Function at 0x51bdb0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push edi
mov ecx, 0x11
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1e4]
push ebx
sub esp, 0x224
mov ebx, dword [0x850160]
mov dword [ebp - 0x200], eax
xor eax, eax
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x51c748
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x85016c]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc54
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateJobObjectW_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [0x850164]
sub esp, 8
mov dword [ebp - 0x1fc], eax
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc57
mov eax, dword [esi + 0x34]
test edi, edi
je 0x51c3d0
mov dword [esp + 8], eax
mov dword [esp + 4], str.AssignProcessToJobObject_error__lu_n
mov dword [esp], 1
call fcn.0050e8b0
lea eax, [ebp - 0x12b]
mov dword [esp + 8], 0x84fee0
lea esi, [ebp - 0x1f4]
mov dword [esp + 4], str.__s__process_exit
mov dword [esp], eax
call fcn.0050d7a0
lea eax, [ebp - 0x1e4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12b]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [ebp - 0x204], eax
call eax
sub esp, 0x28
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc5f
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.CreateProcessA_expected_failure_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x208], edx
call fcn.0057d110
mov edx, dword [ebp - 0x208]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc60
xor eax, eax
cmp edx, 5
sete al
mov dword [esp + 0xc], edx
mov dword [esp + 8], 5
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_ACCESS_DENIED__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
test edi, edi
jne 0x51c6f0
mov ecx, dword [ebp - 0x1fc]
test ecx, ecx
jne 0x51c498
mov dword [ebp - 0x190], 0x800
lea eax, [ebp - 0x1a0]
mov dword [esp + 0xc], 0x70
mov dword [esp + 8], eax
mov dword [esp + 4], 9
mov eax, dword [ebp - 0x200]
mov edi, dword fs:[0x18]
mov dword [esp], eax
call dword [0x850154]
sub esp, 0x10
mov dword [ebp - 0x208], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc83
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.SetInformationJobObject_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x1e4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12b]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x204]
call eax
sub esp, 0x28
mov dword [ebp - 0x208], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc86
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateProcessA_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x1f8]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [0x850160]
sub esp, 0xc
mov dword [ebp - 0x208], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc89
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.IsProcessInJob_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc8a
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.IsProcessInJob_returned_out_u_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov edx, dword [ebp - 0x1fc]
test edx, edx
jne 0x51c458
lea eax, [ebp - 0x1f8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x200]
mov edi, dword fs:[0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [0x850160]
sub esp, 0xc
mov dword [ebp - 0x200], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc92
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.IsProcessInJob_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x200]
mov dword [esp], edx
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc93
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.IsProcessInJob_returned_out_u_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, esi
call fcn.0050e290
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x190], 0x1000
mov dword [esp + 0xc], 0x70
mov dword [esp + 8], eax
mov dword [esp + 4], 9
mov dword [esp], ebx
call dword [0x850154]
sub esp, 0x10
mov dword [ebp - 0x200], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc99
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.SetInformationJobObject_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x200]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x1e4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12b]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x204]
call eax
sub esp, 0x28
mov dword [ebp - 0x200], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc9c
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateProcess_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x200]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x1f8]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [0x850160]
sub esp, 0xc
mov dword [ebp - 0x200], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xc9f
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.IsProcessInJob_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x200]
mov dword [esp], edx
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xca0
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.IsProcessInJob_returned_out_u_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x1fc]
test eax, eax
jne 0x51c418
mov eax, esi
call fcn.0050e290
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x190], 0
mov dword [esp], ebx
mov dword [esp + 0xc], 0x70
mov dword [esp + 8], eax
mov dword [esp + 4], 9
call dword [0x850154]
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xcac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.SetInformationJobObject_error__lu_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.0050e8b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov edx, dword [0x8f0770]
cmp eax, 5
je 0x51c720
mov dword [esp + 8], eax
mov dword [esp + 4], str.AssignProcessToJobObject_error__lu_n
mov dword [esp], 0
call fcn.0050e8b0
mov eax, 0xc5b
call fcn.0050dc60
mov dword [esp], str.Nested_jobs_are_not_supported._n
call fcn.0050e770
jmp 0x51be8c
mov eax, dword [edi + 0x20]
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp], 0xca3
call fcn.0050eab0
mov dword [esp], 1
mov ecx, 1
mov edx, ebx
mov eax, 0xca4
call fcn.00514d80
jmp 0x51c35b
mov eax, dword [edi + 0x20]
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp], 0xc8d
call fcn.0050eab0
mov dword [esp], 1
mov ecx, 1
mov edx, ebx
mov eax, 0xc8e
call fcn.00514d80
jmp 0x51c133
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x20]
mov dword [esp + 4], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0xc6a
call fcn.0050eab0
mov dword [esp], 1
mov ecx, 1
mov edx, ebx
mov eax, 0xc6b
call fcn.00514d80
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x190], 0x800
mov dword [esp], ebx
mov dword [esp + 0xc], 0x70
mov dword [esp + 8], eax
mov dword [esp + 4], 9
call dword [0x850154]
sub esp, 0x10
mov dword [ebp - 0x208], eax
mov eax, 0xc6f
call fcn.0050dc60
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.SetInformationJobObject_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x12b]
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_exit
mov dword [esp], eax
call fcn.0050d7a0
lea eax, [ebp - 0x1e4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12b]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x204]
call eax
sub esp, 0x28
mov dword [ebp - 0x208], eax
mov eax, 0xc73
call fcn.0050dc60
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateProcessA_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0x1f8]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [0x850160]
sub esp, 0xc
mov dword [ebp - 0x208], eax
mov eax, 0xc76
call fcn.0050dc60
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.IsProcessInJob_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
mov eax, 0xc77
call fcn.0050dc60
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.IsProcessInJob_returned_out_u_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x1f8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [0x850160]
sub esp, 0xc
mov dword [ebp - 0x208], eax
mov eax, 0xc7a
call fcn.0050dc60
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.IsProcessInJob_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x208]
mov dword [esp], edx
call fcn.0050e8b0
mov eax, 0xc7b
call fcn.0050dc60
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.IsProcessInJob_returned_out_u_n
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
sub esp, 8
call fcn.0050e290
jmp 0x51bf9b
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
sub esp, 8
call fcn.0050e290
jmp 0x51bf8d
xor eax, eax
test edx, edx
mov dword [esp + 8], 5
sete al
mov dword [esp + 4], str.AssignProcessToJobObject_error__lu_n
mov dword [esp], eax
call fcn.0050e8b0
jmp 0x51c3f7
mov eax, 0xc4f
call fcn.0050dc60
mov dword [esp], str.IsProcessInJob_not_available._n
call fcn.0050e770
jmp 0x51c3c3