Function at 0x100520a0
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005213a
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x80]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.ProductType
push eax
mov dword [esp + 0x34], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005212f
lea ecx, [esp + 0x7c]
push str.WinNT
push ecx
call fcn.10059713
add esp, 8
test eax, eax
je 0x1005212f
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100521df
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetStatisticsGet
push ebx
call edi
push str.NetApiBufferSize
push ebx
mov ebp, eax
call edi
push str.NetApiBufferFree
push ebx
mov esi, eax
call edi
mov edi, eax
test ebp, ebp
je 0x100521d4
test esi, esi
je 0x100521d4
test edi, edi
je 0x100521d4
cmp dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, str.LanmanWorkstation
jne 0x10052198
mov eax, str.LanmanServer
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push eax
push 0
call ebp
test eax, eax
jne 0x100521d4
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push ecx
push edx
call fcn.10051d70
mov eax, dword [esp + 0x14]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x18]
xor ecx, ecx
push 0x2e
push ecx
lea edx, [esp + 0x86]
push edx
xor ebx, ebx
mov word [esp + 0x88], cx
call fcn.10059a00
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
lea eax, [esp + 0x80]
push str..PhysicalDrive_d
push eax
call ebp
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100522d2
push 0
lea edx, [esp + 0x14]
push edx
push 0x58
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x70020
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10052275
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10051d70
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x86]
push ecx
inc ebx
mov word [esp + 0x88], ax
call fcn.10059a00
add esp, 0xc
push ebx
lea edx, [esp + 0x80]
push str..PhysicalDrive_d
push edx
call ebp
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10052238
cmp dword [esi + 0x510], 0
je 0x10052307
mov ecx, dword [esi + 0x50c]
lea edi, [esi + 0x280]
push edi
push 0x280
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10052307
push 0x280
push edi
call fcn.10051d70
mov esi, dword [esp + 0x18]
push 0x280
lea edx, [esi + 0x280]
push 0
push edx
call fcn.10059a00
add esp, 0xc
push esi
call fcn.10052340
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005710f
add esp, 0xa4
ret