Function at 0x41a5d1
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
movzx ebx, byte [esp + 0x1c]
mov esi, dword [esp + 0x14]
movzx edi, byte [esp + 0x18]
jno 0x41a2b2
jo 0x41a2b2
call 0xabfa09
push ebx
push edi
push 0
push esi
push eax
push edx
push 0
push 0
push 0
push ecx
call sub.ntdll.dll_NtLockFile
cmp eax, 0xc0000055
je 0x41a2db
cmp eax, 0xc000009a
je 0x41a2e6
test eax, eax
jne 0x41a2f1
xor eax, eax
jmp 0x41a2fa
jbe 0x41a2e0
ja 0x41a2e0
call 0x5f5b4a
mov ax, 0x1d
jmp 0x41a2fa
jp 0x41a2eb
jnp 0x41a2eb
call 0x575b55
mov ax, 0x15
jmp 0x41a2fa
jge 0x41a2f6
jl 0x41a2f6
call 0x505b60
mov ax, 0xe
jae 0x41a2ff
jb 0x41a2ff
call 0xc39d0261
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x40]
test byte [esp + 0x45], 2
mov esi, ecx
mov ecx, 0x200040
mov edi, 0x200001
jns 0x41a323
pop esi
pop edi
pop ebx
ret
js 0x41a323
call 0x1b7a69e
ja 0x41a328
jbe 0x41a328
call 0x1b2a69c
jo 0x41a32d
jno 0x41a32d
call 0x1bda6ae
jge 0x41a332
jl 0x41a332
call 0x1b3a6a9
jae 0x41a337
jb 0x41a337
call 0x1bfa6ba
jg 0x41a33c
jle 0x41a33c
call 0x8e3ae74f
or al, 0
cmove edi, ecx
lea ecx, [eax + eax]
mov word [esp + 8], cx
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edx
cmp word [edx], 0x2e
jne 0x41a385
jle 0x41a35b
jg 0x41a35b
call 0x28c5a6e
movzx ecx, word [edx + 2]
cmp ecx, 0x2e
je 0x41a375
test ecx, ecx
jne 0x41a385
ja 0x41a36d
jbe 0x41a36d
call 0x24a626d7
or byte [eax], al
and word [esp + 8], 0
jmp 0x41a385
jp 0x41a37a
jnp 0x41a37a
call 0x4bc26e4
add byte [edi], cl
test byte [eax + 1], bl
add byte [eax], al
cmp word [edx + 4], 0
je 0x41a4dd
mov ecx, edx
mov edx, eax
lea ebx, [esp + 0x18]
jae 0x41a392
jb 0x41a392
call 0x59a75d
add byte [eax], al
mov dword [ebx], 0x18
jp 0x41a39d
jnp 0x41a39d
call 0xffc24989
push dword [ecx]
leave
call 0x412447
xor ecx, ecx
test al, 1
lea eax, [esp + 8]
cmovne esi, ecx
mov dword [ebx + 4], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], eax
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
lea esi, [esp + 0x10]
mov eax, esp
jbe 0x41a3ca
ja 0x41a3ca
call 0xaba438
push 0
push 0
push edi
push 1
push 7
push 0
push 0
push esi
push ebx
push 0x110000
push eax
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x41a4cd
mov ecx, eax
mov ax, 8
cmp ecx, 0xc0000034
je 0x41a51d
cmp ecx, 0xc000003a
je 0x41a51d
cmp ecx, 0xc0000043
je 0x41a4d8
cmp ecx, 0xc0000056
je 0x41a4e3
cmp ecx, 0xc00000ba
je 0x41a4ec
cmp ecx, 0xc00000be
je 0x41a4f7
cmp ecx, 0xc00000cc
je 0x41a4fe
cmp ecx, 0xc0000103
je 0x41a509
test ecx, ecx
jne 0x41a514
je 0x41a462
jne 0x41a462
call 0x8d65b0f1
inc esp
and al, 4
mov ecx, dword [esp]
lea eax, [esp + 4]
mov byte [eax], 1
jns 0x41a471
js 0x41a471
call 0x1abb1df
push 0xd
push 1
push eax
push esi
push ecx
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x41a53d
cmp eax, 0xc00000a2
je 0x41a55a
invalid
cmp eax, 0xc0000101
je 0x41a577
cmp eax, 0xc0000121
je 0x41a595
