Function at 0x4013d5
Capabilities:
Create process on windows
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x401416
leave
ret
mov dword [ebp - 4], eax
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
sub eax, 0x2800
cmp eax, 0
ja 0x40142d
leave
ret
mov ebx, eax
push 0
push 0
push 0x2800
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
call sub.KERNEL32.DLL_GetProcessHeap
mov dword [0x404448], eax
add ebx, 0x20
push ebx
push 0xc
push eax
call sub.KERNEL32.DLL_HeapAlloc
mov dword [0x40444c], eax
sub ebx, 0x20
push 0
lea eax, [ebp - 8]
push eax
push ebx
push dword [0x40444c]
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov ebx, dword [0x40444c]
push esi
push edi
mov esi, dword [0x40444c]
mov ecx, dword [ebp - 8]
add esi, ecx
or ecx, ecx
je 0x4014a4
dec ecx
dec esi
mov edi, esi
dec edi
mov al, byte [esi]
dec esi
mov ah, byte [esi]
dec esi
xor al, ah
mov byte [edi], al
dec edi
loop 0x40149a
pop edi
pop esi
mov eax, dword [ebx]
mov dword [0x404478], eax
mov eax, dword [ebx + 4]
mov dword [0x40447c], eax
mov eax, dword [ebx + 8]
mov dword [0x404480], eax
mov eax, dword [ebx + 0xc]
mov dword [0x404484], eax
mov al, byte [ebx + 0x10]
mov byte [0x404488], al
add ebx, 0x11
mov dword [0x404464], ebx
inc ebx
cmp byte [ebx], 0
jne 0x4014d6
inc ebx
mov dword [0x40443c], ebx
inc ebx
cmp byte [ebx], 0
jne 0x4014e3
inc ebx
mov dword [0x404434], ebx
inc ebx
cmp byte [ebx], 0
jne 0x4014f0
inc ebx
mov dword [0x404438], ebx
inc ebx
cmp byte [ebx], 0
jne 0x4014fd
inc ebx
mov dword [0x404440], ebx
inc ebx
cmp byte [ebx], 0
jne 0x40150a
inc ebx
mov dword [0x404444], ebx
inc ebx
cmp byte [ebx], 0
jne 0x401517
inc ebx
mov dword [0x404470], ebx
add ebx, 0x10
cmp dword [ebx], 0
jne 0x401524
add ebx, 4
cmp dword [ebx], 0
je 0x40153c
mov dword [0x40442c], ebx
jmp 0x401546
mov dword [0x40442c], 0
push esi
push edi
lea esi, [ebp - 0x10c]
xor edx, edx
xor ecx, ecx
cld
lodsb al, byte [esi]
inc ecx
cmp al, 0
je 0x401561
cmp al, 0x5c
jne 0x401553
mov edx, ecx
jmp 0x401553
pop edi
pop esi
lea eax, [ebp - 0x10c]
add eax, edx
push dword [0x404464]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push dword [0x404454]
pop dword [0x404489]
push 0
push 0x80
push 3
push 0
push 1
push 0
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x4015ce
push 0x10
call sub.USER32.dll_MessageBeep
mov eax, dword [0x40443c]
cmp word [eax], 0x30
jne 0x4015ba
mov eax, 0
push 0x51010
push eax
push 0x4043b5
push 0
call sub.USER32.dll_MessageBoxA
leave
ret
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x404444]
cmp word [eax], 0x30
je 0x4015ff
mov eax, dword [0x40443c]
cmp word [eax], 0x30
jne 0x4015ef
mov eax, 0
push 0
push eax
push dword [0x404444]
push 0
call sub.USER32.dll_MessageBoxA
push section..data
call sub.KERNEL32.DLL_GetStartupInfoA
mov eax, 2
test byte [0x404483], 2
je 0x40161a
or eax, 1
push 0x404044
push section..data
push 0
push 0
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
jne 0x401646
jmp 0x4015a3
push 0xffffffffffffffff
push 0x404054
call sub.KERNEL32.DLL_WaitForDebugEvent
or eax, eax
jne 0x40166e
push dword [0x40445c]
push 0
push dword [0x404458]
call sub.KERNEL32.DLL_HeapFree
jmp 0x401982
cmp byte [0x40441a], 0
jne 0x401689
inc byte [0x40441a]
push dword [0x404064]
pop dword [0x40446c]
cmp byte [0x40441a], 2
jae 0x4016bf
