Function at 0x438540
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [0x56e4c0]
push edi
xor edi, edi
cmp esi, edi
je 0x438593
cmp dword [esi + 8], edi
jle 0x43858d
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x34]
lea ecx, [ecx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x438580
test al, al
je 0x43857c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x438580
add ecx, 2
add edx, 2
test al, al
jne 0x438560
xor eax, eax
jmp 0x438585
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4386e1
mov esi, dword [esi]
cmp esi, edi
jne 0x438551
push ebx
mov ebx, dword [esp + 0x3c]
mov eax, dword [ebx]
cmp eax, edi
je 0x4386e9
push eax
call fcn.00473bc0
add esp, 4
cmp eax, edi
je 0x4386e9
push eax
call fcn.00418550
add esp, 4
push 0x828
call fcn.00443680
mov esi, eax
mov eax, dword [esp + 0x44]
add esp, 4
cmp eax, edi
je 0x4385fa
push ebx
mov dword [esp + 0x28], 0x53db5c
mov dword [esp + 0x2c], eax
call fcn.00438490
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
add esp, 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], eax
mov ebx, eax
push ebp
push ebx
call fcn.00438490
mov edx, dword [0x53f4e4]
mov ebp, eax
mov eax, dword [0x56e7b8]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [edx + ecx*4]
add esp, 4
test dword [eax + 0xc], 0x200
je 0x438648
mov eax, dword [eax]
mov ecx, dword [str._unknown_program_]
push eax
push ecx
push str._s_MONITOR:_s:
call fcn.00442db0
push ebp
push str.CmdLine:___s__n
call fcn.00442cd0
add esp, 0x14
push 0x44
push edi
push 0x56e4f8
call fcn.00418060
mov ebx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
mov ecx, 1
or dword [0x56e524], ecx
or eax, 0xffffffff
add esp, 0xc
cmp ebx, eax
mov dword [0x56e4f8], 0x44
mov word [0x56e528], di
mov dword [0x56e504], edx
jne 0x43875c
or dword [0x56e524], 0x100
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x28], ecx
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x2c], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x56e530
mov dword [esp + 0x2c], 0xc
call edi
test eax, eax
jne 0x4386f2
push str.Failed_to_create_input_pipe_n
push 3
push 0x32d7
call fcn.00442f20
add esp, 0xc
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
pop edi
mov eax, esi
pop esi
add esp, 0x28
ret
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
push 0
lea edx, [esp + 0x20]
push edx
push 0x56e534
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
jne 0x438734
mov ecx, dword [0x56e530]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Failed_to_create_output_pipe_n
push 3
push 0x32d8
call fcn.00442f20
add esp, 0xc
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push 0x56e538
call edi
mov edx, dword [0x56e534]
push eax
push edx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor edi, edi
jmp 0x43876b
mov dword [0x56e530], eax
mov dword [0x56e534], eax
mov dword [0x56e538], eax
push 0x56e53c
push 0x56e4f8
push edi
push edi
push 0x10
push 1
push edi
push edi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x438799
mov eax, dword [0x56e540]
push eax
call ebp
mov eax, dword [0x56e530]
cmp eax, 0xffffffff
je 0x4387a6
push eax
call ebp
mov eax, dword [0x56e534]
cmp eax, 0xffffffff
je 0x4387b3
push eax
call ebp
mov eax, dword [0x56e538]
cmp eax, 0xffffffff
je 0x4387c0
push eax
call ebp
test edi, edi
jne 0x438800
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push edx
push str.Failed_to_execute_program___s__n
push 3
push 0x32d9
call fcn.00442f20
mov eax, dword [esp + 0x20]
add esp, 0x10
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
push esi
call fcn.00418550
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
cmp ebx, 0xffffffff
mov ebp, 1
mov dword [esi + 8], ebp
mov edx, dword [0x56e544]
mov dword [esi + 0x18], edx
mov eax, dword [0x56e53c]
mov dword [esi + 0x14], eax
jne 0x438835
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x1c], 0
jmp 0x438881
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x24], 0x10
call sub.WSOCK32.dll_accept
push ebx
mov edi, eax
call sub.WSOCK32.dll_closesocket
cmp edi, 0xffffffff
jne 0x438878
push str.Failed_to_connect_to_child_process_n
push 3
push 0x32da
call fcn.00442f20
add esp, 0xc
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], ebp
mov edx, dword [esp + 0x3c]
push edx
call fcn.00443730
add esp, 4
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov eax, dword [0x56e4c0]
pop ebp
pop ebx
mov dword [esi], eax
pop edi
mov dword [0x56e4c0], esi
mov eax, esi
pop esi
add esp, 0x28
ret