test eax, eax
jne 0x41a5b2
jb 0x41a4b6
jae 0x41a4b6
call 0xe865a945
add dword [eax], eax
add byte [eax], al
mov eax, dword [esp]
call 0x41a4bf
add al, ch
push eax
call sub.ntdll.dll_NtClose
je 0x41a4cb
jne 0x41a4cb
call 0x3b1c0ba
jmp 0x41a4e8
jo 0x41a4d2
jno 0x41a4d2
call 0x4b5d3c
mov ax, 9
jmp 0x41a51d
jge 0x41a4dd
jl 0x41a4dd
call 0x5e5d47
mov ax, 0x1c
jmp 0x41a51d
je 0x41a4e8
jne 0x41a4e8
call 0x322d651d
xor eax, eax
jmp 0x41a51d
jbe 0x41a4f1
ja 0x41a4f1
call 0x595d5b
mov ax, 0x17
jmp 0x41a51d
jbe 0x41a4fc
ja 0x41a4fc
call 0x3b9aaeb
jmp 0x41a503
js 0x41a503
jns 0x41a503
call 0x515d6d
mov ax, 0xf
jmp 0x41a51d
jne 0x41a50e
je 0x41a50e
call 0x5b5d78
mov ax, 0x19
jmp 0x41a51d
jbe 0x41a519
ja 0x41a519
call 0x505d83
mov ax, 0xe
jge 0x41a522
jl 0x41a522
call 0x1b5a89b
jne 0x41a527
je 0x41a527
call 0x1bfa8aa
jg 0x41a52c
jle 0x41a52c
call 0x1bca8aa
jp 0x41a531
jnp 0x41a531
call 0x1bea8b1
jl 0x41a536
jge 0x41a536
call 0x5e7269bd
add esp, 0x30
pop esi
pop edi
pop ebx
ret
jge 0x41a542
jl 0x41a542
call 0x7065a9d1
add esi, dword [ecx + 1]
mov eax, dword [esp]
jo 0x41a54a
jno 0x41a54a
call 0xc3e48d9e
add dword [eax], eax
push eax
call sub.ntdll.dll_NtClose
jo 0x41a555
jno 0x41a555
call fcn.00411e42
push dword [ebx + 3]
jmp 0x41a4d2
jae 0x41a55f
jb 0x41a55f
call 0x7965a9ee
add edi, dword [eax + 1]
mov eax, dword [esp]
jns 0x41a567
js 0x41a567
call 0xc3c78dbb
add dword [eax], eax
push eax
call sub.ntdll.dll_NtClose
jl 0x41a572
jge 0x41a572
call fcn.0041015f
invalid
jmp 0x41a4d2
jns 0x41a57c
js 0x41a57c
call 0x7065aa0b
add esi, dword [ecx + 1]
mov eax, dword [esp]
jo 0x41a584
jno 0x41a584
call 0xc3aa8dd8
add dword [eax], eax
push eax
call sub.ntdll.dll_NtClose
ja 0x41a58f
jbe 0x41a58f
call 0xae5df9
mov ax, 0x6c
jmp 0x41a51d
jb 0x41a59a
jae 0x41a59a
call 0x7665aa29
add esi, dword [edi + 1]
mov eax, dword [esp]
jbe 0x41a5a2
ja 0x41a5a2
call 0xc38c8df6
add dword [eax], eax
push eax
call sub.ntdll.dll_NtClose
jb 0x41a5ad
jae 0x41a5ad
call fcn.0040c69a
invalid
jmp 0x41a4d2
call 0x41a5b8
add al, ch
mov eax, dword [esp]
jb 0x41a5c1
jae 0x41a5c1
call 0xc36d8e15
add dword [eax], eax
push eax
call sub.ntdll.dll_NtClose
je 0x41a5cc
jne 0x41a5cc
call fcn.0040eeb9
call dword [ebp + 0x53]
push edi
push esi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ebp, edx
jg 0x41a5e2
jmp 0x41a519
jle 0x41a5e2
call 0x3b5991f
cmp ebx, esi
jae 0x41a5e9
jb 0x41a5e9
call 0x3bdc360
jae 0x41a608
jl 0x41a5f0
jge 0x41a5f0
call 0xdc29fd49
rol dword [ecx], 0
push ebp
push edi
call 0x4367d2
test eax, eax
je 0x41a60c
jne 0x41a600
je 0x41a600
call 0xef439105
add ebx, ebp
add edi, ebp
xor ebp, ebp
jmp 0x41a5e2
xor eax, eax
jmp 0x41a61a
jge 0x41a611
jl 0x41a611
call 0x203b0fd
add byte [esi - 0x48], ah
push cs
add byte [ecx + 3], dh
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
jno 0x41a61f
jo 0x41a61f
call 0x5d9d0581
pop esi
pop edi
pop ebx
pop ebp
ret