Function at 0x415b90
Capabilities:
Encrypt data using rc4 ksa
Generate random numbers via rtlgenrandom
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x940
mov esi, esp
mov dword [esi + 0x924], ebp
mov dword [esi + 0x92c], esp
mov dword [esi + 0x938], 0xffffffff
mov dword [esi + 0x934], 0x4364c0
mov dword [esi + 0x94], edx
lea eax, [esi + 0x930]
mov edi, 1
mov edx, dword fs:[0]
mov dword [esi + 0x930], edx
mov dword fs:[0], eax
lea eax, [ecx + ecx*2]
cmp eax, 2
jb 0x415bfc
dec eax
mov edi, 0xffffffff
bsr ecx, eax
xor ecx, 0x1f
shr edi, cl
inc edi
test edi, edi
je 0x415c08
bsr ebx, edi
xor ebx, 0x1f
jmp 0x415c0d
mov ebx, 0x20
call fcn.0042d780
mov dword [esi + 0xa0], eax
mov dword [esi + 0x98], ecx
mov ecx, 0x40
mov eax, edi
mov dword [esi + 0x9c], edx
mov dword [esi + 0x6c], edi
mul ecx
jo 0x41663f
mov ecx, 0x1f
mov edi, eax
sub ecx, ebx
test edi, edi
mov dword [esi + 0x90], ecx
js 0x41663f
je 0x415c7e
lea ebx, [edi + 0x40]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x41669d
mov ecx, eax
mov edi, eax
and ecx, 0x3f
sub edi, ecx
neg ecx
add edi, 0x40
mov dword [eax + ecx + 0x3c], eax
mov edx, edi
jmp 0x415c88
mov edi, 0x40
mov edx, 0x40
mov eax, dword [esi + 0x6c]
xor ecx, ecx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
mov ebx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x44], eax
cmp ecx, eax
jb 0x415d4d
jmp 0x416328
mov ebx, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x9c]
mov eax, edi
inc edi
mov dword [esi + 0x14], ebx
shl eax, 6
mov dword [edx + eax + 4], ecx
mov ecx, dword [esi + 0xa0]
mov dword [edx + eax], ecx
mov ecx, dword [esi + 0x98]
mov dword [edx + eax + 8], ecx
mov ecx, dword [esi + 0x24]
mov dword [edx + eax + 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [edx + eax + 0x10], ecx
mov ecx, dword [esi + 8]
mov dword [edx + eax + 0x1c], ecx
mov ecx, dword [esi + 0xc]
mov dword [edx + eax + 0x18], ecx
mov dword [edx + eax + 0x20], 0
mov dword [edx + eax + 0x24], 0
mov dword [edx + eax + 0x28], 0
movsd xmm0, qword [esi + 0x110]
movsd xmm1, qword [esi + 0x118]
movsd qword [edx + eax + 0x2c], xmm0
movsd qword [edx + eax + 0x34], xmm1
mov ecx, dword [esi + 0x120]
mov dword [edx + eax + 0x3c], ecx
mov ecx, dword [esi + 0xa8]
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x50], edi
mov edi, edx
inc ecx
cmp ecx, eax
jae 0x416328
xorps xmm0, xmm0
mov dword [esi + 0xa4], edi
mov dword [esi + 0x1c], edx
mov dword [esi + 0xa8], ecx
mov byte [esi + 0x38], 5
movaps xmmword [esi + 0xb0], xmm0
push 0x10
lea eax, [esi + 0xb0]
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x415d90
mov byte [esi + 0x8c], 5
jmp 0x4161d0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416600
mov dword [eax + 4], edi
mov dword [eax], 0
mov dword [esi + 0x28], 0x447d2f
mov dword [esi + 0x2c], 0x1e
mov dword [esi + 0x30], eax
lea eax, [esi + 0x39]
mov dword [esi + 0x34], 0x447d50
mov byte [esi + 0x38], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], fcn.00417c00
mov dword [esi + 0x7c], 0x400000
mov cl, byte [esi + 0x112]
movzx edx, word [esi + 0x110]
mov word [esi + 0xc0], dx
mov byte [esi + 0xc2], cl
mov word [esi + 0x110], dx
mov byte [esi + 0x112], cl
mov byte [eax + 2], cl
mov word [eax], dx
mov eax, dword [0x4529c0]
test al, al
jne 0x4160ae
mov dword [esi + 0x10], fcn.00417c00
call fcn.00417c00
mov dword [esi + 0x114], edx
mov dword [esi + 0x110], eax
push 0x808
push 0
lea eax, [esi + 0x118]
push eax
call fcn.00439140
add esp, 0xc
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
nop word cs:[eax + eax]
mov eax, 0x18f
mov ecx, 0
cmp eax, ebx
sbb ecx, edi
jb 0x415fc5
mov eax, ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x938], 2
add eax, 1
mov dword [esi + 0x24], eax
mov eax, edi
adc eax, 0
mov dword [esi + 0x18], eax
call dword [esi + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
lea ecx, [esi + 0x70]
lea edx, [esi + 0x120]
call fcn.00417700
mov edx, dword [esi + 8]
lea ecx, [esi + 0x70]
push dword [esi + 0xc]
call fcn.00417740
add esp, 4
mov eax, dword [esi + 0x78]
mov dword [esi + 0x10], eax
call eax
mov ecx, dword [esi + 8]
xor ebx, ebx
or ecx, dword [esi + 0xc]
je 0x416459
mov edi, dword [esi + 0x18]
mov ecx, eax
or ecx, edx
je 0x416459
mov ecx, eax
sub ecx, dword [esi + 8]
je 0x416457
cmp dword [esi + 0xac], 0x64
mov ebx, dword [esi + 0x24]
sbb dword [esi + 0x20], 0
jb 0x415ea0
mov edi, dword [esi + 0x118]
mov dword [esi + 0x118], ecx
sub edi, ecx
sete bl
cmp edi, dword [esi + 0x11c]
mov dword [esi + 0x11c], edi
mov edi, dword [esi + 0x18]
sete bh
or bh, bl
movzx ebx, bh
add dword [esi + 0x64], ebx
mov ebx, dword [esi + 0x24]
adc dword [esi + 0x68], 0
cmp dword [esi + 8], eax
sbb dword [esi + 0xc], edx
mov edx, 0x51eb851f
setae al
movzx eax, al
add dword [esi + 0x58], eax
mov eax, ecx
imul edx
mov eax, edx
sar edx, 5
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
xor edx, edx
cmp ecx, eax
mov eax, ecx
sete dl
add dword [esi + 0x5c], edx
adc dword [esi + 0x60], 0
sub eax, dword [esi + 0x54]
mov dword [esi + 0x54], ecx
mov edx, eax
neg edx
cmovl edx, eax
mov eax, edx
sar eax, 0x1f
add dword [esi + 0x3c], edx
adc dword [esi + 0x40], eax
jmp 0x415ea0
mov al, byte [esi + 0x120]
mov byte [esi + 0xc0], al
mov al, byte [esi + 0xc0]
cmp dword [esi + 0x58], 3
jg 0x416638
cmp dword [esi + 0x3c], 0x12c
mov eax, dword [esi + 0x40]
mov ecx, 0x10e
sbb eax, 0
jb 0x416631
cmp ecx, dword [esi + 0x5c]
mov eax, 0
sbb eax, dword [esi + 0x60]
jb 0x416457
cmp ecx, dword [esi + 0x64]
mov eax, 0
sbb eax, dword [esi + 0x68]
jb 0x41662a
push 0
push 0x12c
mov edi, dword [esi + 0x40]
push edi
mov ebx, dword [esi + 0x3c]
push ebx
call fcn.00437020
mov ecx, 0x12bf
cmp ecx, ebx
mov ebx, 0
sbb ebx, edi
jae 0x416075
bsr eax, eax
mov ecx, 0x3f
mov edi, 0x40
cmove eax, ecx
bsr ecx, edx
xor eax, 0x1f
xor ecx, 0x1f
add eax, 0x20
test edx, edx
cmove ecx, eax
sub edi, ecx
je 0x416646
mov eax, 0xbf
xor edx, edx
sub eax, ecx
div edi
jmp 0x416093
movaps xmm0, xmmword [0x445290]
cmp eax, 0x10
movaps xmmword [esi + 0xc0], xmm0
jae 0x41666c
mov al, byte [esi + eax + 0xc0]
movzx ecx, al
test al, al
mov dword [0x4529c0], ecx
mov dword [esi + 0x938], 2
je 0x416611
lea ecx, [esi + 0x70]
mov byte [esi + 0x7e], al
mov dword [esi + 0x938], 2
call fcn.004175c0
movsd xmm0, qword [esi + 0x70]
movsd xmm1, qword [esi + 0x78]
lea eax, [esi + 0xf0]
mov dword [esi + 8], 0x10
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
lea eax, [esi + 0xd6]
movsd xmm0, qword [esi + 0xea]
movsd xmm1, qword [esi + 0xf2]
movsd qword [esi + 0xd0], xmm0
movsd xmm0, qword [esi + 0xf8]
movsd qword [esi + 0xd8], xmm1
movsd qword [esi + 0xde], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
lea eax, [esi + 0xb0]
mov dword [esi + 0xc], eax
movsd qword [esi + 0x100], xmm0
