c0
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
pop ecx
call fcn.00406820
lea eax, [ebp - 0x10]
mov edx, 0x5ba1f8
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba208
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba220
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba234
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba258
call fcn.00406760
lea eax, [ebp - 0x10]
mov edx, 0x5ba268
call fcn.00406760
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005b86f0
lea eax, [ebp - 4]
mov ecx, 0x5ba278
mov edx, dword [ebp - 0x10]
call fcn.00406820
lea eax, [ebp - 4]
mov edx, 0x5ba294
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2a4
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba208
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2bc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2dc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2ec
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba258
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2fc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba30c
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 8]
mov ecx, 0x5ba31c
mov edx, dword [ebp - 0x10]
call fcn.00406820
lea eax, [ebp - 8]
mov edx, 0x5ba330
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba208
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba2bc
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba2dc
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba2ec
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba258
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba2fc
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba30c
call fcn.00406760
lea eax, [ebp - 8]
mov edx, 0x5ba248
call fcn.00406760
mov eax, 0x5ba344
call fcn.004dfdbc
mov eax, 0x5ba360
call fcn.004dfdbc
mov eax, 0x5ba384
call fcn.004dfdbc
mov eax, dword [ebp - 4]
call fcn.0040d89c
test al, al
je 0x5b9e7a
push 1
push 0
push 0x5ba3a8
mov eax, dword [ebp - 4]
call fcn.004063d8
push eax
push 0x5ba3d4
mov eax, ebx
call fcn.00490e44
push eax
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0
mov ecx, 1
mov edx, 1
mov eax, ebx
call fcn.005bbbd4
push 0
call fcn.005b8664
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x5ba1c3
mov eax, dword [ebp - 8]
call fcn.0040d89c
test al, al
je 0x5ba19f
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0040e08c
mov eax, dword [ebp - 0x24]
call fcn.004dfdbc
lea eax, [ebp - 4]
mov ecx, 0x5ba31c
mov edx, dword [ebp - 0x10]
call fcn.00406820
lea eax, [ebp - 4]
mov edx, 0x5ba330
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba208
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2bc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2dc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2ec
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba258
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba2fc
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba30c
call fcn.00406760
lea eax, [ebp - 4]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba3ec
call fcn.004063a0
lea eax, [ebp - 0x18]
mov edx, 0x5ba40c
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba41c
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba438
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba44c
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba464
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba330
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2fc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba478
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba488
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba498
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4a8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4b8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4c8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4c8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4a8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2bc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba248
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4d8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4e8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba330
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4fc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba220
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba234
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba514
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba498
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba208
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba220
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2dc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2ec
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba528
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4c8
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2cc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba2fc
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba53c
call fcn.00406760
lea eax, [ebp - 0x18]
mov edx, 0x5ba4a8
call fcn.00406760
push dword [ebp - 0x18]
push 0x5ba550
push 0x5ba560
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406904
push 1
push 0
mov eax, dword [ebp - 0x18]
call fcn.004063d8
push eax
mov eax, dword [ebp - 4]
call fcn.004063d8
push eax
push 0x5ba3d4
mov eax, ebx
call fcn.00490e44
push eax
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0
mov ecx, 1
mov edx, 1
mov eax, ebx
call fcn.005bbbd4
push 0
call fcn.005b8664
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x5ba1c3
push 0
push 0
push 0
mov ecx, 1
mov edx, 1
mov eax, ebx
call fcn.005bbbd4
push 0
call fcn.005b8664
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba1e5
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00406344
ret