Function at 0x487520
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55e85e
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x602768], ebx
je 0x48758d
push str.GFE::Client::CreateRpcSecret_called_more_than_once
lea esi, [esp + 0x3c]
call fcn.00403350
mov dword [esp + 0x198], ebx
push 0x41
mov ecx, str.srcClientRpc.cpp
mov eax, esi
call fcn.004025bc
xor eax, eax
mov byte [esp + 0x178], bl
lea edi, [esp + 0x179]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf0000040
xor esi, esi
stosw word es:[edi], ax
inc esi
push esi
push ebx
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4875f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4875d5
and eax, 0xffff
or eax, 0x80070000
push 0x55
push str.srcClientRpc.cpp
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004988c2
push 0x5c9774
lea eax, [esp + 0x58]
push eax
call fcn.0051eb2a
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], edi
lea eax, [esp + 0x178]
push eax
push 0x10
push edi
mov dword [esp + 0x1a4], esi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x48764b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x48762e
and eax, 0xffff
or eax, 0x80070000
push 0x5d
push str.srcClientRpc.cpp
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004988c2
push 0x5c9774
lea eax, [esp + 0x58]
jmp 0x4875f0
or dword [esp + 0x198], 0xffffffff
cmp edi, ebx
je 0x48765f
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
pop ecx
call fcn.0049e19b
pop ecx
pop ecx
push str.AA45D379_DBB1_4AF4_833B_39E697EDCCA4
mov dword [esp + 0x19c], 2
push dword [esp + 0x30]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [esp + 0x18], edi
mov byte [esp + 0x198], 3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp edi, ebx
jne 0x4876de
cmp eax, ebx
jle 0x4876be
and eax, 0xffff
or eax, 0x80070000
push 0x71
push str.srcClientRpc.cpp
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004988c2
push 0x5c9774
lea eax, [esp + 0x58]
jmp 0x4875f0
cmp eax, 0xb7
jne 0x487709
push str.RPC_secret_file_already_exists_in_this_session
lea esi, [esp + 0x3c]
call fcn.00403350
mov byte [esp + 0x198], 4
push 0x75
mov ecx, str.srcClientRpc.cpp
mov eax, esi
jmp 0x487588
push ebx
push ebx
push ebx
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x487756
call esi
cmp eax, ebx
jle 0x48772d
and eax, 0xffff
or eax, 0x80070000
push 0x81
push str.srcClientRpc.cpp
mov edx, eax
lea ecx, [esp + 0xec]
call fcn.004988c2
push 0x5c9774
lea eax, [esp + 0xe8]
jmp 0x4875f0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x487765
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
add ecx, ecx
push ecx
push eax
push dword [esp + 0x1c]
call fcn.00517c70
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x602768], edi
push 1
xor edi, edi
lea esi, [esp + 0x20]
call fcn.0040412d
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret