Function at 0x401478
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create process suspended
Get file size
Query environment variable
Read file on windows
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
mov dword [ebp - 0xc], 0
push 1
push 3
call fcn.00401774
or eax, eax
jne 0x4014f2
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push str.snr_offsets.ldr
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4014ed
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
jmp 0x4014f2
jmp 0x40173c
mov dword [ebp - 4], eax
jmp 0x401514
mov ecx, dword [0x403354]
inc ecx
push ecx
push 3
call fcn.00401774
or eax, eax
je 0x40150f
cmp eax, dword [ebp - 4]
jne 0x401514
jmp 0x40173c
mov esi, eax
lea eax, [esi + 0x22]
push 0x200
push 0x403150
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, dword [esi + 2]
or ebx, ebx
je 0x40157a
push 0x403150
call fcn.00401960
cmp eax, 0xffffffff
je 0x401562
cmp ebx, eax
je 0x40157a
push 0x30
push 0x403150
push str.Wrong_Filesize_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401740
jmp 0x401722
push 0x30
push 0x403150
push str.File_not_found_
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401722
cmp dword [esi + 0xa], 0
je 0x4015ac
push 0x403150
call fcn.004017f0
cmp dword [esi + 0xa], eax
je 0x4015ac
push 0x30
push 0x403150
push str.CRC32_Check_failed_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401740
jmp 0x401722
cmp byte [esi + 1], 1
jne 0x401722
call sub.kernel32.dll_GetCommandLineA
push 0x4035a8
push 0x403564
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push 0x403150
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x4015f3
push 0x30
push 0x403150
push str.Cant_create_Process
push 0
call sub.user32.dll_MessageBoxA
cmp dword [esi + 0xe], 0
je 0x40162c
push dword [0x4035ac]
call sub.kernel32.dll_ResumeThread
push 0
push 4
push 0x403358
push dword [esi + 0xe]
push dword [0x4035a8]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [esi + 0x12]
cmp dword [0x403358], eax
jne 0x40162a
jmp 0x40162c
jmp 0x401604
push esi
mov dword [0x403558], 0
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
lea ecx, [ecx]
jmp 0x4016db
push 0
push 1
push 0x403358
push dword [esi]
push dword [0x4035a8]
call sub.kernel32.dll_ReadProcessMemory
mov al, byte [esi + 4]
cmp al, byte [0x403358]
jne 0x4016b0
lea eax, [esi + 5]
push 0
push 1
push eax
push dword [esi]
push dword [0x4035a8]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x4016a1
lea eax, [esi + 5]
push 0x40355c
push 0x40
push 1
push eax
push dword [0x4035a8]
call sub.kernel32.dll_VirtualProtectEx
or eax, eax
jne 0x40169f
xor eax, eax
jmp 0x4016eb
jmp 0x401666
mov dword [0x403558], 0
xor eax, eax
inc eax
jmp 0x4016d8
push dword [0x4035ac]
call sub.kernel32.dll_ResumeThread
inc dword [0x403558]
cmp dword [0x403558], 0x10000000
jae 0x4016d4
jmp 0x40163d
xor eax, eax
jmp 0x4016eb
add esi, 6
cmp dword [esi], 0
je 0x4016eb
cmp word [esi + 4], 0
jne 0x401645
pop esi
or eax, eax
jne 0x401717
push dword [0x403560]
push dword [0x4035a8]
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x403150
push str.Time_out.Bytes_not_found.
push 0
call sub.user32.dll_MessageBoxA
popal
leave
ret
push dword [0x4035ac]
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x401737
push 0x4000
push dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree
jmp 0x4014f7
popal
leave
ret