Function at 0x4018e5
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create process suspended
Get file size
Query environment variable
Read .ini file
Read file on windows
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0xc], 0
push 1
push 3
call fcn.00401057
or eax, eax
jne 0x40195f
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 0x40466c
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x40195a
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
jmp 0x40195f
jmp 0x401c2a
mov dword [ebp - 4], eax
jmp 0x401981
mov ecx, dword [0x404264]
inc ecx
push ecx
push 3
call fcn.00401057
or eax, eax
je 0x40197c
cmp eax, dword [ebp - 4]
jne 0x401981
jmp 0x401c2a
mov esi, eax
push 1
push 0xe
call fcn.00401057
or eax, eax
je 0x401995
lea eax, [eax + 9]
jmp 0x401998
lea eax, [esi + 0x22]
push 0x400
push 0x404a6c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push esi
mov esi, 0x404a6c
jmp 0x4019cc
lodsb al, byte [esi]
cmp al, 0x25
jne 0x4019cc
push 0x404a6c
call fcn.00401fb0
push eax
push 0x404a6c
call sub.kernel32.dll_lstrcpyA
jmp 0x4019d1
cmp byte [esi], 0
jne 0x4019b0
pop esi
push 0x40426c
call fcn.00401e80
cmp eax, 1
jne 0x401a01
push 0x40426c
push 0x400
push 0x404a6c
push 0
push 0x40418f
push 0x40418b
call sub.kernel32.dll_GetPrivateProfileStringA
mov ebx, dword [esi + 2]
or ebx, ebx
je 0x401a4e
push 0x404a6c
call fcn.00401ec0
cmp eax, 0xffffffff
je 0x401a3a
cmp ebx, eax
je 0x401a4e
push 0x30
push 0x404a6c
push str.Wrong_Filesize_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401c2d
jmp 0x401c10
push 0x404a6c
call fcn.00401c61
cmp eax, 1
je 0x401a08
jmp 0x401c10
cmp dword [esi + 0xa], 0
je 0x401a80
push 0x404a6c
call fcn.00401ce5
cmp dword [esi + 0xa], eax
je 0x401a80
push 0x30
push 0x404a6c
push str.CRC32_Check_failed_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401c2d
jmp 0x401c10
test dword [esi + 0x1e], 4
je 0x401c10
call sub.kernel32.dll_GetCommandLineA
push 0x4052b8
push 0x405274
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push 0x404a6c
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x401acf
push 0x30
push 0x404a6c
push str.Cant_create_Process
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401c10
cmp dword [esi + 0xe], 0
je 0x401b08
push dword [0x4052bc]
call sub.kernel32.dll_ResumeThread
push 0
push 4
push 0x404e6c
push dword [esi + 0xe]
push dword [0x4052b8]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [esi + 0x12]
cmp dword [0x404e6c], eax
jne 0x401b06
jmp 0x401b08
jmp 0x401ae0
mov byte [ebp - 0x11], 0
mov dword [0x40526c], 0
mov eax, dword [esi + 0x16]
lea edi, [eax + esi]
lea esp, [esp]
jmp 0x401bce
push 0
push 1
push 0x404e6c
push dword [edi]
push dword [0x4052b8]
call sub.kernel32.dll_ReadProcessMemory
mov al, byte [edi + 4]
cmp al, byte [0x404e6c]
jne 0x401b9b
lea eax, [edi + 5]
push 0
push 1
push eax
push dword [edi]
push dword [0x4052b8]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x401b86
cmp byte [ebp - 0x11], 0
jne 0x401b86
push 0x405270
push 0x40
push 1
push dword [edi]
push dword [0x4052b8]
call sub.kernel32.dll_VirtualProtectEx
cmp eax, 0
je 0x401bde
mov byte [ebp - 0x11], 1
jmp 0x401b46
mov byte [ebp - 0x11], 0
mov dword [0x40526c], 0
mov eax, 1
jmp 0x401bcb
push dword [0x4052bc]
call sub.kernel32.dll_ResumeThread
add dword [0x40526c], 1
cmp dword [0x40526c], 0xfa
jae 0x401bc7
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x401b20
xor eax, eax
jmp 0x401bde
add edi, 6
cmp dword [edi], 0
je 0x401bde
cmp word [edi + 4], 0
jne 0x401b25
or eax, eax
jne 0x401c05
push 0
push dword [0x4052b8]
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x404a6c
push str.Time_out.Bytes_not_found.
push 0
call sub.user32.dll_MessageBoxA
popal
leave
ret
push dword [0x4052bc]
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x401c25
push 0x4000
push dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree
jmp 0x401964
popal
leave
ret