Function at 0x4010fc
Capabilities:
Create process on windows
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0x68
push dword [0x403004]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401150
push 5
push 0x4020fe
push 0x402103
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 4
jne 0x40114b
jmp 0x401112
jmp 0x4013ad
mov dword [ebp - 4], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x403014], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x401195
push 5
push 0x4020fe
push 0x402110
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 4
jne 0x401190
jmp 0x401160
jmp 0x4013a5
mov dword [0x40300c], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x4011cb
push 5
push 0x4020fe
push 0x40211d
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 4
jne 0x4011c6
jmp 0x40119a
jmp 0x40139a
mov dword [0x403010], eax
add dword [0x403014], eax
cld
mov eax, 0xff00
mov edi, 0x40311c
inc ah
scasb al, byte es:[edi]
jne 0x4011e1
cmp ah, 0
je 0x40138f
mov bh, ah
mov edx, dword [0x403010]
mov esi, edx
mov edi, 0x40311c
movzx eax, bh
add eax, esi
cmp dword [0x403014], eax
js 0x40138f
movzx ecx, bh
mov edx, esi
inc edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4011f7
push 5
push 0x4020ce
push dword [ebp + 8]
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 4
jne 0x401389
push 1
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x1f
ja 0x401269
push 5
push 0x4020fe
push 0x402103
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 4
jne 0x401264
jmp 0x401233
jmp 0x401389
push 0x3e8
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0x64
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x45
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x45
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0x3e8
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0x3e8
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0x1f4
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0x3e8
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0x64
push dword [0x403221]
call sub.kernel32.dll_WaitForSingleObject
push 0
push 0
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_keybd_event
inc dword [0x403008]
push dword [0x403010]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x40300c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
leave
ret 4