Function at 0x436580
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0x2f8], 0
xor eax, eax
push esi
push edi
mov dword [ebp - 0x2f0], edx
mov dword [ebp - 0x304], ecx
mov dword [ebp - 0x28c], 7
mov dword [ebp - 0x290], 0
mov word [ebp - 0x2a0], ax
mov dword [ebp - 0x2ec], eax
or eax, 0xffffffff
lea ebx, [ebp - 0x310]
mov edi, 8
nop dword [eax]
cmp edi, 0xffffffff
mov dword [ebp - 0x2f4], 0xffffffff
mov esi, edi
cmova esi, eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x4365ff
int3
add ebx, esi
mov eax, 0xffffffff
sub edi, esi
jne 0x4365e0
mov eax, dword [ebp - 0x310]
lea ebx, [ebp - 0x318]
mov dword [ebp - 0x2fc], eax
mov edi, 8
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x2f4], eax
nop dword [eax]
cmp edi, 0xffffffff
mov dword [ebp - 0x31c], 0xffffffff
mov eax, 0xffffffff
mov esi, edi
cmova esi, eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x436654
int3
add ebx, esi
sub edi, esi
jne 0x436630
mov ecx, dword [ebp - 0x314]
mov edx, dword [ebp - 0x2fc]
and ecx, 0x3fffffff
or ecx, 0x80000000
and edx, 0xffff4fff
movzx eax, cx
or edx, 0x4000
push eax
push dword [ebp - 0x318]
mov dword [ebp - 0x324], ecx
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x2f4]
movzx eax, dx
push eax
mov eax, ecx
shrd edx, eax, 0x10
shr eax, 0x10
movzx eax, dx
push eax
push ecx
lea eax, [ebp - 0x2b8]
push str._08x__04x__04x__04x__012llx
push eax
call fcn.00449590
mov eax, dword [ebp - 0x2a8]
lea ecx, [ebp - 0x2b8]
add esp, 0x18
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2a4], 0x10
mov edi, esp
mov dword [ebp - 0x274], 7
cmovae ecx, dword [ebp - 0x2b8]
xor edx, edx
mov byte [ebp - 0x2f8], dl
add eax, ecx
push dword [ebp - 0x2f8]
mov dword [ebp - 0x278], 0
push eax
push ecx
lea ecx, [ebp - 0x288]
mov word [ebp - 0x288], dx
call fcn.00438020
push 4
push str..tmp
lea ecx, [ebp - 0x288]
call fcn.0041b9f3
mov esi, eax
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp dword [esi + 0x14], 8
jae 0x43676c
mov eax, dword [esi + 0x10]
add eax, 1
je 0x43677a
add eax, eax
push eax
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.004cca40
add esp, 0xc
jmp 0x43677a
mov eax, dword [esi]
mov dword [ebp - 0x230], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x220], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x21c], eax
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4367a2
mov esi, dword [esi]
mov ecx, dword [ebp - 0x304]
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
mov dword [edi], eax
mov eax, dword [ebp - 0x220]
mov dword [edi + 4], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.0043fdb0
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0043efe0
lea ecx, [ebp - 0x2d0]
call fcn.0043ef40
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x436848
mov ecx, dword [ebp - 0x230]
inc eax
cmp eax, 0x7fffffff
ja 0x436beb
add eax, eax
cmp eax, 0x1000
jb 0x43683f
test cl, 0x1f
jne 0x436beb
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x436beb
sub ecx, eax
cmp ecx, 4
jb 0x436beb
cmp ecx, 0x23
ja 0x436beb
mov ecx, eax
push ecx
call fcn.004cbd7a
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x4368be
mov ecx, dword [ebp - 0x288]
inc eax
cmp eax, 0x7fffffff
ja 0x436beb
add eax, eax
cmp eax, 0x1000
jb 0x4368b5
test cl, 0x1f
jne 0x436beb
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x436beb
sub ecx, eax
cmp ecx, 4
jb 0x436beb
cmp ecx, 0x23
ja 0x436beb
mov ecx, eax
push ecx
call fcn.004cbd7a
add esp, 4
xor eax, eax
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x278], 0
cmp eax, 0x10
jb 0x436927
mov ecx, dword [ebp - 0x2b8]
inc eax
cmp eax, 0x1000
jb 0x43691e
test cl, 0x1f
jne 0x436beb
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x436beb
sub ecx, eax
cmp ecx, 4
jb 0x436beb
cmp ecx, 0x23
ja 0x436beb
mov ecx, eax
push ecx
call fcn.004cbd7a
add esp, 4
mov ecx, dword [0x51d17c]
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x258], 7
mov dword [ebp - 0x25c], 0
mov word [ebp - 0x26c], ax
test ecx, ecx
je 0x436964
mov eax, dword [ecx]
lea edx, [ebp - 0x254]
push edx
call dword [eax + 8]
push 0x62
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x250], 0
push eax
lea ecx, [ebp - 0x270]
mov word [ebp - 0x24c], 0
call fcn.00451e00
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x43699e
cmp eax, 0xffffffff
jne 0x436a41
lea ecx, [ebp - 0x270]
call fcn.00459670
mov ecx, dword [0x51d17c]
test ecx, ecx
je 0x4369bf
mov eax, dword [ecx]
lea edx, [ebp - 0x254]
push edx
call dword [eax + 0xc]
lea ecx, [ebp - 0x26c]
call fcn.0043ef40
mov edi, dword [ebp - 0x270]
test edi, edi
je 0x436a0b
cmp edi, 0xffffffff
je 0x436a0b
call sym.setup.exe_GetHandleVerifier
mov edx, eax
mov esi, dword [edx]
call fcn.0044dee0
mov ecx, dword [ebp + 4]
push eax
push ecx
lea eax, [ebp - 0x270]
mov ecx, edx
push eax
push edi
call dword [esi + 8]
mov esi, dword [ebp - 0x270]
call sym.setup.exe_GetHandleVerifier
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp eax, 0x64
jl 0x4365cf
xor bl, bl
lea ecx, [ebp - 0x2a0]
call fcn.0043ef40
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x270]
call fcn.00459670
lea ecx, [ebp - 0x270]
call fcn.00459670
mov ecx, dword [0x51d17c]
test ecx, ecx
je 0x436a6d
mov eax, dword [ecx]
lea edx, [ebp - 0x254]
push edx
call dword [eax + 0xc]
lea ecx, [ebp - 0x26c]
call fcn.0043ef40
mov edi, dword [ebp - 0x270]
test edi, edi
je 0x436ab9
cmp edi, 0xffffffff
je 0x436ab9
call sym.setup.exe_GetHandleVerifier
mov edx, eax
mov esi, dword [edx]
call fcn.0044dee0
mov ecx, dword [ebp + 4]
push eax
push ecx
lea eax, [ebp - 0x270]
mov ecx, edx
push eax
push edi
call dword [esi + 8]
mov esi, dword [ebp - 0x270]
call sym.setup.exe_GetHandleVerifier
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
cmp dword [ebp - 0x28c], 8
lea ecx, [ebp - 0x218]
push 0x104
lea eax, [ebp - 0x2a0]
cmovae eax, dword [ebp - 0x2a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x104
ja 0x436bd2
test eax, eax
je 0x436bd2
xor ecx, ecx
mov dword [ebp - 0x234], 7
push eax
lea eax, [ebp - 0x218]
mov word [ebp - 0x248], cx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
call fcn.0041b8e7
sub esp, 8
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x2e8]
mov edx, esp
cmovae eax, dword [ebp - 0x248]
mov dword [edx], eax
mov eax, dword [ebp - 0x238]
mov dword [edx + 4], eax
call fcn.0043eec0
mov ecx, dword [ebp - 0x2f0]
push eax
call fcn.0043efe0
lea ecx, [ebp - 0x2e8]
call fcn.0043ef40
mov eax, dword [ebp - 0x234]
mov bl, 1
cmp eax, 8
jb 0x436bb0
mov ecx, dword [ebp - 0x248]
inc eax
cmp eax, 0x7fffffff
ja 0x436beb
add eax, eax
cmp eax, 0x1000
jb 0x436ba7
test cl, 0x1f
jne 0x436bf0
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x436bf5
sub ecx, eax
cmp ecx, 4
jb 0x436bfa
cmp ecx, 0x23
ja 0x436bff
mov ecx, eax
push ecx
call fcn.004cbd7a
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jmp 0x436a23
mov ecx, dword [ebp - 0x2f0]
lea eax, [ebp - 0x2a0]
push eax
call fcn.0043efe0
mov bl, 1
jmp 0x436a23
call fcn.004d1350
call fcn.004d1350
call fcn.004d1350
call fcn.004d1350
call fcn.004d1350
int3