Function at 0x18000ec30
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
mov ebp, dword [rcx + 0x504]
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, rbx
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetInputState]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetMessagePos]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetMessageTime]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rbx
mov rdx, rax
call fcn.18000ea50
mov ecx, 0x4bf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov rcx, rbx
mov edx, eax
call fcn.18000ea50
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCaretPos]
xor r12d, r12d
mov rdi, r12
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x18000edab
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000edd0
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000ed90
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x18000ee0b
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000ee30
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000edf0
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x58], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rdi, r12
nop word [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x58]
jne 0x18000ee78
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000ee9d
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 0x38
jl 0x18000ee60
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rdi, r12
nop dword [rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x18000eefb
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000ef20
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000eee0
mov rdi, r12
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x18000ef56
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000ef7b
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000ef40
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x18000efa6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000efcb
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000ef93
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x18000eff6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f01b
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000efe3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x148]
mov rsi, rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x140]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x18000f07f
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f0a4
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000f064
mov rdi, r12
nop dword [rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x18000f0d6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f0fb
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000f0c0
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x18000f126
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f14b
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000f113
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x18000f176
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f19b
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000f163
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.18000ea50
mov edx, dword [rsp + 0x40]
mov rcx, rbx
call fcn.18000ea50
cmp dword [0x18010406c], r12d
jne 0x18000f259
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x90]
jne 0x18000f21b
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f240
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 0x68
jl 0x18000f200
mov dword [0x18010406c], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18000f2be
mov rdi, r12
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x48]
jne 0x18000f288
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f2ad
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x18000f270
jmp 0x18000f31f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, r12
mov dword [rsp + 0x130], eax
nop
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x130]
jne 0x18000f2eb
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000f310
mov rcx, rbx
call fcn.18000f780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 4
jl 0x18000f2d0
cmp dword [rbx + 0x518], r12d
je 0x18000f35a
mov rcx, qword [rbx + 0x510]
lea r8, [rbx + 0x280]
mov edx, 0x280
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18000f35a
lea rdx, [rbx + 0x280]
mov r8d, 0x280
mov rcx, rbx
call fcn.18000eb80
mov rcx, rbx
call fcn.18000f780
mov dword [rbx + 0x504], ebp
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret