Function at 0x18000f380
Capabilities:
Generate random numbers via winapi
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x108
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
lea rax, [rsp + 0x48]
mov rbx, rcx
mov qword [r11 - 0x18], r12
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [r11 - 0x28], r14
mov esi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
test eax, eax
jne 0x18000f444
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.ProductType
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000f439
lea rdx, str.WinNT
lea rcx, [rsp + 0xb0]
call fcn.180062e30
test eax, eax
cmovne esi, r14d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x18000f51b
lea rdx, str.NetStatisticsGet
mov rcx, rax
mov qword [rsp + 0xf8], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetApiBufferSize
mov rcx, rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetApiBufferFree
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x18000f50a
test rbp, rbp
je 0x18000f50a
test rax, rax
je 0x18000f50a
lea rax, str.LanmanWorkstation
lea rdx, str.LanmanServer
test esi, esi
cmovne rdx, rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r14
call r13
test eax, eax
jne 0x18000f50a
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r14d
call rbp
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.18000eb80
mov rcx, qword [rsp + 0x48]
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0xf8]
xor eax, eax
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
mov r12d, r14d
mov word [rsp + 0xb0], r14w
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov dword [rsp + 0xda], eax
mov word [rsp + 0xde], ax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000f6e7
nop
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x70020
mov rcx, rbp
mov dword [rsp + 0x28], 0x58
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18000f64b
movsxd rsi, dword [rsp + 0x40]
mov rdi, r14
test rsi, rsi
jle 0x18000f64b
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x50]
jne 0x18000f618
mov dword [rbx + 0x504], r14d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f63d
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, rsi
jl 0x18000f600
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc r12d
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0xb0]
mov r8d, r12d
mov word [rsp + 0xb0], r14w
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov dword [rsp + 0xda], eax
mov word [rsp + 0xde], ax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18000f5b0
cmp dword [rbx + 0x518], 0
mov r14, qword [rsp + 0xf0]
mov r12, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x128]
je 0x18000f742
mov rcx, qword [rbx + 0x510]
lea r8, [rbx + 0x280]
mov edx, 0x280
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18000f742
lea rdx, [rbx + 0x280]
mov r8d, 0x280
mov rcx, rbx
call fcn.18000eb80
lea rcx, [rbx + 0x280]
xor edx, edx
mov r8d, 0x280
call fcn.1800644c0
mov rcx, rbx
call fcn.18000f780
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.180062100
add rsp, 0x108
pop rdi
pop rbx
ret