Function at 0x564cf0
Capabilities:
Create process on windows
Create process suspended
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, dword fs:[0x18]
sub esp, 0x18c
mov dword [ebp - 0x170], eax
mov dword [ebx + 0x34], 0xdeadbef
mov dword [esp + 0x14], str.winetest_virtual.c
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
sub esp, 0x18
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x1095
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
test edi, edi
jne 0x564f48
mov dword [ebx + 0x34], 0xdeadbef
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 6
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x109b
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.MapViewOfFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [ebp - 0x16c], edi
lea edi, [ebp - 0x150]
mov dword [esp], eax
call fcn.0055ab70
mov eax, dword [ebp - 0x170]
mov ecx, 0x10
mov dword [ebp - 0x154], 0x44
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
mov dword [edi], 0x1a2b3c4d
lea edi, [ebp - 0x110]
mov dword [esp], eax
call fcn.0057d960
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [esp], edi
mov dword [esp + 4], str.__s__virtual_sharedmem
mov dword [esp + 8], eax
call fcn.0055a2e0
lea eax, [ebp - 0x164]
mov dword [esp + 4], edi
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x154]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov dword [ebp - 0x170], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10ae
mov eax, dword [ebx + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.CreateProcess__s__error__ld_n
mov edx, dword [ebp - 0x170]
mov dword [esp], edx
call fcn.0055ab70
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10af
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call fcn.0057d980
mov eax, dword [ebp - 0x160]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x164]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp], esi
call edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x1097
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.expected_ERROR_ALREADY_EXISTS__got__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 0xb7
sete al
mov dword [esp], eax
call fcn.0055ab70
mov dword [ebx + 0x34], 0xdeadbef
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 6
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov edi, eax
mov dword [ebp - 0x16c], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x109b
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.MapViewOfFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x109f
mov eax, dword [edi]
mov dword [esp + 4], str.expected_0x1a2b3c4d_in_child__got__lx_n
cmp eax, 0x1a2b3c4d
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0055ab70
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x564f1f