Function at 0x180018b70
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x108
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
lea rax, [rsp + 0x48]
mov rbx, rcx
mov qword [r11 - 0x18], r12
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [r11 - 0x28], r14
mov esi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
test eax, eax
jne 0x180018c34
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.ProductType
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180018c29
lea rdx, str.WinNT
lea rcx, [rsp + 0xb0]
call fcn.180078518
test eax, eax
cmovne esi, r14d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x180018d0b
lea rdx, str.NetStatisticsGet
mov rcx, rax
mov qword [rsp + 0xf8], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetApiBufferSize
mov rcx, rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetApiBufferFree
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x180018cfa
test rbp, rbp
je 0x180018cfa
test rax, rax
je 0x180018cfa
lea rax, str.LanmanWorkstation
lea rdx, str.LanmanServer
test esi, esi
cmovne rdx, rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r14
call r13
test eax, eax
jne 0x180018cfa
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r14d
call rbp
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.180018430
mov rcx, qword [rsp + 0x48]
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0xf8]
xor eax, eax
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
mov r12d, r14d
mov word [rsp + 0xb0], r14w
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov dword [rsp + 0xda], eax
mov word [rsp + 0xde], ax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180018ed7
nop
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x70020
mov rcx, rbp
mov dword [rsp + 0x28], 0x58
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180018e3b
movsxd rsi, dword [rsp + 0x40]
mov rdi, r14
test rsi, rsi
jle 0x180018e3b
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x50]
jne 0x180018e08
mov dword [rbx + 0x504], r14d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180018e2d
mov rcx, rbx
call fcn.180018f70
inc dword [rbx + 0x504]
inc rdi
cmp rdi, rsi
jl 0x180018df0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc r12d
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0xb0]
mov r8d, r12d
mov word [rsp + 0xb0], r14w
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov dword [rsp + 0xda], eax
mov word [rsp + 0xde], ax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180018da0
cmp dword [rbx + 0x518], 0
mov r14, qword [rsp + 0xf0]
mov r12, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x128]
je 0x180018f32
mov rcx, qword [rbx + 0x510]
lea r8, [rbx + 0x280]
mov edx, 0x280
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180018f32
lea rdx, [rbx + 0x280]
mov r8d, 0x280
mov rcx, rbx
call fcn.180018430
lea rcx, [rbx + 0x280]
xor edx, edx
mov r8d, 0x280
call fcn.1800795c0
mov rcx, rbx
call fcn.180018f70
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.180076a70
add rsp, 0x108
pop rdi
pop rbx
ret