Function at 0x17ea400
Capabilities:
Generate random numbers via winapi
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x458
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rax, qword [0x039f1190]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edi, r9d
mov dword [rsp + 0x50], r9d
mov r15, r8
mov rsi, rdx
mov qword [rsp + 0xd0], rcx
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0xd8], rax
mov word [rsp + 0x230], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x232]
call sub.MSVCR80.dll_memset
mov word [rsp + 0x130], 0
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0x132]
call sub.MSVCR80.dll_memset
mov qword [rsp + 0x58], 0
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x17ea4ba
lea r13, [rax + 0x20]
jmp 0x17ea4bd
xor r13d, r13d
mov qword [rsp + 0x58], r13
lea r14, [r13 + 0x30]
mov rcx, qword [r14]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
mov r12, rax
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x17ea4e2
cmp word [rsi], 0
jne 0x17ea4e9
lea rsi, [0x017eb270]
lea rbp, [rsp + 0x230]
mov word [rsp + 0x230], 0
mov ebx, 0xff
movzx eax, word [rsi]
test ax, ax
je 0x17eadad
lea r13, [0x01000000]
test ebx, ebx
jle 0x17ead7d
cmp ax, 0x3c
jne 0x17ea94c
mov r8d, 6
lea rdx, [0x017eb260]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17ea58c
add rsi, 0xc
lea rcx, [rsp + 0xe8]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
mov edi, eax
test eax, eax
js 0x17eaa7d
mov r8d, ebx
mov rdx, rbp
lea rcx, [rsp + 0xe8]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x17eaa4d
sub eax, 1
sub ebx, eax
cdqe
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov r8d, 5
lea rdx, [0x017eb250]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17ea62e
add rsi, 0xa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [0x0157e4d0]
mov edx, 0x7f
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17eaac0
mov word [rsp + 0x22e], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17eaa90
movsxd rdx, ebx
lea r8, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov r8d, 5
lea rdx, [0x017eb240]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17ea6d0
add rsi, 0xa
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, [0x017eb234]
mov edx, 0x7f
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17eab20
mov word [rsp + 0x22e], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17eaaf0
movsxd rdx, ebx
lea r8, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov r8d, 4
lea rdx, [0x017eb228]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17ea77a
add rsi, 8
mov r9d, 1
lock xadd dword [0x03e497a8], r9d
add r9d, 1
lea r8, [0x0157e4d0]
lea edx, [rax + 0x7f]
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17eab80
mov word [rsp + 0x22e], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17eab50
movsxd rdx, ebx
lea r8, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov r8d, 6
lea rdx, [0x017eb218]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17ea850
add rsi, 0xc
cmp ebx, 5
jb 0x17eac24
xor r12d, r12d
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [rax + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x17eabf3
mov edi, r12d
nop
nop
lea r8, [rsp + 0x70]
mov edx, 4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x17eabb0
mov eax, 0x38e38e39
mov ecx, dword [rsp + 0x70]
mul ecx
shr edx, 3
lea eax, [rdx + rdx*8]
shl eax, 2
sub ecx, eax
mov eax, ecx
movzx eax, word [r13 + rcx*2 + 0x580f20]
mov word [rbp], ax
add rbp, 2
add edi, 1
cmp edi, 5
jb 0x17ea7e0
sub ebx, 5
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x17eaa38
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [0x017eb1f8]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x17eacb4
add rsi, 0x1e
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0xce]
movzx eax, word [rsp + 0xcc]
movzx ecx, word [rsp + 0xca]
movzx edi, word [rsp + 0xc8]
movzx r8d, word [rsp + 0xc6]
movzx r10d, word [rsp + 0xc2]
movzx r9d, word [rsp + 0xc0]
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, [0x017eb1b0]
mov edx, SafeArrayCopy
lea rcx, [rsp + 0xf8]
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17eac84
mov word [rsp + 0x128], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17eac54
movsxd rdx, ebx
lea r8, [rsp + 0xf8]
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
cmp ax, 0x25
jne 0x17eaa27
movzx ecx, word [rsi + 2]
cmp cx, 0x73
jne 0x17ea9a6
add rsi, 4
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17eace1
mov r8, r15
mov edx, 0x104
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
cmp cx, 0x64
jne 0x17eaa27
add rsi, 4
mov r9d, edi
lea r8, [0x0157e4d0]
mov edx, 0x7f
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCR80.dll_swprintf_s]
cmp eax, 0xffffffff
je 0x17ead41
mov word [rsp + 0x22e], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp ecx, ebx
jg 0x17ead11
movsxd rdx, ebx
lea r8, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
sub ebx, edi
movsxd rax, edi
lea rbp, [rbp + rax*2]
mov edi, dword [rsp + 0x50]
jmp 0x17eaa3c
mov word [rbp], ax
add rbp, 2
add rsi, 2
sub ebx, 1
jmp 0x17eaa3c
mov edi, dword [rsp + 0x50]
mov ax, word [rsi]
test ax, ax
je 0x17ead71
jmp 0x17ea513
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000001
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000001
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000001
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x17eabc2
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, 0xc1010000
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, 0xc1010000
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000001
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
lea r8, [0x017eb178]
mov edx, 0x1167
lea rcx, [0x01580f90]
call fcn.017eea00
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000001
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
jmp 0x17eadad
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x78]
jmp 0x17eb14d
mov word [rbp], 0
cmp word [rsi], 0
jne 0x17eb124
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x17eb124
lea rcx, [rsp + 0x80]
call fcn.0116d180
nop
lea rax, [0x01165c20]
mov qword [rsp + 0x98], rax
lea rdi, [0x01000000]
lea rax, [rdi + 0x4f0d0]
mov qword [rsp + 0x80], rax
lea rax, [0x0109b930]
mov qword [rsp + 0x98], rax
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
lea rbx, [0x0104ef20]
mov qword [rsp + 0x80], rbx
lea rsi, [0x0109b930]
mov qword [rsp + 0x98], rsi
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.0116cfa0
xor edx, edx
lea rcx, [rsp + 0x80]
mov rax, qword [rsp + 0x80]
call qword [rax + 0x180]
nop
mov edx, dword [reloc.OLEAUT32.dll_VariantInit]
and edx, 7
lea rax, [rdx + rdx*2]
movzx ecx, byte [rdi + rax*2 + 0x173e9d]
movzx eax, byte [rdi + rax*2 + 0x173e9c]
add eax, ecx
cdqe
movabs r8, 0x7fffffffffffffff
mov rcx, r8
sub rcx, rax
shr rcx, 1
sub rcx, 1
cmp rcx, 0x104
jge 0x17eaf0f
lea r8, [0x017eb178]
mov edx, 0x1191
lea rcx, [0x01580f90]
call fcn.017eea00
mov edi, eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
jmp 0x17eb14d
lea rax, [rdx + rdx*2]
movzx ecx, byte [rdi + rax*2 + 0x173e9d]
movzx eax, byte [rdi + rax*2 + 0x173e9c]
add ecx, eax
movsxd rdi, ecx
add rdi, 0x20a
mov rcx, qword [r14]
cmp rdi, r8
jae 0x17eb0db
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + SafeArrayCopy]
test rax, rax
je 0x17eb0db
mov rcx, qword [r13 + 0x28]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rdi
lea rcx, [rsp + 0x68]
call fcn.0116a950
nop
mov r9, qword [r13 + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x68]
call fcn.0118a2d0
mov edi, eax
test eax, eax
jns 0x17eafd5
lea rcx, [rsp + 0x68]
call fcn.0116a920
nop
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
jmp 0x17eb14d
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xd0]
call fcn.017e7510
mov edi, eax
test eax, eax
jns 0x17eb027
lea rcx, [rsp + 0x68]
call fcn.0116a920
nop
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
jmp 0x17eb14d
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x17eb043
movzx eax, byte [r8 - 5]
test al, 0x40
jne 0x17eb03e
test al, 0x20
je 0x17eb046
mov r8, qword [r8]
jmp 0x17eb046
mov r8, rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x230]
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call fcn.0122c810
mov edi, eax
test eax, eax
jns 0x17eb0a2
lea rcx, [rsp + 0x68]
call fcn.0116a920
nop
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
jmp 0x17eb14d
lea rcx, [rsp + 0x68]
call fcn.0116a920
nop
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
mov eax, ebp
jmp 0x17eb14f
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov ecx, 0xc1030001
call fcn.0124e580
mov edi, eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x80]
call fcn.0116d120
nop
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
jmp 0x17eb14d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1000008
call fcn.0124e580
mov edi, eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x78]
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.01003340
add rsp, 0x458
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret