Function at 0x401490
Capabilities:
Accept command line arguments
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x720
push ebx
push esi
push edi
mov ecx, 0xf
mov esi, str.xx345y3x0sd4yy5x54ff0svpzoimdb
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [str.vpzoimdb]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x405574]
mov dword [ebp - 0x50], ecx
mov edx, dword [0x405578]
mov dword [ebp - 0x4c], edx
mov eax, dword [0x40557c]
mov dword [ebp - 0x48], eax
mov cx, word [0x405580]
mov word [ebp - 0x44], cx
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x470], 0
push 0
push str.Attention_
push str.Please__backup_ALL_your_data_first__Then_press_OK_and_wait_Done_MessageBox_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea eax, [ebp - 0x46c]
push eax
call fcn.00404af0
add esp, 8
mov dword [ebp - 0x260], 0
jmp 0x401545
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x260], eax
jge 0x4015fc
mov eax, dword [ebp - 0x260]
movzx ecx, word [ebp + eax*2 - 0x25c]
cmp ecx, 0x20
jne 0x4015c3
mov eax, dword [ebp - 0x260]
movzx ecx, word [ebp + eax*2 - 0x25a]
cmp ecx, 0x2f
jne 0x4015c3
mov eax, dword [ebp - 0x260]
movzx ecx, word [ebp + eax*2 - 0x258]
cmp ecx, 0x64
jne 0x4015c3
mov eax, dword [ebp - 0x260]
movzx ecx, word [ebp + eax*2 - 0x256]
cmp ecx, 0x20
jne 0x4015c3
mov eax, dword [ebp - 0x260]
add eax, 4
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x470], 1
cmp dword [ebp - 0x470], 0
je 0x4015f7
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x260]
mov dx, word [ebp + ecx*2 - 0x25c]
mov word [ebp + eax*2 - 0x46c], dx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x401536
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
cmp dword [ebp - 0x470], 0
je 0x4016d7
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx ecx, word [ebp + eax*2 - 0x46e]
cmp ecx, 0x5c
je 0x40165d
push 0x405528
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push str.Decryption_Directory
lea eax, [ebp - 0x46c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x49c], 0x3e8
mov dword [ebp - 0x498], 1
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x6a4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x6a4]
push eax
call fcn.00404700
add esp, 4
push 0
push str.Done_
push str.Done_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push str.Scanning_All_Drives
push str.Scanning_All_Drives
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x6d8]
push eax
push 0x34
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0x224
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x6d8]
mov dword [ebp - 0x6dc], eax
jmp 0x40173f
mov eax, dword [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x6dc]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x6dc], edx
mov eax, dword [ebp - 0x6dc]
movzx ecx, word [eax]
test ecx, ecx
je 0x40181c
mov eax, dword [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x401817
mov eax, dword [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jae 0x401817
mov eax, dword [ebp - 0x47c]
add eax, 1
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
imul eax, eax, 0x224
push eax
mov ecx, dword [ebp - 0x480]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x49c], 0x3e8
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x6a4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x224
lea eax, [ebp - 0x6a4]
push eax
mov ecx, dword [ebp - 0x47c]
sub ecx, 1
imul ecx, ecx, 0x224
add ecx, dword [ebp - 0x480]
push ecx
call fcn.004040c0
add esp, 0xc
jmp 0x401722
mov eax, dword [ebp - 0x47c]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x260], 0
jmp 0x401856
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x47c]
jge 0x4018b5
push 0
push 0
mov eax, dword [ebp - 0x260]
imul eax, eax, 0x224
add eax, dword [ebp - 0x480]
push eax
push 0x404980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x474]
mov dword [edx + ecx*4], eax
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x474]
cmp dword [ecx + eax*4], 0
jne 0x4018b3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401847
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x6e0], 0
jmp 0x4018e8
mov eax, dword [ebp - 0x6e0]
add eax, 1
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
cmp eax, dword [ebp - 0x47c]
jge 0x40190e
mov eax, dword [ebp - 0x6e0]
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx + eax*4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4018d9
mov eax, dword [ebp - 0x474]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x480]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push str.Done_
push str.Done_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]