Function at 0x1800184e0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
mov ebp, dword [rcx + 0x504]
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, rbx
call fcn.180018300
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetInputState]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetMessagePos]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetMessageTime]
mov rcx, rbx
mov edx, eax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rbx
mov rdx, rax
call fcn.180018300
mov ecx, 0x4bf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov rcx, rbx
mov edx, eax
call fcn.180018300
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCaretPos]
xor r12d, r12d
mov rdi, r12
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x18001865b
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180018680
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018640
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x1800186bb
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800186e0
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x1800186a0
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x58], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rdi, r12
nop word [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x58]
jne 0x180018728
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18001874d
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 0x38
jl 0x180018710
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rdi, r12
nop dword [rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x1800187ab
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800187d0
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018790
mov rdi, r12
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x180018806
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18001882b
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x1800187f0
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x180018856
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18001887b
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018843
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x1800188a6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800188cb
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018893
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x148]
mov rsi, rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x140]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x18001892f
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180018954
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018914
mov rdi, r12
nop dword [rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x180018986
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800189ab
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018970
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x1800189d6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800189fb
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x1800189c3
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x180018a26
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180018a4b
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180018a13
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.180018300
mov edx, dword [rsp + 0x40]
mov rcx, rbx
call fcn.180018300
cmp dword [0x18011c548], r12d
jne 0x180018acd
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rdx, [rsp + 0x90]
mov r8d, 0x68
mov rcx, rbx
call fcn.180018430
mov dword [0x18011c548], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180018ae9
mov r8d, 8
lea rdx, [rsp + 0x48]
jmp 0x180018b04
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, 4
lea rdx, [rsp + 0x130]
mov dword [rsp + 0x130], eax
mov rcx, rbx
call fcn.180018430
cmp dword [rbx + 0x518], r12d
je 0x180018b47
mov rcx, qword [rbx + 0x510]
lea r8, [rbx + 0x280]
mov edx, 0x280
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180018b47
lea rdx, [rbx + 0x280]
mov r8d, 0x280
mov rcx, rbx
call fcn.180018430
mov rcx, rbx
call fcn.180018f70
mov dword [rbx + 0x504], ebp
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret