Function at 0x14003eb70
Capabilities:
Generate random numbers via winapi
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor esi, esi
cmp dword [0x14014895c], 0xffffffff
jne 0x14003ec47
lea rax, [rsp + 0x50]
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ec47
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.ProductType
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x40
mov dword [0x14014895c], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ec3c
lea rdx, str.WinNT
lea rcx, [rbp - 0x10]
call fcn.1400a6f40
mov ecx, dword [0x14014895c]
test eax, eax
cmovne ecx, esi
mov dword [0x14014895c], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [0x1401a6c50], rsi
jne 0x14003edd4
mov edi, 0x104
lea rcx, [rbp + 0x30]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
lea rax, [rbp + 0x30]
je 0x14003ece9
mov ecx, edi
nop
cmp word [rax], si
je 0x14003ec88
add rax, 2
dec rcx
jne 0x14003ec70
mov qword [rsp + 0x58], rsi
jmp 0x14003ed2f
test rcx, rcx
je 0x14003ec7e
mov rdx, rdi
sub rdx, rcx
sub rdi, rdx
mov qword [rsp + 0x58], rdx
lea rax, [rbp + rdx*2 + 0x30]
je 0x14003ece0
lea r8, str.NETAPI32.DLL
lea rcx, [rdi + rdx + 0x7ffffefb]
sub r8, rax
test rcx, rcx
je 0x14003ecdb
movzx edx, word [r8 + rax]
test dx, dx
je 0x14003ecdb
mov word [rax], dx
add rax, 2
dec rcx
dec rdi
jne 0x14003ecb4
sub rax, 2
mov word [rax], si
jmp 0x14003ed2f
test rdi, rdi
jne 0x14003ece4
sub rax, 2
mov word [rax], si
jmp 0x14003ed2f
lea rdx, str.C:WindowsSystem32NETAPI32.DLL
lea rcx, [rbp + 0x30]
sub rdx, rax
nop word [rax + rax]
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x14003ed23
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14003ed23
mov word [rcx], ax
add rcx, 2
dec rdi
jne 0x14003ed00
jmp 0x14003ed28
test rdi, rdi
jne 0x14003ed2c
sub rcx, 2
mov word [rcx], si
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1401a6c50], rax
test rax, rax
je 0x14003ee34
lea rdx, str.NetStatisticsGet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401a6c50]
lea rdx, str.NetApiBufferSize
mov qword [0x1401a6c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401a6c50]
lea rdx, str.NetApiBufferFree
mov qword [0x1401a6c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov qword [0x1401a6c70], rax
mov rax, qword [0x1401a6c60]
test rax, rax
je 0x14003edbe
cmp qword [0x1401a6c68], rsi
je 0x14003edbe
test rdx, rdx
je 0x14003edbe
cmp qword [0x1401a6c50], rsi
je 0x14003ee34
jmp 0x14003eddb
mov rcx, qword [0x1401a6c50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1401a6c50], rsi
jmp 0x14003ee34
mov rax, qword [0x1401a6c60]
cmp dword [0x14014895c], esi
lea rcx, str.LanmanWorkstation
lea rdx, str.LanmanServer
cmovne rdx, rcx
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
call rax
test eax, eax
jne 0x14003ee34
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
call qword [0x1401a6c68]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14003df90
mov rcx, qword [rsp + 0x48]
call qword [0x1401a6c70]
xor r9d, r9d
lea r8, str..PhysicalDrive_d
lea rcx, [rbp - 0x40]
lea edx, [r9 + 0x18]
mov ebx, esi
call fcn.140013cf0
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x40]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003ef1b
nop
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x70020
mov rcx, rdi
mov dword [rsp + 0x28], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14003eec7
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14003df90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea r8, str..PhysicalDrive_d
lea rcx, [rbp - 0x40]
mov r9d, ebx
mov edx, 0x18
call fcn.140013cf0
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x40]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003ee80
cmp dword [0x1401a6c4c], esi
je 0x14003f006
mov rcx, qword [0x1401ade68]
lea rbx, [0x1401a6ad0]
mov esi, 0x140
mov r8, rbx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14003effa
mov edx, esi
mov rcx, rbx
call fcn.14003df90
call fcn.14005a7b0
test eax, eax
jne 0x14003ef97
lea ecx, [rax + 1]
xor edx, edx
call fcn.14005a510
mov rdi, rax
test rax, rax
je 0x14003ef97
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.140059c00
test rax, rax
jle 0x14003ef8f
mov edx, eax
mov rcx, rbx
call fcn.14003df90
mov rcx, rdi
call fcn.14005a750
call fcn.140014fb0
test eax, eax
je 0x14003efdc
mov eax, dword [0x1401ac6e0]
test eax, eax
je 0x14003efb9
mov rdx, rsi
mov rcx, rbx
call fcn.140059b90
test eax, eax
jne 0x14003efd2
mov eax, dword [0x1401ac6dc]
test eax, eax
je 0x14003efdc
mov rdx, rsi
mov rcx, rbx
call fcn.140059b60
test eax, eax
je 0x14003efdc
mov edx, esi
mov rcx, rbx
call fcn.14003df90
mov rdi, rbx
xor eax, eax
mov rcx, rsi
rep stosb byte [rdi], al
mov byte [rbx], al
inc rbx
dec rsi
jne 0x14003efe6
call fcn.14003dc20
lea eax, [rsi + 1]
jmp 0x14003f008
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1401a6c58], eax
xor eax, eax
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret