Function at 0x40196b
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create process suspended
Get file size
Query environment variable
Read .ini file
Read file on windows
Resume thread
Set environment variable
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
pushal
mov dword [ebp - 0xc], 0
push 1
push 3
call fcn.00401057
or eax, eax
jne 0x4019e8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 0x40468c
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4019e3
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
jmp 0x4019e8
jmp 0x401d4a
mov dword [ebp - 4], eax
jmp 0x401a0a
mov ecx, dword [0x404284]
inc ecx
push ecx
push 3
call fcn.00401057
or eax, eax
je 0x401a05
cmp eax, dword [ebp - 4]
jne 0x401a0a
jmp 0x401d4a
mov esi, eax
push 1
push 0xe
call fcn.00401057
or eax, eax
je 0x401a1e
lea eax, [eax + 9]
jmp 0x401a21
lea eax, [esi + 0x22]
push 0x400
push 0x404a8c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push esi
mov esi, 0x404a8c
jmp 0x401a55
lodsb al, byte [esi]
cmp al, 0x25
jne 0x401a55
push 0x404a8c
call fcn.004020d0
push eax
push 0x404a8c
call sub.kernel32.dll_lstrcpyA
jmp 0x401a5a
cmp byte [esi], 0
jne 0x401a39
pop esi
push 0x40428c
call fcn.00401fa0
cmp eax, 1
jne 0x401a8a
push 0x40428c
push 0x400
push 0x404a8c
push 0
push 0x404190
push 0x40418c
call sub.kernel32.dll_GetPrivateProfileStringA
mov edi, 0x404a8c
cmp byte [edi + 1], 0x3a
je 0x401ae4
push 0x400
lea eax, [ebp - 0x411]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x411]
push eax
call fcn.00401e92
cmp byte [edi], 0x5c
je 0x401aca
push 0x404199
lea eax, [ebp - 0x411]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0x411]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x411]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
push 0x404a8c
push str.dup2_last_file
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x404a8c
lea eax, [ebp - 0x411]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x411]
push eax
call fcn.00401e92
lea eax, [ebp - 0x411]
push eax
push str.dup2_last_path
call sub.kernel32.dll_SetEnvironmentVariableA
mov ebx, dword [esi + 2]
or ebx, ebx
je 0x401b6e
push 0x404a8c
call fcn.00401fe0
cmp eax, 0xffffffff
je 0x401b5a
cmp ebx, eax
je 0x401b6e
push 0x30
push 0x404a8c
push 0x4040a1
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401d4d
jmp 0x401d30
push 0x404a8c
call fcn.00401d81
cmp eax, 1
je 0x401b28
jmp 0x401d30
cmp dword [esi + 0xa], 0
je 0x401ba0
push 0x404a8c
call fcn.00401e0a
cmp dword [esi + 0xa], eax
je 0x401ba0
push 0x30
push 0x404a8c
push str.CRC32_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401d4d
jmp 0x401d30
test dword [esi + 0x1e], 4
je 0x401d30
call sub.kernel32.dll_GetCommandLineA
push 0x4052d8
push 0x405294
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push 0x404a8c
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x401bef
push 0x30
push 0x404a8c
push 0x404078
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401d30
cmp dword [esi + 0xe], 0
je 0x401c28
push dword [0x4052dc]
call sub.kernel32.dll_ResumeThread
push 0
push 4
push 0x404e8c
push dword [esi + 0xe]
push dword [0x4052d8]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [esi + 0x12]
cmp dword [0x404e8c], eax
jne 0x401c26
jmp 0x401c28
jmp 0x401c00
mov byte [ebp - 0x11], 0
mov dword [0x40528c], 0
mov eax, dword [esi + 0x16]
lea edi, [eax + esi]
lea esp, [esp]
jmp 0x401cee
push 0
push 1
push 0x404e8c
push dword [edi]
push dword [0x4052d8]
call sub.kernel32.dll_ReadProcessMemory
mov al, byte [edi + 4]
cmp al, byte [0x404e8c]
jne 0x401cbb
lea eax, [edi + 5]
push 0
push 1
push eax
push dword [edi]
push dword [0x4052d8]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x401ca6
cmp byte [ebp - 0x11], 0
jne 0x401ca6
push 0x405290
push 0x40
push 1
push dword [edi]
push dword [0x4052d8]
call sub.kernel32.dll_VirtualProtectEx
cmp eax, 0
je 0x401cfe
mov byte [ebp - 0x11], 1
jmp 0x401c66
mov byte [ebp - 0x11], 0
mov dword [0x40528c], 0
mov eax, 1
jmp 0x401ceb
push dword [0x4052dc]
call sub.kernel32.dll_ResumeThread
add dword [0x40528c], 1
cmp dword [0x40528c], 0xfa
jae 0x401ce7
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x401c40
xor eax, eax
jmp 0x401cfe
add edi, 6
cmp dword [edi], 0
je 0x401cfe
cmp word [edi + 4], 0
jne 0x401c45
or eax, eax
jne 0x401d25
push 0
push dword [0x4052d8]
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x404a8c
push 0x4041b9
push 0
call sub.user32.dll_MessageBoxA
popal
leave
ret
push dword [0x4052dc]
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x401d45
push 0x4000
push dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree
jmp 0x4019ed
popal
leave
ret