movsd qword [esi + 0x108], xmm1
nop dword [eax + eax]
lea ecx, [esi + 0x100]
mov byte [esi + 0x10f], 0
call fcn.004175c0
mov ecx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add ecx, 0xfffffff8
mov dword [edi], eax
mov dword [edi + 4], edx
add edi, 8
test ecx, ecx
mov dword [esi + 0xc], edi
mov dword [esi + 8], ecx
jne 0x416140
cmp byte [esi + 0x38], 5
mov byte [esi + 0x8c], 5
je 0x4161d0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4161d0
mov ecx, dword [esi + 0x34]
mov dword [esi + 0x938], 1
mov dword [esi + 8], eax
push eax
mov dword [esi + 0xc], ecx
call dword [ecx]
add esp, 4
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x4161d0
cmp dword [eax + 8], 9
jae 0x4161b4
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x4161bc
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
nop word cs:[eax + eax]
nop
mov ebx, dword [esi + 0xb8]
mov ecx, dword [esi + 0xb0]
mov eax, dword [esi + 0xbc]
mov edi, dword [esi + 0xb4]
mov edx, 0x4c957f2d
or ebx, 1
mov dword [esi + 8], eax
add ecx, ebx
mov dword [esi + 0xc], ebx
adc edi, eax
mov eax, ecx
imul ecx, ecx, 0x5851f42d
mul edx
add ecx, edx
imul edx, edi, 0x4c957f2d
mov edi, dword [esi + 0x50]
add edx, ecx
add eax, ebx
mov ecx, dword [esi + 0x44]
adc edx, dword [esi + 8]
mov dword [esi + 0x10], eax
cmp edi, ecx
mov dword [esi + 0x24], edx
jne 0x415cb0
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x18], edi
cmp eax, ecx
jne 0x4162e0
mov ebx, eax
inc ebx
je 0x4165dc
mov eax, dword [esi + 0x14]
mov ecx, 0x40
add eax, eax
cmp eax, ebx
cmova ebx, eax
mov eax, ebx
mul ecx
mov ecx, eax
mov eax, dword [esi + 0x14]
jo 0x4165dc
test ecx, ecx
js 0x4165dc
test eax, eax
lea edi, [ecx + 0x40]
mov dword [esi + 0x20], ecx
je 0x4162e7
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4165f1
mov ecx, eax
mov edx, eax
and ecx, 0x3f
sub edx, ecx
neg ecx
mov dword [eax + ecx + 0x3c], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x20]
add edx, 0x40
mov dword [esi + 0x1c], edx
shl eax, 6
cmp eax, ecx
cmova eax, ecx
push eax
mov edi, dword [esi + 0xa4]
push edi
push edx
call fcn.00438b50
add esp, 0xc
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esi + 0x1c]
test edx, edx
jne 0x416317
jmp 0x4165f1
mov ebx, eax
mov dword [esi + 0x44], eax
jmp 0x416320
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4165f1
mov ecx, eax
mov edx, eax
and ecx, 0x3f
sub edx, ecx
neg ecx
add edx, 0x40
mov dword [eax + ecx + 0x3c], eax
test edx, edx
je 0x4165f1
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], ebx
mov edi, dword [esi + 0x18]
jmp 0x415cb6
movsd xmm0, qword [esi + 0x48]
mov edi, dword [esi + 0x50]
movsd qword [esi + 0x110], xmm0
mov dword [esi + 0x118], edi
mov ebx, dword [esi + 0x114]
cmp ebx, edi
jne 0x416353
mov edi, dword [esi + 0x110]
jmp 0x416414
jb 0x4166ab
test edi, edi
je 0x4163e3
mov eax, dword [esi + 0x110]
mov ecx, edi
shl ecx, 6
mov dword [esi + 0xc], ecx
mov dword [esi + 8], eax
lea eax, [ecx + 0x40]
mov dword [esi + 0x10], eax
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x10]
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4166d1
mov ecx, eax
mov edx, eax
shl ebx, 6
and ecx, 0x3f
sub edx, ecx
neg ecx
mov dword [eax + ecx + 0x3c], eax
mov eax, dword [esi + 0xc]
add edx, 0x40
mov dword [esi + 0x10], edx
cmp ebx, eax
cmova ebx, eax
push ebx
mov ebx, dword [esi + 8]
push ebx
push edx
call fcn.00438b50
add esp, 0xc
