Function at 0x18000fa30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov r11, rsp
push rsi
push r14
sub rsp, 0xb8
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x18], rbx
xor esi, esi
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x28], rdi
movzx eax, r9w
mov r9d, edx
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x38], r13
mov r13, qword [rsp + 0xf0]
mov dword [rsp + 0x54], edx
mov rdx, rcx
mov word [rsp + 0x68], ax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rcx
test byte [0x1800b78f1], 4
mov ecx, dword [rsp + 0x100]
mov ebp, dword [rsp + 0xf8]
jne 0x18003acc8
mov eax, esi
test r13, r13
jne 0x18003acec
test byte [0x1800b78f3], 2
jne 0x18003acf6
movzx ebx, ax
mov edi, 0x200
mov qword [rsp + 0x88], r15
cmp bx, di
ja 0x18003ad13
xor r15b, r15b
mov rax, qword [0x1800b8500]
movzx r14d, di
lea r12d, [r14 + 0x273]
test rax, rax
jne 0x18003ad1e
mov rax, qword [0x1800b7ed8]
test rax, rax
je 0x18003ad46
mov r8d, r12d
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov r12, qword [rsp + 0x98]
test rbx, rbx
je 0x18000fbd3
movzx eax, di
lea rcx, [rbx + 0x26c]
add rcx, rax
mov dword [rbx + 0x210], r14d
mov qword [rbx + 0x218], rcx
mov byte [rbx + 0x24c], r15b
test byte [0x1800b78f1], 4
jne 0x18003ad5e
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
test r15b, r15b
jne 0x18003ad7f
xor al, al
mov byte [rbx + 0x24c], al
xor eax, eax
mov byte [rbx + 0x24f], sil
mov dword [rbx + 0x234], esi
mov qword [rbx + 0x26c], rax
mov dword [rbx + 0x274], eax
lea rax, [rbx + 0x278]
mov qword [rbx + 0x220], rax
mov qword [rbx + 0x260], rsi
test byte [0x1800b78f1], 4
jne 0x18003ad9b
lea rcx, [rbx + 0x1d8]
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov r15, qword [rsp + 0x88]
test byte [0x1800b78f3], 2
jne 0x18003adb2
test rbx, rbx
je 0x18003adcc
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x18000fcac
bt ebp, 0x1d
jb 0x18003add7
mov rdx, qword [rbx + 0x218]
lea rcx, [rbx + 0x278]
mov r14d, 1
mov eax, esi
bt ebp, 0x1c
cmovb eax, r14d
or byte [rbx + 0x26e], r14b
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov word [rsp + 0x20], si
call sym.DNSAPI.dll_Dns_WriteDottedNameToPacket
mov rdi, rax
test rax, rax
je 0x18003ae13
movzx ecx, word [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_htons]
nop dword [rax + rax]
mov word [rdi], ax
test dword [rbx + 0x254], 0x20000000
jne 0x18003ade6
mov eax, pe_nt_image_headers64
mov word [rdi + 2], ax
add rdi, 4
mov word [rbx + 0x270], r14w
mov qword [rbx + 0x220], rdi
mov byte [rbx + 0x24f], sil
mov rax, qword [section..data]
test byte [rax + 0x1c], 2
jne 0x18003adfe
test rdi, rdi
je 0x18003ae13
mov edi, dword [rsp + 0x100]
test r13, r13
jne 0x18003ae1e
mov r14d, esi
test edi, edi
jne 0x18000fcd9
cmp dword [0x1800b7a1c], esi
jne 0x18003ae96
bt ebp, 0x18
jb 0x18003ae5a
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x18000fd97
test bpl, 4
jne 0x18000fdb8
cmp word [rbx + 0x26c], si
jne 0x18000fd32
