Function at 0x402270
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get file size
Query environment variable
Read .ini file
Read file on windows
Resume thread
Set environment variable
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
pushal
mov dword [ebp - 0x14], 0
push 1
push 3
push dword [0x4042c8]
call fcn.00401440
or eax, eax
jne 0x4022f3
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push 0x4046d0
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4022ee
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x18], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x14]
jmp 0x4022f3
jmp 0x4026c3
mov dword [ebp - 0xc], eax
jmp 0x40231b
mov ecx, dword [0x4042c4]
inc ecx
push ecx
push 3
push dword [0x4042c8]
call fcn.00401440
or eax, eax
je 0x402316
cmp eax, dword [ebp - 0xc]
jne 0x40231b
jmp 0x4026c3
mov esi, eax
push 1
push 0xe
push dword [0x4042c8]
call fcn.00401440
or eax, eax
je 0x402335
lea eax, [eax + 9]
jmp 0x402338
lea eax, [esi + 0x22]
push 0x400
push 0x404ad0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push esi
mov esi, 0x404ad0
jmp 0x40236c
lodsb al, byte [esi]
cmp al, 0x25
jne 0x40236c
push 0x404ad0
call fcn.00402a70
push eax
push 0x404ad0
call sub.kernel32.dll_lstrcpyA
jmp 0x402371
cmp byte [esi], 0
jne 0x402350
pop esi
push 0x4042d0
call fcn.00402930
cmp eax, 1
jne 0x4023a1
push 0x4042d0
push 0x400
push 0x404ad0
push 0
push 0x4041cc
push 0x4041c8
call sub.kernel32.dll_GetPrivateProfileStringA
mov edi, 0x404ad0
cmp byte [edi + 1], 0x3a
je 0x4023fb
push 0x400
lea eax, [ebp - 0x41d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x41d]
push eax
call fcn.0040280b
cmp byte [edi], 0x5c
je 0x4023e1
push 0x4041d8
lea eax, [ebp - 0x41d]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0x41d]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x41d]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
push 0x404ad0
push str.dup2_last_file
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x404ad0
lea eax, [ebp - 0x41d]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x41d]
push eax
call fcn.0040280b
lea eax, [ebp - 0x41d]
push eax
push str.dup2_last_path
call sub.kernel32.dll_SetEnvironmentVariableA
mov ebx, dword [esi + 2]
or ebx, ebx
je 0x402485
push 0x404ad0
call fcn.00402970
cmp eax, 0xffffffff
je 0x402471
cmp ebx, eax
je 0x402485
push 0x30
push 0x404ad0
push str.Wrong_Filesize_
push 0
call sub.user32.dll_MessageBoxA
call fcn.004026c6
jmp 0x4026a9
push 0x404ad0
call fcn.004026fa
cmp eax, 1
je 0x40243f
jmp 0x4026a9
cmp dword [esi + 0xa], 0
je 0x4024b7
push 0x404ad0
call fcn.00402783
cmp dword [esi + 0xa], eax
je 0x4024b7
push 0x30
push 0x404ad0
push str.CRC32_Check_failed_
push 0
call sub.user32.dll_MessageBoxA
call fcn.004026c6
jmp 0x4026a9
test dword [esi + 0x1e], 4
je 0x4026a9
push 0x405324
push 0x4052e0
push 0
push 0
push 4
push 0
push 0
push 0
push dword [0x4042cc]
push 0x404ad0
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x402506
push 0x30
push 0x404ad0
push str.Cant_create_Process
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4026a9
test dword [esi + 0x1e], 0x40
je 0x40251c
push 0x4052dc
call fcn.00402206
mov dword [ebp - 4], eax
cmp dword [esi + 0xe], 0
je 0x402562
push dword [0x405328]
call sub.kernel32.dll_ResumeThread
mov edx, dword [esi + 0xe]
test dword [esi + 0x1e], 0x40
je 0x40253c
add edx, dword [ebp - 4]
push 0
push 4
push 0x404ed0
push edx
push dword [0x405324]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [esi + 0x12]
cmp dword [0x404ed0], eax
jne 0x402560
jmp 0x402562
jmp 0x40252d
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x1c], 0
mov dword [0x4052d0], 0
mov eax, dword [esi + 0x16]
lea edi, [eax + esi]
lea ecx, [ecx]
mov eax, dword [edi]
add ax, word [edi + 4]
jmp 0x402668
mov eax, dword [edi]
test dword [esi + 0x1e], 0x40
je 0x402599
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0
push 1
push 0x404ed0
push dword [ebp - 8]
push dword [0x405324]
call sub.kernel32.dll_ReadProcessMemory
mov al, byte [edi + 4]
cmp al, byte [0x404ed0]
jne 0x402615
lea eax, [edi + 5]
push 0
push 1
push eax
push dword [ebp - 8]
push dword [0x405324]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x402600
cmp byte [ebp - 0x1d], 0
jne 0x402600
push 0x4052d4
push 0x40
push 1
push dword [ebp - 8]
push dword [0x405324]
call sub.kernel32.dll_VirtualProtectEx
cmp eax, 0
je 0x402670
mov byte [ebp - 0x1d], 1
jmp 0x4025be
mov byte [ebp - 0x1d], 0
mov dword [0x4052d0], 0
mov eax, 1
jmp 0x40265f
cmp dword [0x4052d0], 0
jne 0x402635
push dword [0x405328]
call sub.kernel32.dll_ResumeThread
add dword [0x4052d0], 1
jmp 0x402580
add dword [0x4052d0], 1
cmp dword [0x4052d0], 0xfa
jae 0x402656
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x402580
mov dword [ebp - 0x1c], 1
jmp 0x402670
add edi, 6
mov eax, dword [edi]
add ax, word [edi + 4]
or eax, eax
jne 0x40258b
cmp dword [ebp - 0x1c], 1
jne 0x402699
push 0
push dword [0x405324]
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x404ad0
push str.Time_out.Bytes_not_found.
push 0
call sub.user32.dll_MessageBoxA
popal
leave
ret
push dword [0x405328]
call sub.kernel32.dll_ResumeThread
call fcn.00401aaf
mov eax, dword [ebp - 0x14]
or eax, eax
je 0x4026be
push 0x4000
push dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualFree
jmp 0x4022f8
popal
leave
ret