mov ebx, dword [0x404470]
push dword [ebx]
pop dword [0x40416c]
push dword [0x40445c]
call fcn.004019e6
or eax, eax
je 0x4016b8
mov byte [0x40441a], 2
jmp 0x4016bf
mov byte [0x40441a], 1
cmp dword [0x404054], 5
jne 0x4016e3
mov eax, dword [0x40404c]
cmp eax, dword [0x404058]
jne 0x401946
jmp 0x401982
cmp dword [0x404054], 3
jne 0x4016f1
jmp 0x401946
cmp dword [0x404054], 1
jne 0x4018e5
cmp byte [0x40441b], 0
jne 0x40170c
call fcn.004019ad
cmp dword [0x404060], 0x80000003
jne 0x4018a4
mov dword [0x4040b4], 0x10007
cmp byte [0x40441a], 2
jne 0x401736
mov byte [0x40441a], 3
push 0x4040b4
push dword [0x404048]
call sub.KERNEL32.DLL_GetThreadContext
cmp dword [0x404474], 0
je 0x4017b3
mov eax, dword [0x404474]
inc eax
cmp eax, dword [0x40416c]
jne 0x401946
dec dword [0x40416c]
push 0x4040b4
push dword [0x404048]
call sub.KERNEL32.DLL_SetThreadContext
movzx eax, byte [ebx + 0xc]
push eax
push dword [0x40445c]
call fcn.00401ae7
mov ebx, dword [0x404470]
push dword [ebx]
pop dword [0x40416c]
push dword [0x40445c]
call fcn.00401a0e
or eax, eax
je 0x4017ae
mov dword [0x404474], 0
jmp 0x401946
mov ebx, dword [0x404470]
cmp dword [ebx], 0
je 0x40189f
mov eax, dword [ebx]
inc eax
cmp eax, dword [0x40416c]
jne 0x40189f
dec dword [0x40416c]
push 0x4040b4
push dword [0x404048]
call sub.KERNEL32.DLL_SetThreadContext
movzx eax, byte [ebx + 0xc]
push eax
push dword [0x40445c]
call fcn.00401ae7
dec byte [ebx + 4]
cmp byte [ebx + 4], 0
jne 0x40186d
cmp dword [ebx + 0x10], 0
jne 0x40184a
mov byte [0x40441a], 2
call fcn.004011af
call section..text
push 0x10002
push dword [0x40405c]
push dword [0x404058]
call sub.KERNEL32.DLL_ContinueDebugEvent
push 0x64
push 0x401e35
push 0
push 0x64
push dword [0x404468]
call sub.USER32.dll_DialogBoxParamA
jmp 0x401646
call fcn.004011af
add ebx, 0x10
mov dword [0x404470], ebx
push dword [ebx]
pop dword [0x40416c]
push dword [0x40445c]
call fcn.00401a0e
jmp 0x40189f
movzx eax, byte [ebx + 0xc]
add eax, dword [ebx]
mov dword [0x40416c], eax
mov dword [0x404474], eax
push 1
push dword [0x40445c]
call fcn.00401a72
mov eax, dword [0x40445c]
add eax, 0x10
mov word [eax], 0xcc
push 1
push eax
call fcn.00401ae7
jmp 0x401946
cmp dword [0x404060], 0xc0000005
jne 0x4018c8
cmp byte [0x40441a], 2
jae 0x4018c8
cmp byte [0x40441c], 0xff
jae 0x4018c8
inc byte [0x40441c]
push 0x80010001
push dword [0x40405c]
push dword [0x404058]
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x401646
cmp byte [0x40441a], 2
jbe 0x4018f7
mov byte [0x40441a], 2
jmp 0x401946
cmp byte [0x40441a], 2
jae 0x401946
cmp byte [0x40441c], 0xa
jbe 0x401946
cmp byte [0x40441c], 0xff
je 0x401946
mov byte [0x40441c], 0xff
mov ebx, dword [0x404470]
push dword [ebx]
pop dword [0x40416c]
push dword [0x40445c]
call fcn.004019e6
or eax, eax
je 0x40193f
mov byte [0x40441a], 2
jmp 0x401946
mov byte [0x40441a], 1
test byte [0x40441a], 1
jne 0x401967
push 0x80010001
push dword [0x40405c]
push dword [0x404058]
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x40197d
push 0x10002
push dword [0x40405c]
push dword [0x404058]
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x401646
push dword [0x404044]
call sub.KERNEL32.DLL_CloseHandle
push dword [0x404048]
call sub.KERNEL32.DLL_CloseHandle
push dword [0x40444c]
push 0
push dword [0x404448]
call sub.KERNEL32.DLL_HeapFree
leave
ret