Function at 0x41a460
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x4527b8]
mov dword [esp + 0x84], eax
cmp dword [0x450718], 0xffffffff
jne 0x41a4f7
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a4f7
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.ProductType
push eax
mov dword [esp + 0x18], 0x20
mov dword [0x450718], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a4ec
lea ecx, [esp + 0xc]
push str.WinNT
push ecx
call fcn.0041dc48
add esp, 8
test eax, eax
je 0x41a4ec
mov dword [0x450718], 0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x466e70]
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x41a589
push str.NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x466e70], eax
je 0x41a5db
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetStatisticsGet
push eax
call esi
mov dword [0x466e7c], eax
mov eax, dword [0x466e70]
push str.NetApiBufferSize
push eax
call esi
mov ecx, dword [0x466e70]
push str.NetApiBufferFree
push ecx
mov dword [0x466e80], eax
call esi
cmp dword [0x466e7c], edi
mov dword [0x466e84], eax
je 0x41a56c
cmp dword [0x466e80], edi
je 0x41a56c
cmp eax, edi
jne 0x41a581
mov edx, dword [0x466e70]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x466e70], edi
jmp 0x41a5db
cmp dword [0x466e70], edi
je 0x41a5db
cmp dword [0x450718], edi
mov eax, str.LanmanWorkstation
jne 0x41a59b
mov eax, str.LanmanServer
lea ecx, [esp + 0xc]
push ecx
push edi
push edi
push eax
push edi
call dword [0x466e7c]
test eax, eax
jne 0x41a5db
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
call dword [0x466e80]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.0041a390
mov eax, dword [esp + 0x14]
add esp, 8
push eax
call dword [0x466e84]
push ebx
push edi
lea ecx, [esp + 0x1c]
push str..PhysicalDrive_d
push ecx
call fcn.0041d3d4
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push edi
push edi
push 3
push edi
push 3
push edi
lea edx, [esp + 0x30]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x41a678
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0x14]
push eax
push 0x58
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0x70020
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41a646
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0041a390
add esp, 8
push esi
call ebp
inc edi
push edi
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.0041d3d4
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea edx, [esp + 0x34]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a612
pop ebp
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edi, 0x64
pop ebx
mov eax, dword [0x468ad8]
test eax, eax
je 0x41a6b0
push 0x468ae0
push 0x140
push eax
call esi
test eax, eax
je 0x41a6b0
push 0x140
push 0x468ae0
call fcn.0041a390
add esp, 8
dec edi
jne 0x41a684
xor eax, eax
mov ecx, 0x50
mov edi, 0x468ae0
rep stosd dword es:[edi], eax
call fcn.0041a230
mov ecx, dword [esp + 0x8c]
pop edi
mov eax, 1
pop esi
call fcn.0041d4a3
add esp, 0x88
ret