Function at 0x4017f2
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create process suspended
Get file size
Query environment variable
Read file on windows
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0xc], 0
push 1
push 3
call fcn.00401057
or eax, eax
jne 0x40186c
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push str.snr_offsets.ldr
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401867
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
jmp 0x40186c
jmp 0x401b0a
mov dword [ebp - 4], eax
jmp 0x40188e
mov ecx, dword [0x4031f4]
inc ecx
push ecx
push 3
call fcn.00401057
or eax, eax
je 0x401889
cmp eax, dword [ebp - 4]
jne 0x40188e
jmp 0x401b0a
mov esi, eax
push 1
push 0xe
call fcn.00401057
or eax, eax
je 0x4018a2
lea eax, [eax + 9]
jmp 0x4018a5
lea eax, [esi + 0x22]
push 0x400
push 0x4031f8
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push esi
mov esi, 0x4031f8
jmp 0x4018d9
lodsb al, byte [esi]
cmp al, 0x25
jne 0x4018d9
push 0x4031f8
call fcn.00401d60
push eax
push 0x4031f8
call sub.kernel32.dll_lstrcpyA
jmp 0x4018de
cmp byte [esi], 0
jne 0x4018bd
pop esi
mov ebx, dword [esi + 2]
or ebx, ebx
je 0x401930
push 0x4031f8
call fcn.00401cd0
cmp eax, 0xffffffff
je 0x401918
cmp ebx, eax
je 0x401930
push 0x30
push 0x4031f8
push 0x4030a1
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401b0d
jmp 0x401af0
push 0x30
push 0x4031f8
push 0x403068
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401af0
cmp dword [esi + 0xa], 0
je 0x401962
push 0x4031f8
call fcn.00401b41
cmp dword [esi + 0xa], eax
je 0x401962
push 0x30
push 0x4031f8
push str.CRC32_
push 0
call sub.user32.dll_MessageBoxA
call fcn.00401b0d
jmp 0x401af0
test dword [esi + 0x1e], 4
je 0x401af0
call sub.kernel32.dll_GetCommandLineA
push 0x403a44
push 0x403a00
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push 0x4031f8
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x4019b1
push 0x30
push 0x4031f8
push 0x403078
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401af0
cmp dword [esi + 0xe], 0
je 0x4019ea
push dword [0x403a48]
call sub.kernel32.dll_ResumeThread
push 0
push 4
push 0x4035f8
push dword [esi + 0xe]
push dword [0x403a44]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [esi + 0x12]
cmp dword [0x4035f8], eax
jne 0x4019e8
jmp 0x4019ea
jmp 0x4019c2
mov byte [ebp - 0x11], 0
mov dword [0x4039f8], 0
mov eax, dword [esi + 0x16]
lea edi, [eax + esi]
mov edi, edi
jmp 0x401aae
push 0
push 1
push 0x4035f8
push dword [edi]
push dword [0x403a44]
call sub.kernel32.dll_ReadProcessMemory
mov al, byte [edi + 4]
cmp al, byte [0x4035f8]
jne 0x401a7b
lea eax, [edi + 5]
push 0
push 1
push eax
push dword [edi]
push dword [0x403a44]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x401a66
cmp byte [ebp - 0x11], 0
jne 0x401a66
push 0x4039fc
push 0x40
push 1
push dword [edi]
push dword [0x403a44]
call sub.kernel32.dll_VirtualProtectEx
cmp eax, 0
je 0x401abe
mov byte [ebp - 0x11], 1
jmp 0x401a26
mov byte [ebp - 0x11], 0
mov dword [0x4039f8], 0
mov eax, 1
jmp 0x401aab
push dword [0x403a48]
call sub.kernel32.dll_ResumeThread
add dword [0x4039f8], 1
cmp dword [0x4039f8], 0xfa
jae 0x401aa7
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x401a00
xor eax, eax
jmp 0x401abe
add edi, 6
cmp dword [edi], 0
je 0x401abe
cmp word [edi + 4], 0
jne 0x401a05
or eax, eax
jne 0x401ae5
push 0
push dword [0x403a44]
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x4031f8
push 0x4031a1
push 0
call sub.user32.dll_MessageBoxA
popal
leave
ret
push dword [0x403a48]
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x401b05
push 0x4000
push dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree
jmp 0x401871
popal
leave
ret