Function at 0x10014230
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100142ca
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x80]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.ProductType
push eax
mov dword [esp + 0x34], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100142bf
lea ecx, [esp + 0x7c]
push str.WinNT
push ecx
call fcn.10063dc5
add esp, 8
test eax, eax
je 0x100142bf
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001436f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetStatisticsGet
push ebx
call edi
push str.NetApiBufferSize
push ebx
mov ebp, eax
call edi
push str.NetApiBufferFree
push ebx
mov esi, eax
call edi
mov edi, eax
test ebp, ebp
je 0x10014364
test esi, esi
je 0x10014364
test edi, edi
je 0x10014364
cmp dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, str.LanmanWorkstation
jne 0x10014328
mov eax, str.LanmanServer
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push eax
push 0
call ebp
test eax, eax
jne 0x10014364
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push ecx
push edx
call fcn.10013f10
mov eax, dword [esp + 0x14]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x18]
xor ecx, ecx
push 0x2e
push ecx
lea edx, [esp + 0x86]
push edx
xor ebx, ebx
mov word [esp + 0x88], cx
call fcn.10064e10
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
lea eax, [esp + 0x80]
push str..PhysicalDrive_d
push eax
call ebp
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10014462
push 0
lea edx, [esp + 0x14]
push edx
push 0x58
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x70020
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10014405
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10013f10
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x86]
push ecx
inc ebx
mov word [esp + 0x88], ax
call fcn.10064e10
add esp, 0xc
push ebx
lea edx, [esp + 0x80]
push str..PhysicalDrive_d
push edx
call ebp
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100143c8
cmp dword [esi + 0x510], 0
je 0x10014497
mov ecx, dword [esi + 0x50c]
lea edi, [esi + 0x280]
push edi
push 0x280
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10014497
push 0x280
push edi
call fcn.10013f10
mov esi, dword [esp + 0x18]
push 0x280
lea edx, [esi + 0x280]
push 0
push edx
call fcn.10064e10
add esp, 0xc
push esi
call fcn.100144d0
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10062448
add esp, 0xa4
ret