call sub.KERNEL32.dll_GetProcessHeap
push dword [ebx - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x10]
mov ebx, edi
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edi
mov edi, eax
jmp 0x416414
test ebx, ebx
je 0x4163fd
mov edi, dword [esi + 0x110]
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
xor ebx, ebx
mov dword [esi + 0x110], 0x40
mov edi, 0x40
mov dword [esi + 0x114], ebx
call sub.KERNEL32.dll_GetProcessHeap
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x41668c
mov ecx, dword [esi + 0x90]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x94]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x930]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
movsd xmm1, qword [esi + 0xf2]
movq xmm0, qword [esi + 0xea]
movsd qword [esi + 0xd8], xmm1
movq xmm1, qword [esi + 0xf8]
movq qword [esi + 0xd0], xmm0
movq qword [esi + 0xde], xmm1
call sub.KERNEL32.dll_GetProcessHeap
push 1
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x4164ad
mov ecx, 1
mov edx, 1
call fcn.0040dcf0
ud2
mov byte [eax], bl
mov edi, eax
cmp byte [esi + 0x38], 5
jne 0x4164f7
mov eax, 0x447ce0
mov ecx, str.timer_jitter_failed_basic_quality_testscouldnt_generate_random_bytes
movd xmm1, edi
movd xmm0, eax
mov eax, 0x27
movd xmm2, ecx
movd xmm3, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm3
punpcklqdq xmm2, xmm1
movdqu xmmword [esi + 0x28], xmm2
mov byte [esi + 0x38], 0
mov byte [esi + 0x3b], 0
mov word [esi + 0x39], 0
jmp 0x416505
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x38]
movsd xmm0, qword [esi + 0x28]
movsd xmm1, qword [esi + 0x30]
mov dword [esi + 0x120], eax
movsd qword [esi + 0x118], xmm1
movsd qword [esi + 0x110], xmm0
call sub.KERNEL32.dll_GetProcessHeap
push 0x14
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x41654c
mov ecx, 0x14
mov edx, 4
call fcn.0040dcf0
ud2
mov ecx, dword [esi + 0x120]
mov dword [eax + 0x10], ecx
movsd xmm0, qword [esi + 0x110]
movsd xmm1, qword [esi + 0x118]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [esi + 0x80], 0x1a
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0x447914
mov byte [esi + 0x8c], 0
mov byte [esi + 7], 1
mov dword [esi + 0x938], 0
mov al, byte [esi + 0x112]
movzx ecx, word [esi + 0x110]
mov dword [esi + 0x110], str.All_entropy_sources_failed
mov word [esi + 0x8d], cx
mov byte [esi + 0x8f], al
lea ecx, [esi + 0x110]
movaps xmm0, xmmword [esi + 0x80]
movups xmmword [esi + 0x114], xmm0
call fcn.004169f0
ud2
mov byte [esi + 7], 1
mov dword [esi + 0x938], 0
call fcn.0040dd00
jmp 0x4165da
mov ecx, dword [esi + 0x20]
mov edx, 0x40
call fcn.0040dcf0
ud2
mov ecx, 8
mov edx, 4
call fcn.0040dcf0
ud2
mov ecx, str.assertion_failed:_rounds___0
mov edx, 0x1c
push 0x447b04
call fcn.004104b0
add esp, 4
jmp 0x4165da
mov bl, 4
jmp 0x416459
mov bl, 3
jmp 0x416459
mov bl, 2
jmp 0x416459
call fcn.0041e940
ud2
mov dword [esi + 0x938], 2
mov ecx, 0x447b80
mov edx, 0x19
push 0x447b9c
call fcn.004104b0
add esp, 4
jmp 0x4165da
mov dword [esi + 0x938], 2
mov ecx, 0x447bac
mov edx, eax
push 0x10
call fcn.0040ff60
add esp, 4
jmp 0x4165da
mov ecx, 0x10
mov edx, 4
call fcn.0040dcf0
ud2
mov ecx, edi
mov edx, 0x40
call fcn.0040dcf0
ud2
mov dword [esi + 0x938], 3
mov ecx, str.Tried_to_shrink_to_a_larger_capacityD
mov edx, 0x24
push 0x448034
call fcn.004104b0
add esp, 4
jmp 0x4165da
mov ecx, dword [esi + 0xc]
mov edx, 0x40
call fcn.0040dcf0
ud2