Function at 0x565290
Capabilities:
Create process on windows
Create process suspended
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov esi, dword fs:[0x18]
sub esp, 0x190
mov dword [ebp - 0x16c], edx
mov dword [esi + 0x34], 0xdeadbef
mov dword [esp + 0x14], str.winetest_virtual.c_ro
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
sub esp, 0x18
mov edi, eax
mov dword [ebp - 0x170], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10bf
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [ebp - 0x174], ebx
test ebx, ebx
jne 0x565510
mov dword [esi + 0x34], 0xdeadbef
mov dword [esp], edi
lea edi, [ebp - 0x150]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10c5
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov eax, dword [ebp - 0x174]
mov ecx, 0x10
mov dword [ebp - 0x154], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x168]
lea edi, [ebp - 0x110]
mov dword [esp], eax
call fcn.0057d960
mov eax, dword [ebp - 0x16c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [esp + 4], str.__s__virtual_sharedmemro__lx
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.0055a2e0
lea eax, [ebp - 0x164]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x154]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov dword [ebp - 0x174], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10d6
mov eax, dword [esi + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.CreateProcess__s__error__ld_n
mov edx, dword [ebp - 0x174]
mov dword [esp], edx
call fcn.0055ab70
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10d7
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call fcn.0057d980
mov eax, dword [ebp - 0x160]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x164]
sub esp, 4
mov dword [esp], eax
call esi
sub esp, 4
test byte [ebp - 0x16c], 2
je 0x5655e0
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10dc
mov eax, dword [ebx]
mov dword [esp + 4], str.p___lx__expected_0xdeadbeef_n
cmp eax, 0xdeadbeef
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0055ab70
jmp 0x5655be
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10c1
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.expected_ERROR_ALREADY_EXISTS__got__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esi + 0x34], 0xb7
sete al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esi + 0x34], 0xdeadbef
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x16c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10c5
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [ebx], 0xdeadbeef
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x10de
mov eax, dword [ebx]
mov dword [esp + 4], str.p___lx__expected_0_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0055ab70
jmp 0x5655be