Function at 0x4156d5
Capabilities:
Create process on windows
Get file size
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x415a30
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push 4
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test eax, eax
je 0x415a18
mov ebp, eax
push ebp
push 0
push 0
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x40178b], 0
jne 0x41575b
push 0x40178b
push 0x40178b
push 0x40d
push ebx
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40137f], eax
lea esi, [ebp + esi]
mov ebx, 1
cmp word [ebp], 0xa0d
jne 0x415770
inc ebx
add ebp, 1
push 8
push str.include
push ebp
call dword [sym.imp.ntdll.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x415803
cmp byte [ebp + 9], 0x27
je 0x415791
cmp byte [ebp + 9], 0x22
jne 0x415803
push 4
push 0x1000
push 0x400
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test eax, eax
je 0x415a18
add ebp, 8
push ebp
mov edi, eax
push edi
movzx eax, byte [ebp]
push eax
call dword [sym.imp.ntdll.dll_isalpha]
add esp, 4
test eax, eax
lea ebp, [ebp + 1]
je 0x4157b4
sub ebp, 1
movzx eax, byte [ebp]
cmp al, 0x22
je 0x4157e2
cmp al, 0x27
je 0x4157e2
mov byte [edi], al
lea edi, [edi + 1]
lea ebp, [ebp + 1]
jmp 0x4157cc
call fcn.004156d5
add esp, 4
push eax
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
pop eax
pop ebp
test eax, eax
je 0x415a1d
push dword [0x40137f]
push 0x40178b
push ebp
call dword [sym.imp.ntdll.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x415a0d
mov eax, dword [0x40137f]
cmp byte [ebp + eax], 0x3a
jne 0x41583e
cmp byte [ebp - 1], 9
je 0x415856
cmp byte [ebp - 1], 0xa
je 0x415856
cmp byte [ebp - 1], 0x20
je 0x415856
push ebp
sub ebp, 1
cmp byte [ebp], 0x20
je 0x41583f
cmp dword [ebp - 3], 0x636f7270
pop ebp
jne 0x415a0d
push 4
push 0x1000
push 0x400
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push ebp
push ebx
mov ebp, eax
mov byte [ebp], 0x22
mov dword [0x40131f], 0x44
push 0x400
lea eax, [ebp + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ebx, eax
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_strlen]
add esp, 4
push eax
lea eax, [ebx + eax]
cmp eax, 0x400
jb 0x4158eb
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
lea ebx, [ebx + 3]
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ebp, eax
mov byte [ebp], 0x22
mov dword [0x40131f], 0x44
push 0x400
lea eax, [ebp + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ebx, eax
mov dword [ebp + ebx + 1], 0x22202022
pop ecx
mov esi, dword [esp + 0x20]
lea edi, [ebp + ebx + 5]
rep movsb byte es:[edi], byte [esi]
mov word [edi], 0x22
push 0x401363
push 0x40131f
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov edi, eax
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
pop ebx
pop ebp
push 0x64
push dword [0x401363]
call dword [sym.imp.USER32.DLL_WaitForInputIdle]
test eax, eax
jne 0x415934
mov dword [0x40d2ec], ebx
mov dword [0x40d2e8], ebx
mov dword [0x40d2f4], ebx
mov dword [0x40d2f0], 0
push 0
push 0x10
push 0x40d2e8
push 0x40d2e8
push dword [0x401363]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push 0
push 4
push 0x401373
push 0x402004
push dword [0x401363]
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
push 0
push 0x40d2e8
push 0x402
push dword [0x401373]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 4
push 0x401373
push 0x401ff4
push dword [0x401363]
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
push 1
push ebx
push 1
push dword [0x401373]
call dword [sym.imp.USER32.DLL_SetScrollPos]
push 0
push 0x22b3
push 0x111
push dword [0x401373]
call dword [sym.imp.USER32.DLL_PostMessageA]
push 0
push 0x4ba
push 0x111
push dword [0x401373]
call dword [sym.imp.USER32.DLL_PostMessageA]
xor eax, eax
jmp 0x415a1d
add ebp, 1
cmp ebp, esi
jne 0x415764
mov eax, 1
mov ebx, eax
pop eax
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, ebx
pop ebx
pop ebp
pop esi
pop edi
ret