Function at 0x5d3b40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6217a3
mov eax, dword fs:[0]
push eax
mov eax, 0x108c
call fcn.005f33e0
mov eax, dword [0x6be5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1038], ebx
push ebx
lea eax, [ebp - 0x1044]
push eax
lea ecx, [ebp - 0x1034]
push ecx
lea edx, [ebp - 0x1030]
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1044], 0xc
mov dword [ebp - 0x1040], ebx
mov dword [ebp - 0x103c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x5d3bde
push 0xc
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x6905a0
mov ecx, esi
mov byte [esi + 4], bl
call fcn.005d37f0
cmp dword [ebp + 0x24], 0x10
jmp 0x5d3da7
push 0x40
lea ecx, [ebp - 0x1094]
push ebx
push ecx
mov dword [ebp - 0x1098], 0x44
call fcn.005f6220
mov eax, dword [ebp - 0x1034]
xor edx, edx
mov edi, 0x10
add esp, 0xc
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp + 0x10]
mov word [ebp - 0x1068], dx
mov dword [ebp - 0x106c], 0x101
cmp dword [ebp + 0x24], edi
jae 0x5d3c2f
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x1054]
push ecx
lea edx, [ebp - 0x1098]
push edx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x5d3c70
push 0xf
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x690590
mov ecx, esi
mov byte [esi + 4], bl
call fcn.005d37f0
jmp 0x5d3da4
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
lea edx, [ebp - 0x1010]
push ebx
push edx
mov dword [ebp - 0x1034], ebx
call fcn.005f6220
add esp, 0xc
mov dword [ebp - 0x1014], 0xf
mov dword [ebp - 0x1018], ebx
mov byte [ebp - 0x1028], bl
mov edx, dword [ebp - 0x1030]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x1038]
push eax
push 0xfff
lea ecx, [ebp - 0x1010]
push ecx
push edx
mov byte [ebp - 4], 1
call edi
test eax, eax
je 0x5d3d2d
lea esp, [esp]
lea eax, [ebp - 0x1010]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5d3cf0
sub eax, edx
push eax
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x102c]
call fcn.005d38d0
mov eax, dword [ebp - 0x1030]
push ebx
lea ecx, [ebp - 0x1038]
push ecx
push 0xfff
lea edx, [ebp - 0x1010]
push edx
push eax
call edi
test eax, eax
jne 0x5d3ce0
mov ecx, dword [ebp - 0x1030]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x1050]
push edx
mov dword [ebp - 0x1030], ebx
call edi
mov eax, dword [ebp - 0x1054]
push eax
call edi
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x102c]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.005d3700
mov edi, 0x10
cmp dword [ebp - 0x1014], edi
jb 0x5d3d8e
mov edx, dword [ebp - 0x1028]
push edx
call fcn.00612a47
add esp, 4
mov dword [ebp - 0x1014], 0xf
mov dword [ebp - 0x1018], ebx
mov byte [ebp - 0x1028], bl
cmp dword [ebp + 0x24], edi
jb 0x5d3db5
mov eax, dword [ebp + 0x10]
push eax
call fcn.00612a47
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f60cd
mov esp, ebp
pop ebp
ret