Function at 0x4038e4
Capabilities:
Encode data using xor
Get file size
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00404d7f
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x403c88
mov dword [0x40138c], eax
push 0
push dword [0x40138c]
call sub.kernel32.dll_GetFileSize
or eax, eax
jne 0x403935
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403c96
mov dword [0x401370], eax
mov eax, dword [0x401370]
add eax, 0x60
add eax, 0xdae
add eax, dword [0x4037bc]
mov dword [0x401374], eax
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
jne 0x40396e
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403c7a
mov dword [0x40136c], eax
push 0
push 0x401364
push dword [0x401370]
push dword [0x40136c]
push dword [0x40138c]
call sub.kernel32.dll_ReadFile
mov edi, dword [0x40136c]
cmp word [edi], 0x5a4d
je 0x4039b9
push dword [0x40136c]
call sub.kernel32.dll_GlobalFree
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403c81
add edi, dword [edi + 0x3c]
cmp word [edi], 0x4550
je 0x4039de
push dword [0x40136c]
call sub.kernel32.dll_GlobalFree
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403c81
mov dword [0x40137c], edi
push dword [edi + 0x80]
pop dword [0x401388]
push word [edi + 6]
pop word [0x401380]
cmp dword [0x401380], 0x14
jbe 0x403a09
jmp 0x403c9d
push dword [edi + 0x28]
pop dword [0x4048f9]
push dword [edi + 0x34]
pop dword [0x4048f5]
xor eax, eax
mov ecx, 4
lea edi, [edi + 0xd0]
stosd dword es:[edi], eax
loop 0x403a28
push dword [0x401388]
push dword [0x40136c]
call fcn.00403fa4
push eax
push dword [0x40136c]
call fcn.00403ead
or eax, eax
jne 0x403a67
push dword [0x40136c]
call sub.kernel32.dll_GlobalFree
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403ca4
push dword [0x40136c]
call fcn.00403cf4
or eax, eax
jne 0x403a91
push dword [0x40136c]
call sub.kernel32.dll_GlobalFree
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
jmp 0x403c8f
xchg esi, eax
mov eax, dword [esi + 0x14]
mov dword [0x401384], eax
add eax, dword [0x40136c]
push dword [esi + 0xc]
push eax
call fcn.00403dbb
push dword [esi + 0xc]
push dword [0x40136c]
call fcn.00403e56
pushal
push 0x30
push 0x4044f0
push 0x403cc0
call fcn.00404d8b
mov eax, dword [0x40136c]
mov ebx, 0
call fcn.0040446b
popal
mov edi, dword [0x40137c]
push dword [esi + 0xc]
pop dword [edi + 0x80]
mov eax, dword [esi + 0xc]
add eax, 0x60
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
mov dword [edi + 0x50], eax
push dword [ebp + 0x10]
pop dword [0x4048fd]
mov eax, dword [0x401384]
add eax, 0x60
add eax, 0xdae
mov dword [0x401378], eax
mov edi, dword [0x401384]
add edi, 0x60
add edi, dword [0x40136c]
mov esi, 0x403fd1
mov ecx, 0xdae
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40136c]
add edi, dword [0x401384]
add edi, 0x60
add edi, 0x7d7
mov esi, edi
mov ecx, 0xdf
xor ebx, ebx
lodsb al, byte [esi]
ror al, 2
add al, bl
xor al, 0x79
stosb byte es:[edi], al
inc ebx
loop 0x403b4e
push 0x30
mov eax, dword [0x40136c]
add eax, dword [0x401384]
add eax, 0x60
add eax, 0x1b
push eax
push 0x403b97
call fcn.00404d8b
mov edi, dword [0x40136c]
add edi, dword [0x401384]
add edi, 0x60
add edi, 0x4e
mov ecx, 0xd43
mov esi, edi
lodsb al, byte [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
stosb byte es:[edi], al
loop 0x403b96
mov eax, dword [0x40136c]
mov ecx, dword [0x401378]
sub ecx, 5
call fcn.0040442e
mov dword [0x404d7a], eax
mov eax, dword [0x40136c]
add eax, 0x60
add eax, dword [0x401384]
add eax, 0xda9
mov edx, dword [0x404d7a]
mov dword [eax], edx
push 0
push 0
push 0
push dword [0x40138c]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x401368
push dword [0x401374]
push dword [0x40136c]
push dword [0x40138c]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [0x401378]
push dword [0x40138c]
call sub.kernel32.dll_SetFilePointer
push dword [0x40138c]
call sub.kernel32.dll_SetEndOfFile
push 0x40
push 0x403749
push 0x403740
push dword [ebp + 0xc]
call sub.user32.dll_MessageBoxA
push dword [0x40136c]
call sub.kernel32.dll_GlobalFree
push dword [0x40138c]
call sub.kernel32.dll_CloseHandle
leave
ret 0xc
mov eax, 0x40376c
jmp 0x403cab
mov eax, 0x40375d
jmp 0x403cab
mov eax, 0x40374e
jmp 0x403cab
mov eax, 0x40378d
jmp 0x403cab
mov eax, 0x40377b
jmp 0x403cab
mov eax, 0x40379e
jmp 0x403cab
mov eax, 0x4037a9
jmp 0x403cab
push 0x10
push 0x40373b
push eax
push dword [ebp + 0xc]
call sub.user32.dll_MessageBoxA
jmp 0x403c76