mov edx, 2
lea rcx, [rsp + 0x68]
call qword [sym.imp.CRYPTBASE.dll_SystemFunction036]
nop dword [rax + rax]
test al, al
je 0x18003aeb7
movzx eax, word [rsp + 0x68]
test ax, ax
je 0x18000fcfa
mov word [rbx + 0x26c], ax
test ax, ax
je 0x18003aee7
bt ebp, 0x19
jb 0x18003aefb
mov rsi, rbx
mov ecx, r14d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
test byte [0x1800b78f1], 4
jne 0x18003af07
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0xb8
pop r14
pop rsi
ret
mov r8d, 0xc
cmp dword [rsp + 0x54], esi
jne 0x18003aeac
lea rcx, [rbx + 0x26c]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
jmp 0x18000fce7
and byte [rbx + 0x26e], 0xfe
jmp 0x18000fcf1
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r8, rdx
call fcn.18008a978
nop
jmp 0x18000faa2
mov eax, 0xffff
jmp 0x18000faad
movzx ebx, ax
lea rdx, [0x18009f0e0]
mov r8d, ebx
mov ecx, 0xe
call fcn.1800876bc
nop
jmp 0x18000fabd
movzx edi, bx
mov r15b, 1
jmp 0x18000fad6
mov ecx, r12d
call qword [case.0x180030b5c.0]
mov rbx, rax
test rax, rax
je 0x18000fb1b
mov r8d, r12d
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
nop
jmp 0x18000fb1b
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x1800b7ed8], rax
jmp 0x18000fb01
mov ecx, 0x10
lea rdx, [0x18009f0e0]
mov r8, rbx
call fcn.1800879b4
movzx r15d, byte [rbx + 0x24c]
jmp 0x18000fb5b
mov byte [rbx + 0x250], sil
mov al, 1
mov word [rbx + 0x26a], si
mov qword [rbx + 0x258], rsi
jmp 0x18000fb75
mov ecx, 0x11
lea rdx, [0x18009f0e0]
call fcn.180087008
nop
jmp 0x18000fbb9
mov ecx, 0xf
lea rdx, [0x18009f0e0]
mov r8, rbx
call fcn.1800879b4
nop
jmp 0x18000fbe8
mov r14d, 0xe
jmp 0x18000fd3f
or dword [rbx + 0x254], 0x20000000
jmp 0x18000fc09
mov eax, 0x180
mov word [rdi + 2], ax
and dword [rbx + 0x254], 0xdfffffff
jmp 0x18000fc78
mov rdx, rbx
lea rcx, str.Packet_after_question_write:
call fcn.18006fa34
nop
jmp 0x18000fca3
mov r14d, 0x7b
jmp 0x18003aeed
mov r8d, edi
mov rdx, r13
mov rcx, rbx
call sym.DNSAPI.dll_Dns_AddRecordsToMessage
mov r14d, eax
test eax, eax
je 0x18000fcbf
test byte [0x1800b78f1], 4
je 0x18003aeed
mov ecx, 0x1b
lea rdx, [0x18009f0e0]
call fcn.180087008
jmp 0x18003aeed
mov eax, dword [0x1800b7a48]
mov ecx, 0x1000
cmp eax, ecx
cmovb ax, cx
movzx ecx, ax
movzx edx, cx
mov edi, ebp
and edi, 0x1000000
mov rcx, rbx
setne al
mov byte [rsp + 0x20], al
call fcn.180056cac
mov r14d, eax
mov dword [rbx + 0x254], edi
jmp 0x18000fcd9
mov eax, dword [0x1800b7a48]
mov ecx, 0x1000
cmp eax, ecx
jne 0x18003ae67
mov ecx, 0x4000
jmp 0x18003ae6e
mov r8d, 4
jmp 0x18000fda7
test byte [0x1800b78f0], 0x10
je 0x18003aee0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, 0x3f
lea rdx, [0x18009f0e0]
mov r8d, eax
call fcn.1800876bc
mov eax, esi
jmp 0x18000fd22
mov r14d, 0xe
mov rcx, rbx
call sym.DNSAPI.dll_Dns_FreeMsgBuf
nop
jmp 0x18000fd3f
or byte [rbx + 0x26f], 0x10
jmp 0x18000fd3c
mov ecx, 0x1c
lea rdx, [0x18009f0e0]
mov r8d, r14d
call fcn.1800876bc
nop
jmp 0x18000fd7b