Function at 0x100001fc8
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x80
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r8, [r11 - 0x30]
lea rdx, [r11 - 0x58]
mov rdi, rcx
call fcn.100001abc
mov r12d, 2
mov rbx, rax
cmp rax, r12
je 0x100002247
mov ecx, dword [0x100006724]
sub ecx, 1
je 0x100002073
sub ecx, 1
je 0x10000205d
cmp ecx, 1
jne 0x100002083
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [0x100001ec0]
mov edx, 0x38e
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rbx, rax
cmp rax, r12
jne 0x100002083
jmp 0x100002247
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [0x100001d30]
mov edx, 0x384
jmp 0x10000203a
lea rcx, [rsp + 0x68]
call fcn.100001534
test eax, eax
cmove rbx, r12
mov rcx, qword [0x100006760]
mov ebp, 0x10
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
xor edx, edx
mov word [rsp + 0x38], bp
mov qword [rsp + 0x50], rax
mov word [rsp + 0x3a], bp
mov word [rsp + 0x48], bp
mov word [rsp + 0x4a], bp
call sub.SAMLIB.dll_SamiSetBootKeyInformation
test eax, eax
jns 0x1000020e9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, 0x5e2
mov rcx, rdi
mov r8d, eax
call fcn.1000016ec
jmp 0x100002247
mov ecx, dword [rsp + 0x30]
sub ecx, 1
je 0x1000021d7
cmp ecx, r12d
jne 0x100002183
mov edx, 0x5e5
mov r9d, 0x21
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.100001634
movsxd rbx, eax
cmp rbx, r12
je 0x100002183
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.100001934
mov ebp, eax
test eax, eax
je 0x100002167
mov edx, 0x5e8
mov r9d, 0x15
mov rcx, rdi
lea r8d, [rdx - 2]
call fcn.100001634
movsxd rbx, eax
cmp rbx, r12
je 0x100002163
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.100001934
mov ebp, eax
test eax, eax
jne 0x100002131
test ebp, ebp
jne 0x10000217e
mov edx, 0x5e7
mov r9d, 0x40
mov rcx, rdi
lea r8d, [rdx - 1]
call fcn.100001634
mov ebp, 0x10
cmp rbx, 1
jne 0x1000021e3
mov ecx, dword [rsp + 0x30]
call fcn.100003524
test eax, eax
js 0x1000020cc
mov edx, 0x5e3
lea r9d, [rbx + 0x3f]
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.100001634
cmp dword [rsp + 0x30], ebx
je 0x1000021cb
lea rcx, [rsp + 0x58]
mov edx, ebp
call sub.ADVAPI32.dll_SystemFunction036
lea rcx, [rsp + 0x58]
call fcn.1000014d8
movabs rax, 1
jmp 0x10000224a
lea rcx, [rsp + 0x58]
call fcn.1000014d8
jmp 0x100002183
mov ecx, dword [0x100006724]
call fcn.100003524
test eax, eax
js 0x1000020cc
cmp dword [0x100006724], r12d
jne 0x10000223d
mov rcx, qword [0x100006760]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
xor edx, edx
call sub.SAMLIB.dll_SamiSetBootKeyInformation
test eax, eax
jns 0x100002247
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, 0x5e2
mov rcx, rdi
mov r8d, eax
call fcn.1000016ec
mov ecx, 1
call fcn.100003524
lea rcx, [rsp + 0x58]
call fcn.1000014d8
mov rax, r12
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1000038f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret