Function at 0x140001a70
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movzx edx, word [0x1400f8b28]
xor esi, esi
mov word [0x1400f7574], dx
test dx, dx
jne 0x140001b0b
test byte [0x1400f8b38], 4
je 0x140001b09
lea rax, [rbp - 0x39]
mov dword [rbp - 0x39], 0x85
mov qword [rbp - 9], rax
lea r9d, [rsi + 4]
lea rax, str.C:Users_adminDownloadsquicreach_mainquicreachmsquic_srccorelibrary.c
mov qword [rbp - 1], 4
mov qword [rbp + 7], rax
lea rdx, [0x1400d0898]
lea rax, str.MsQuicLib.ProcessorCount___0
mov qword [rbp + 0xf], 0x4c
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x1f], 0x1d
call fcn.140001460
movzx edx, word [0x1400f7574]
int 0x2c
mov rax, qword [0x1400f75a0]
mov qword [rsp + 0xe0], rbx
test rax, rax
je 0x140001b26
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x140001b98
mov rcx, qword [0x1400f7598]
mov ebx, 0x200
mov word [0x1400f7576], dx
movzx edi, dx
mov dword [rbp - 0x39], ebx
test rcx, rcx
je 0x140001b8c
lea rax, [rbp - 0x31]
mov dword [rbp - 0x31], 4
mov rcx, qword [rcx]
lea r9, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rdx, str.MaxPartitionCount
lea rax, [rbp - 0x39]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbp - 0x39]
test eax, eax
movzx edi, word [0x1400f7576]
movzx edx, word [0x1400f7574]
cmove eax, ebx
mov ebx, eax
movzx eax, di
cmp eax, ebx
cmova di, bx
movzx ecx, di
movzx eax, cx
mov word [0x1400f7576], cx
shr ax, 1
or cx, ax
movzx edi, dx
movzx eax, cx
shl rdi, 9
shr ax, 2
mov r8, rdi
or cx, ax
xor edx, edx
movzx eax, cx
shr ax, 4
or cx, ax
movzx eax, cx
shr ax, 8
or ax, cx
mov rcx, qword [0x1400f8a70]
mov word [0x1400f7578], ax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400f75d8], rax
test rax, rax
jne 0x140001c47
test byte [0x1400f8b38], 2
je 0x140001c3d
lea rax, str.connection_pools
mov qword [rbp - 0x29], rdi
mov qword [rbp - 9], rax
lea rdx, [0x1400d0050]
lea rax, [rbp - 0x29]
mov qword [rbp - 1], SafeArrayGetElement
mov qword [rbp + 7], rax
mov r9d, 3
lea rax, [rbp - 0x19]
mov qword [rbp + 0xf], 8
mov qword [rsp + 0x20], rax
call fcn.140001460
mov eax, 0x8007000e
jmp 0x140001e28
mov r8, rdi
mov qword [rsp + 0xe8], r14
xor edx, edx
mov rcx, rax
call fcn.1400819f0
cmp si, word [0x1400f7574]
movzx ebx, si
jae 0x140001d29
mov qword [rsp + 0xf0], r15
lea r14, [0x1400013c0]
lea r15, [0x1400013e0]
movzx edi, bx
shl rdi, 9
add rdi, qword [0x1400f75d8]
mov rcx, rdi
mov dword [rdi + 0x10], 0xfa0
mov dword [rdi + 0x14], 0x31306351
mov dword [rdi + 0x18], 0x100
mov qword [rdi + 0x20], r14
mov qword [rdi + 0x28], r15
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
lea rcx, [rdi + 0x30]
mov dword [rcx + 0x10], 0x100
mov dword [rcx + 0x14], 0x32306351
mov dword [rcx + 0x18], 0x100
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x28], r15
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
lea rcx, [rdi + 0x60]
mov dword [rcx + 0x10], 0x1b0
mov dword [rcx + 0x14], 0x32306351
mov dword [rcx + 0x18], 0x100
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x28], r15
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
lea rcx, [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
inc bx
cmp bx, word [0x1400f7574]
jb 0x140001c82
mov r15, qword [rsp + 0xf0]
mov r9d, 2
lea rdx, [rbp + 0x27]
xor ecx, ecx
lea r8d, [r9 + 0x12]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp si, word [0x1400f7574]
movzx edi, si
jae 0x140001e13
lea r14, [0x1400d92a0]
nop word [rax + rax]
mov dword [rsp + 0x30], 0x20
lea rax, [rbp + 0x27]
movzx edx, di
xor r9d, r9d
shl rdx, 9
xor r8d, r8d
add rdx, 0x90
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
add rdx, qword [0x1400f75d8]
mov ecx, 0xb1
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov ebx, eax
test eax, eax
jns 0x140001de8
test byte [0x1400f8b38], 4
je 0x140001de8
mov dword [rbp - 0x31], eax
lea rdx, [0x1400d0948]
lea rax, [rbp - 0x31]
mov qword [rbp - 1], 4
mov qword [rbp - 9], rax
mov r9d, 3
lea rax, [rbp - 0x19]
mov qword [rbp + 7], r14
mov qword [rsp + 0x20], rax
mov qword [rbp + 0xf], SafeArrayGetElement
call fcn.140001460
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
test eax, eax
jle 0x140001dff
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140001e47
inc di
cmp di, word [0x1400f7574]
jb 0x140001d60
lea rdi, [rbp + 0x27]
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
rep stosb byte [rdi], al
mov r14, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
lea rdi, [rbp + 0x27]
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
rep stosb byte [rdi], al
call fcn.140001920
mov eax, ebx
jmp 0x140001e20