Function at 0x40ad90
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
sub esp, 0xac
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0xa4], eax
cmp dword [0x463b04], 0xffffffff
push ebx
push ebp
push esi
push edi
jne 0x40ae38
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ae38
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x98]
push edx
push eax
push eax
mov eax, dword [esp + 0x2c]
push str.ProductType
push eax
mov dword [esp + 0x2c], 0x20
mov dword [0x463b04], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ae2d
lea ecx, [esp + 0x94]
push str.WinNT
push ecx
call fcn.00425cb7
add esp, 8
test eax, eax
je 0x40ae2d
mov dword [0x463b04], 0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x471d20], 0
jne 0x40aecd
push str.NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x471d20], eax
je 0x40af22
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetStatisticsGet
push eax
call esi
mov dword [0x471d24], eax
mov eax, dword [0x471d20]
push str.NetApiBufferSize
push eax
call esi
mov ecx, dword [0x471d20]
push str.NetApiBufferFree
push ecx
mov dword [0x471d28], eax
call esi
cmp dword [0x471d24], 0
mov dword [0x471d2c], eax
je 0x40aeab
cmp dword [0x471d28], 0
je 0x40aeab
test eax, eax
jne 0x40aec4
mov edx, dword [0x471d20]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x471d20], 0
jmp 0x40af22
cmp dword [0x471d20], 0
je 0x40af22
cmp dword [0x463b04], 0
mov eax, str.LanmanWorkstation
jne 0x40aee0
mov eax, str.LanmanServer
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push eax
push 0
call dword [0x471d24]
test eax, eax
jne 0x40af22
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call dword [0x471d28]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push ecx
call fcn.0040a7a0
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
call dword [0x471d2c]
xor ebp, ebp
push ebp
lea eax, [esp + 0x80]
push str..PhysicalDrive_d
push eax
call fcn.00425524
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push ebp
push ebp
push 3
push ebp
push 3
push ebp
lea ecx, [esp + 0x94]
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40afd0
lea esp, [esp]
push 0
lea edx, [esp + 0x18]
push edx
push 0x58
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x70020
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40af93
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
call fcn.0040a7a0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebp, 1
push ebp
lea edx, [esp + 0x80]
push str..PhysicalDrive_d
push edx
call fcn.00425524
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [esp + 0x94]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40af60
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebp, 0x64
jmp 0x40afe0
mov eax, dword [0x4740f8]
test eax, eax
je 0x40b052
push 0x474100
push 0x140
push eax
call edi
test eax, eax
je 0x40b052
mov eax, dword [0x471d08]
mov ecx, dword [0x471d00]
xor esi, esi
cmp eax, 0x140
jne 0x40b015
xor eax, eax
mov dword [0x471d08], eax
mov dl, byte [esi + 0x474100]
add byte [ecx + eax], dl
mov edx, eax
and edx, 0x80000007
jns 0x40b02d
dec edx
or edx, 0xfffffff8
inc edx
jne 0x40b03f
call fcn.0040a630
mov eax, dword [0x471d08]
mov ecx, dword [0x471d00]
add eax, 1
add esi, 1
cmp esi, 0x140
mov dword [0x471d08], eax
jl 0x40b007
sub ebp, 1
jne 0x40afe0
mov edx, 0x474100
mov ecx, 0x140
mov esi, ecx
mov eax, edx
mov byte [eax], 0
add eax, 1
sub esi, 1
jne 0x40b065
sub ecx, 1
mov byte [edx], 0
add edx, 1
test ecx, ecx
jne 0x40b070
call fcn.0040a630
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00423893
add esp, 0xac
ret