Function at 0x10001d30
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1d4], eax
push esi
push edi
mov byte [esp + 0x17], 0
mov dword [esp + 0x24], 0x200
call fcn.1003e5c0
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
js 0x10002540
lea eax, [esp + 0x38]
mov byte [esp + 0x17], 1
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov eax, 0xcccccccd
mov edi, 0x624dd2f
mul dword [esp + 0x34]
mov ecx, edx
mov edx, 0x1a9fbe77
shr ecx, 3
mov eax, ecx
mov dword [esp + 0xc], ecx
mul edx
mov dword [esp + 0x28], eax
mov esi, edx
mov eax, ecx
mov ecx, 0x1a9fbe77
mul edi
mov edi, eax
mov dword [esp + 0x18], edx
xor eax, eax
mul ecx
mov ecx, eax
mov dword [esp + 0x10], edx
xor eax, eax
mov edx, 0x624dd2f
mul edx
add ecx, esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x10]
adc edx, 0
mov dword [esp + 0x1c], eax
add edi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edi
adc ecx, 0
xor eax, eax
add edx, ecx
mov ecx, dword [esp + 0x1c]
adc eax, eax
add ecx, edx
mov edx, dword [esp + 0x20]
adc edx, eax
sub esi, ecx
mov eax, 0
sbb eax, edx
shrd esi, eax, 1
shr eax, 1
add esi, ecx
mov ecx, esi
mov dword [esp + 0xc], esi
adc eax, edx
shrd ecx, eax, 9
lea eax, [esp + 0x28]
inc cl
push eax
mov byte [0x1005858a], cl
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x2c]
mov ecx, 0xf4240
push dword [0x10059a9c]
mov edi, dword [0x10059a98]
mul ecx
push edi
mov ecx, eax
mov eax, edx
push eax
push ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], eax
call fcn.1004a350
mov ecx, eax
mov edx, 0xf4240
mov eax, dword [esp + 0x28]
xor esi, esi
mul edx
push dword [0x10059a9c]
add esi, eax
push edi
adc ecx, edx
push ecx
push esi
call fcn.1004a2e0
push dword [0x10059a9c]
mov esi, eax
mov edi, edx
push dword [0x10059a98]
push dword [esp + 0x18]
push dword [esp + 0x24]
call fcn.1004a2e0
add esi, 0
push 0xf8
adc edi, eax
mov dword [0x10059938], esi
push 0
push 0x10059940
mov dword [0x1005993c], edi
call fcn.10049330
add esp, 0xc
push 2
push 0x2a
push 0x10059900
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor edx, edx
mov edi, 0x10058600
mov dword [esp + 0x10], edx
nop dword [eax]
mov ecx, edx
and edx, 1
shr ecx, 1
shl edx, 2
movzx esi, byte [ecx + 0x10059900]
movzx eax, byte [ecx + 0x10059901]
shl esi, 8
add esi, eax
movzx eax, byte [ecx + 0x10059902]
shl esi, 8
add esi, eax
movzx eax, byte [ecx + 0x10059903]
shl esi, 8
add esi, eax
movzx eax, byte [ecx + 0x10059904]
mov dword [esp + 0xc], eax
mov ecx, 8
sub ecx, edx
shr eax, cl
mov ecx, edx
mov dword [esp + 0x20], eax
inc edx
mov eax, esi
shl eax, cl
mov ecx, 8
or dword [esp + 0x20], eax
sub ecx, edx
mov eax, dword [esp + 0xc]
shr eax, cl
mov ecx, edx
mov dword [esp + 0x18], eax
inc edx
mov eax, esi
shl eax, cl
mov ecx, 8
or dword [esp + 0x18], eax
sub ecx, edx
mov eax, dword [esp + 0xc]
shr eax, cl
mov ecx, edx
mov dword [esp + 0x1c], eax
inc edx
mov eax, esi
shl eax, cl
mov ecx, 8
or dword [esp + 0x1c], eax
sub ecx, edx
shr dword [esp + 0xc], cl
mov ecx, edx
mov edx, dword [esp + 0xc]
shl esi, cl
or edx, esi
mov esi, dword [esp + 0x20]
xor ecx, ecx
nop dword [eax + eax]
xor eax, eax
mov dword [edi], eax
test cl, 1
je 0x10001f9d
mov eax, edx
mov dword [edi], edx
test cl, 2
je 0x10001fa8
xor eax, dword [esp + 0x1c]
mov dword [edi], eax
test cl, 4
je 0x10001fb3
xor eax, dword [esp + 0x18]
mov dword [edi], eax
test cl, 8
je 0x10001fbc
xor eax, esi
mov dword [edi], eax
inc ecx
add edi, 4
cmp ecx, 0x10
jb 0x10001f90
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp edx, 0x4c
jb 0x10001ee0
push 0x88
push 0
push 0x100584c8
call fcn.10049330
add esp, 0xc
mov edx, 0x10001c80
xor ecx, ecx
push 0x100585a8
push 1
call fcn.1003ead0
mov edi, eax
add esp, 8
mov dword [esp + 0xc], edi
test edi, edi
jns 0x10002043
test byte [0x10059abe], 0x20
je 0x10002043
push edi
push str.__lib__Failed_to_open_global_settings__0x_x
push 0xffffffffffffffff
lea eax, [esp + 0x64]
push 0x80
push eax
lfence
call fcn.100015f0
add esp, 0x14
lea eax, [esp + 0x58]
mov edx, 0x1004cd88
push eax
call fcn.10001490
add esp, 4
mov ecx, 0x100584c8
call fcn.1001a8d0
mov edx, dword [0x100585a8]
test edx, edx
je 0x10002061
mov ecx, 0x100584c8
call fcn.1001b9e0
test byte [0x10059abe], 0x40
je 0x100020a0
push 0x100584c8
push str.__lib__Settings__p_Updated
push 0xffffffffffffffff
lea eax, [esp + 0xe4]
push 0x80
push eax
call fcn.100015f0
add esp, 0x14
lea eax, [esp + 0xd8]
mov edx, 0x1004ca90
push eax
call fcn.10001490
add esp, 4
mov ecx, 0x100584c8
call fcn.1001c9d0
xor cl, cl
call fcn.100019b0
xorps xmm0, xmm0
mov esi, 4
movq qword [0x100585e4], xmm0
mov eax, 0x1004dba0
movaps xmmword [0x100585f0], xmm0
mov edx, 0x1004db88
mov dword [esp + 0x10], esi
nop word [eax + eax]
xor ecx, ecx
cmp dword [eax + ecx], 0x1000000
jne 0x100020fa
mov eax, dword [ecx + 0x1004dba4]
cmp eax, dword [edx]
je 0x10002104
mov eax, 0x1004dba0
add ecx, 8
cmp ecx, 0x18
jb 0x100020e2
jmp 0x10002107
add esi, 4
add edx, 4
mov eax, 0x1004dba0
sub dword [esp + 0x10], 1
jne 0x100020e0
test esi, esi
mov eax, 0
cmovne eax, esi
mov esi, eax
mov dword [esp + 0x10], eax
push esi
push 0
push dword [0x10059a38]
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1005992c], eax
test eax, eax
jne 0x10002168
test byte [0x10059ab8], 2
je 0x1000215a
push eax
push esi
push str.default_compatibility_list
call fcn.10001500
add esp, 0xc
mov edi, 0x8007000e
mov dword [esp + 0xc], edi
jmp 0x10002540
lea eax, [esp + 0x1c]
shr esi, 2
push eax
push dword [0x1005992c]
mov edx, 0x1004db88
mov dword [0x10059930], esi
push 4
mov ecx, 0x1000000
call fcn.1000c720
add esp, 0xc
test eax, eax
js 0x10002538
mov eax, dword [0x100585a8]
test eax, eax
je 0x100021d9
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 4
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x48]
push ecx
push 0
push str.MaxPartitionCount
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x24]
mov ecx, 0x200
cmp eax, ecx
cmova eax, ecx
mov dword [esp + 0x24], eax
push 0xffff
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movzx eax, ax
mov word [0x10058584], ax
test ax, ax
jne 0x1000221a
test byte [0x10059ab8], 4
je 0x10002218
push str.MsQuicLib.ProcessorCount___0
push str.C:__w1_s_srccorelibrary.c
push 0x150
call fcn.1003e120
mov ax, word [0x10058584]
add esp, 0xc
int 0x2c
mov ecx, dword [esp + 0x24]
movzx esi, ax
movzx eax, ax
cmp esi, ecx
movzx edx, cx
cmovb edx, eax
movzx eax, dx
mov cx, ax
mov dword [esp + 0x10], eax
shr ax, 1
or cx, ax
mov word [0x10058586], dx
mov ax, cx
shr ax, 2
or cx, ax
mov ax, cx
shr ax, 4
or cx, ax
mov ax, cx
shr ax, 8
or cx, ax
mov ax, cx
shr ax, 1
sub cx, ax
imul eax, esi, 0x1c0
add cx, cx
dec cx
mov word [0x10058588], cx
push eax
push 0
push dword [0x10059a38]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x100585c8], eax
test eax, eax
jne 0x100022bb
test byte [0x10059ab8], 2
je 0x1000215a
movzx eax, word [0x10058584]
imul eax, eax, 0x1c0
push 0
push eax
push str.connection_pools
jmp 0x10002152
push 2
push 0x14
lea eax, [esp + 0x4c]
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ax, word [0x10058584]
xor ecx, ecx
cmp cx, ax
jae 0x100023e7
xor edi, edi
nop
movzx eax, di
imul esi, eax, 0x1c0
mov eax, dword [0x100585c8]
push 0x1c0
push 0
add eax, esi
push eax
call fcn.10049330
mov eax, dword [0x100585c8]
add esp, 0xc
add eax, esi
push eax
mov dword [eax + 8], 0xc70
mov dword [eax + 0xc], 0x31306351
mov dword [eax + 0x10], 0x100
mov dword [eax + 0x14], 0x10001080
mov dword [eax + 0x18], 0x100010a0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [0x100585c8]
add eax, 0x20
add eax, esi
push eax
mov dword [eax + 8], 0xf8
mov dword [eax + 0xc], 0x32306351
mov dword [eax + 0x10], 0x100
mov dword [eax + 0x14], 0x10001080
mov dword [eax + 0x18], 0x100010a0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [0x100585c8]
add eax, 0x40
add eax, esi
push eax
mov dword [eax + 8], 0x198
mov dword [eax + 0xc], 0x32306351
mov dword [eax + 0x10], 0x100
mov dword [eax + 0x14], 0x10001080
mov dword [eax + 0x18], 0x100010a0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [0x100585c8]
add eax, 0x64
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x100585c8]
push 0xf8
push 0
mov dword [eax + esi + 0x60], 0
mov eax, dword [0x100585c8]
add eax, 0x98
add eax, esi
push eax
call fcn.10049330
mov ax, word [0x10058584]
inc edi
add esp, 0xc
cmp di, ax
jb 0x100022e0
mov edi, dword [esp + 0xc]
xor ecx, ecx
xor esi, esi
cmp cx, ax
jae 0x10002468
movzx eax, si
imul ecx, eax, 0x1c0
mov eax, dword [0x100585c8]
push 0x20
push 0x14
add eax, 0x60
add eax, ecx
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push eax
push 0xb1
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov edi, eax
test edi, edi
jns 0x1000243c
test byte [0x10059ab8], 4
je 0x1000243c
push 0x10054e74
push edi
lfence
call fcn.10001400
add esp, 8
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
jle 0x1000245c
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0xc], edi
test edi, edi
js 0x100024d1
inc esi
cmp si, word [0x10058584]
jb 0x100023f0
mov al, byte [0x10059ab8]
test al, 1
je 0x100024af
movzx eax, word [0x10058586]
mov edx, 0x1004ce08
push eax
call fcn.10001310
mov al, byte [0x10059ab8]
add esp, 4
test al, 1
je 0x100024af
push dword [0x100584c0]
push dword [0x100584bc]
push dword [0x100584b8]
push dword [0x100584b4]
call fcn.10001360
add esp, 0x10
push str.verifier.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100024ed
push str.vrfcore.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100024ed
mov cl, 2
jmp 0x100024ef
test byte [0x10059ab8], 4
je 0x10002540
push str.Create_reset_token_hash
push edi
lfence
call fcn.10001400
add esp, 8
jmp 0x10002540
xor cl, cl
mov al, byte [0x100584b0]
and al, 0xfd
or al, cl
mov byte [0x100584b0], al
test al, 2
je 0x10002538
test byte [0x10059abe], 0x40
je 0x10002538
push str.__lib__Verifing_enabled_for_all_
push 0xffffffffffffffff
lea eax, [esp + 0x160]
push 0x80
push eax
call fcn.100015f0
lea eax, [esp + 0x168]
mov edx, 0x1004ca90
push eax
call fcn.10001490
add esp, 0x14
test edi, edi
jns 0x10002707
cmp dword [0x100585c8], 0
je 0x10002691
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], eax
cmp cx, word [0x10058584]
jae 0x1000266f
nop dword [eax]
nop word [eax + eax]
mov edi, dword [0x100585c8]
movzx eax, ax
imul esi, eax, 0x1c0
add edi, esi
mov dword [esp + 0x18], esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
je 0x100025b4
mov esi, dword [edi + 0x18]
mov ecx, esi
push edi
push dword [edi + 0xc]
push eax
call dword [0x1004b298]
call esi
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
jne 0x10002590
mov esi, dword [esp + 0x18]
mov edi, dword [0x100585c8]
add edi, 0x20
add edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
je 0x100025f4
nop word [eax + eax]
mov esi, dword [edi + 0x18]
mov ecx, esi
push edi
push dword [edi + 0xc]
push eax
call dword [0x1004b298]
call esi
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
jne 0x100025d0
mov esi, dword [esp + 0x18]
mov edi, dword [0x100585c8]
add edi, 0x40
add edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
je 0x10002634
nop word [eax + eax]
mov esi, dword [edi + 0x18]
mov ecx, esi
push edi
push dword [edi + 0xc]
push eax
call dword [0x1004b298]
call esi
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test eax, eax
jne 0x10002610
mov esi, dword [esp + 0x18]
mov eax, dword [0x100585c8]
add eax, 0x64
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x100585c8]
mov eax, dword [esi + eax + 0x60]
test eax, eax
je 0x10002659
push eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp ax, word [0x10058584]
jb 0x10002570
push dword [0x100585c8]
push 0
push dword [0x10059a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0xc]
mov dword [0x100585c8], 0
mov esi, dword [0x100585a8]
test esi, esi
je 0x100026d9
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
push dword [0x10059a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x100585a8], 0
mov eax, dword [0x1005992c]
test eax, eax
je 0x100026fb
push eax
push 0
push dword [0x10059a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x1005992c], 0
cmp byte [esp + 0x17], 0
je 0x10002707
call fcn.1003e800
mov ecx, 0x14
lea eax, [esp + 0x44]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10002710
mov ecx, dword [esp + 0x1dc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100483f7
mov esp, ebp
pop ebp
ret