Function at 0x4010f0
Capabilities:
Accept command line arguments
Create process on windows
Get file size
Parse pe header
Read file via mapping
Resume thread

Disassembly:
call dword [sym.imp.kernel32.dll_GetCommandLineA]
inc eax
mov dword [0x4067a8], 0
mov dword [0x406680], eax
cmp byte [eax], 0x22
je 0x401116
inc eax
mov dword [0x406680], eax
cmp byte [eax], 0x22
jne 0x40110b
push ebx
push ebp
push esi
push edi
inc eax
push 0
mov dword [0x406680], eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x40660c], eax
mov esi, dword [eax + 0x3c]
mov edi, dword [0x4067a8]
add esi, eax
xor eax, eax
mov dword [0x406608], esi
lea ecx, [esi + 0xf8]
mov dword [0x406604], ecx
mov ax, word [esi + 6]
cmp edi, eax
jae 0x4011bb
mov ebp, dword [str.....]
mov eax, dword [0x4067a0]
movsx edx, byte [ebp]
xor ebx, ebx
mov bl, byte [ecx]
cmp ebx, edx
jne 0x40119f
movsx edx, byte [ebp + 1]
xor ebx, ebx
mov bl, byte [ecx + 1]
cmp ebx, edx
jne 0x40119f
movsx edx, byte [ebp + 2]
xor ebx, ebx
mov bl, byte [ecx + 2]
cmp ebx, edx
jne 0x40119f
movsx edx, byte [ebp + 3]
xor ebx, ebx
mov bl, byte [ecx + 3]
cmp ebx, edx
jne 0x40119f
mov eax, dword [esi + 0x34]
mov edx, dword [ecx + 0xc]
add eax, edx
mov dword [0x4067a0], eax
add ecx, 0x28
inc edi
xor edx, edx
mov dword [0x406604], ecx
mov dword [0x4067a8], edi
mov dx, word [esi + 6]
cmp edi, edx
jb 0x40115f
jmp 0x4011c0
mov eax, dword [0x4067a0]
test eax, eax
jne 0x4011da
push 0x40615c
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push 0
push 0
mov dword [0x40679c], eax
mov ecx, dword [eax]
push 3
push 0
add eax, 4
push 1
push 0x80000000
push eax
mov dword [0x406788], ecx
mov dword [0x4067a0], eax
mov dword [0x40678c], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x40667c], eax
jne 0x401255
or ecx, eax
mov edi, 0x406130
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x40678c]
mov edx, ecx
mov ebx, edi
or ecx, 0xffffffff
push ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call ebp
mov eax, dword [0x4067a0]
mov dword [0x406794], eax
mov cl, byte [eax]
mov esi, dword [0x4067a0]
inc eax
inc esi
test cl, cl
mov byte [0x406790], cl
mov dword [0x406794], eax
mov dword [0x4067a0], esi
jne 0x401268
mov ecx, 0x11
xor eax, eax
mov edi, 0x406620
mov edx, dword [0x40678c]
rep stosd dword es:[edi], eax
mov dword [0x406610], eax
mov ecx, dword [0x406680]
mov dword [0x406614], eax
push 0x406610
mov dword [0x406618], eax
push 0x406620
push eax
push eax
push 0x24
push eax
push eax
push eax
push ecx
push edx
mov dword [0x40661c], eax
mov dword [0x406620], 0x44
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x4012f2
push 0x406110
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov esi, dword [sym.imp.kernel32.dll_ReadProcessMemory]
mov eax, dword [0x4067a0]
mov edi, 0x406684
mov dword [0x40679c], eax
mov ecx, dword [eax]
add eax, 4
cmp ecx, 3
mov dword [0x4065f8], ecx
mov dword [0x4067a0], eax
ja case.default.0x401320
jmp dword [ecx*4 + 0x401890]
xor ecx, ecx
mov dword [0x406798], eax
mov cx, word [eax]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [0x4067a0]
add eax, 2
mov dword [0x4067a0], eax
jmp case.0x401320.0
mov edx, dword [0x406614]
push edx
call dword [sym.imp.kernel32.dll_ResumeThread]
mov dword [0x4067a4], 1
jmp 0x4016f7
mov dword [0x406794], eax
mov dl, byte [eax]
xor ecx, ecx
push 0
test dl, dl
setne cl
inc eax
mov dword [0x406668], ecx
mov edx, eax
mov dword [0x406794], eax
mov dword [0x4067a0], edx
mov cl, byte [eax]
mov byte [0x4065e8], cl
mov ecx, dword [0x4065e8]
and ecx, 0xff
inc eax
mov dword [0x4065f0], eax
add eax, ecx
push 0x80
push 3
mov dword [0x406794], eax
mov dword [0x4065f4], eax
mov eax, dword [0x40678c]
push 0
push 1
lea edx, [edx + ecx*2 + 1]
push 0x80000000
push eax
mov dword [0x4067a0], edx
call dword [sym.imp.kernel32.dll_CreateFileA]
test eax, eax
mov dword [0x40667c], eax
je 0x40170f
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, dword [0x40667c]
push 0
push 0
push 0
push 2
push 0
push ecx
mov dword [0x406674], eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x406678], eax
je 0x40172a
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
test eax, eax
mov dword [0x406670], eax
je 0x40174e
mov edx, dword [0x406678]
push edx
call ebp
mov eax, dword [0x40667c]
push eax
call ebp
mov edx, dword [0x406670]
mov dword [0x40660c], edx
cmp word [edx], 0x5a4d
jne 0x40177a
mov eax, dword [edx + 0x3c]
add eax, edx
mov dword [0x406608], eax
cmp dword [eax], 0x4550
jne 0x4017a2
mov ecx, dword [0x4065e8]
mov esi, dword [0x4065f0]
xor eax, eax
and ecx, 0xff
mov dword [0x406794], esi
mov dword [0x4067a8], eax
jbe 0x4014a3
mov bl, byte [esi + eax]
mov byte [eax + 0x406684], bl
inc eax
cmp eax, ecx
mov dword [0x4067a8], eax
jb 0x401490
mov ebp, dword [0x406674]
xor eax, eax
xor esi, esi
mov edi, edx
mov dword [0x40666c], esi
mov dword [0x4067a8], eax
mov dword [0x406664], eax
mov dword [0x406794], edi
mov ecx, dword [0x4065e8]
and ecx, 0xff
mov bl, byte [edi]
cmp bl, byte [esi + 0x406684]
jne 0x4014de
inc esi
jmp 0x4014e0
xor esi, esi
inc eax
inc edi
cmp esi, ecx
mov dword [0x40666c], esi
mov dword [0x4067a8], eax
mov dword [0x406794], edi
je 0x401501
cmp eax, ebp
jae 0x4015aa
jmp 0x4014d1
cmp eax, ebp
jae 0x4015aa
push 0x4065e0
push 4
sub eax, ecx
push ecx
push eax
mov dword [0x406664], 1
call fcn.00401090
mov ecx, dword [0x406610]
add esp, 4
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [0x4065e8]
mov ecx, dword [0x4067a8]
mov edx, dword [0x4065f4]
and eax, 0xff
push 0x406600
push eax
sub ecx, eax
push edx
push ecx
call fcn.00401090
mov edx, dword [0x406610]
add esp, 4
push eax
push edx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x4017c9
mov eax, dword [0x4067a8]
mov ebp, dword [0x406674]
cmp eax, ebp
jae 0x4015a4
mov ecx, dword [0x406668]
test ecx, ecx
je 0x4015a4
mov edi, dword [0x406794]
mov edx, dword [0x406670]
xor esi, esi
mov dword [0x40666c], esi
jmp 0x4014c5
mov edx, dword [0x406670]
push edx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x406664]
test eax, eax
je 0x4017f1
mov eax, dword [0x4067a0]
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [sym.imp.kernel32.dll_ReadProcessMemory]
mov edi, 0x406684
jmp case.0x401320.0
mov dword [0x406794], eax
mov cl, byte [eax]
mov byte [0x4065e8], cl
mov ecx, dword [0x4065e8]
mov edx, ecx
mov dword [0x4065e4], 0
and edx, 0xff
lea ebx, [eax + edx*2 + 1]
inc eax
mov dword [0x4065f0], eax
add eax, edx
mov edx, dword [0x406788]
mov dword [0x4067a0], ebx
mov dword [0x406794], eax
mov dword [0x4065f4], eax
mov dword [0x406784], edx
mov eax, dword [0x4065f8]
and ecx, 0xff
push 0x4065fc
push ecx
mov ecx, dword [0x406610]
push edi
push eax
push ecx
call esi
test eax, eax
je 0x40180c
mov edx, dword [0x4065e8]
mov eax, dword [0x4065f0]
and edx, 0xff
mov dword [0x4065ec], edi
push edx
push edi
push eax
call fcn.00401050
add esp, 0xc
test eax, eax
jne 0x401692
mov eax, dword [0x406784]
dec eax
mov dword [0x406784], eax
je 0x401827
mov eax, dword [0x4065e4]
test eax, eax
jne 0x40169c
mov ecx, dword [0x4065e8]
jmp 0x401626
mov dword [0x4065e4], 1
mov ecx, dword [0x4065e8]
mov edx, dword [0x4065f8]
mov eax, dword [0x406610]
push 0x4065e0
and ecx, 0xff
push 4
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [0x4065e8]
mov edx, dword [0x4065f4]
mov eax, dword [0x4065f8]
and ecx, 0xff
push 0x406600
push ecx
mov ecx, dword [0x406610]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x401842
mov eax, dword [0x4067a0]
mov ecx, dword [0x4065f8]
test ecx, ecx
je 0x40185d
jmp 0x401302
call fcn.00401020
push 0x4060e4
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
call fcn.00401020
push 0x4060e4
call fcn.00401000
mov edx, dword [0x40667c]
add esp, 4
push edx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x4060e4
call fcn.00401000
mov eax, dword [0x406678]
add esp, 4
push eax
call ebp
mov ecx, dword [0x40667c]
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x4060c4
call fcn.00401000
mov edx, dword [0x406670]
add esp, 4
push edx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x4060c4
call fcn.00401000
mov eax, dword [0x406670]
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x406094
call fcn.00401000
mov ecx, dword [0x406670]
add esp, 4
push ecx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40607c
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
call fcn.00401020
push 0x406050
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
call fcn.00401020
push 0x406040
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
call fcn.00401020
push 0x406094
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [0x4067a4]
test eax, eax
jne 0x401873
mov edx, dword [0x406614]
push edx
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [0x406610]
push eax
call ebp
mov ecx, dword [0x406614]
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10