Function at 0x5199a0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [0x85017c]
test ebx, ebx
je 0x51a040
xor eax, eax
lea edi, [ebp - 0x4c]
lea edx, [ebp - 0x60]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.kernel32.dll_CreateProcessA]
lea esi, [ebp - 0x50]
mov dword [ebp - 0x50], 0x44
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x57f3a0
mov dword [ebp - 0x78], eax
call eax
lea edx, [ebp - 0x60]
sub esp, 0x28
test eax, eax
jne 0x519ea0
mov eax, 0x14c
mov word [ebp - 0x72], ax
lea eax, [ebp - 0x66]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [ebp - 0x7c], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x80], eax
xor eax, eax
mov ecx, 0x10
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x44
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x64]
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x57f360
mov eax, dword [ebp - 0x78]
call eax
sub esp, 0x28
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8ea
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateProcess_error__lu_n
call fcn.0050e8b0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [0x850180]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8ee
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov esi, 0xffffdead
mov dword [esp + 8], eax
mov dword [esp + 4], str.IsWow64Process_error__lu_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x70]
mov word [ebp - 0x68], si
mov ecx, 0xffffdead
mov word [ebp - 0x66], cx
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [0x85017c]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8f3
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.IsWow64Process2_error__lu_n
call fcn.0050e8b0
call fcn.0057d110
movzx edx, word [ebp - 0x68]
mov dword [eax], 0x5eee7f
test dx, dx
mov dword [eax + 4], 0x8f5
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 4], str.got__x_n
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
movzx edx, word [ebp - 0x66]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8f6
mov dword [esp + 8], edx
mov dword [esp + 4], str.got__x_n
cmp dx, word [ebp - 0x72]
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xffffdead
mov dword [ebx + 0x34], 0xdeadbeef
mov word [ebp - 0x68], ax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [0x85017c]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8fb
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.IsWow64Process2_error__lu_n
call fcn.0050e8b0
call fcn.0057d110
movzx edx, word [ebp - 0x68]
mov dword [eax], 0x5eee7f
test dx, dx
mov dword [eax + 4], 0x8fc
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 4], str.got__x_n
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov esi, dword [ebp - 0x7c]
call esi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x8ff
mov dword [esp], esi
mov dword [esp + 4], str.TerminateProcess_error_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov esi, dword [ebp - 0x80]
call esi
mov eax, dword [ebp - 0x5c]
sub esp, 4
mov dword [esp], eax
call esi
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], 0xffffffff
call dword [0x850180]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x906
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.IsWow64Process_error__lu_n
call fcn.0050e8b0
mov ecx, dword [ebp - 0x70]
mov eax, 0xffffdead
mov dword [ebx + 0x34], 0xdeadbeef
mov word [ebp - 0x66], ax
mov eax, 0xffffdead
mov word [ebp - 0x68], ax
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x6c]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
call dword [0x85017c]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x90b
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.IsWow64Process2_error__lu_n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0050e8b0
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x51a008
mov eax, 0x90f
call fcn.0050dc60
movzx edx, word [ebp - 0x68]
mov dword [esp + 4], str.got__x_n
cmp dx, 0x14c
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x910
call fcn.0050dc60
movzx edx, word [ebp - 0x66]
mov dword [esp + 4], str.got__x_n
mov dword [esp + 8], edx
cmp dx, word [ebp - 0x72]
sete al
movzx eax, al
mov dword [esp], eax
mov esi, dword fs:[0x18]
call fcn.0050e8b0
mov eax, 0xffffdead
mov dword [esi + 0x34], 0xdeadbeef
mov word [ebp - 0x68], ax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
call dword [0x85017c]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x91b
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.IsWow64Process2_error__lu_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0050e8b0
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x519fd0
mov eax, 0x91d
call fcn.0050dc60
movzx edx, word [ebp - 0x68]
mov dword [esp + 4], str.got__x_n
cmp dx, 0x14c
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xffffdead
mov ecx, 0xffffdead
lea eax, [ebp - 0x66]
mov dword [ebx + 0x34], 0xdeadbeef
mov word [ebp - 0x66], dx
mov word [ebp - 0x68], cx
mov dword [ebp - 0x70], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [0x85017c]
sub esp, 0xc
mov edi, eax
mov eax, 0x8d5
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 4], str.IsWow64Process2_error__lu_n
mov dword [esp + 8], eax
call fcn.0050e8b0
mov eax, 0x8d8
call fcn.0050dc60
movzx ecx, word [ebp - 0x68]
mov dword [esp + 4], str.got__x_n
cmp cx, 0x14c
mov dword [esp + 8], ecx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x8d9
call fcn.0050dc60
movzx eax, word [ebp - 0x66]
mov dword [esp + 4], str.got__x_n
mov ecx, eax
cmp ax, 0x8664
mov dword [esp + 8], eax
sete al
cmp cx, 0xaa64
sete cl
or eax, ecx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
movzx eax, word [ebp - 0x66]
mov word [ebp - 0x72], ax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [ebp - 0x7c], eax
call eax
sub esp, 8
mov ebx, eax
mov eax, 0x8e0
call fcn.0050dc60
mov dword [esp + 4], str.TerminateProcess_error_n
mov dword [esp], ebx
call fcn.0050e8b0
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov dword [ebp - 0x80], edi
call edi
mov eax, dword [ebp - 0x5c]
sub esp, 4
mov dword [esp], eax
call edi
lea edx, [ebp - 0x60]
sub esp, 4
jmp 0x519a65
mov eax, 0x91f
call fcn.0050dc60
movzx edx, word [ebp - 0x68]
mov dword [esp + 4], str.got__x_n
test dx, dx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x914
call fcn.0050dc60
movzx edx, word [ebp - 0x68]
mov dword [esp + 4], str.got__x_n
test dx, dx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x915
jmp 0x519dd4
mov eax, 0x8c8
call fcn.0050dc60
mov dword [esp], str.IsWow64Process2_is_not_available_n
call fcn.0050e770
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret