Function at 0x180065c30
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
mov ebp, dword [rcx + 0x504]
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, rbx
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetInputState]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetMessagePos]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetMessageTime]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rbx
mov rdx, rax
call fcn.180065a50
mov ecx, 0x4bf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov rcx, rbx
mov edx, eax
call fcn.180065a50
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCaretPos]
xor r12d, r12d
mov rdi, r12
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x180065dab
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065dd0
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065d90
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x138]
jne 0x180065e0b
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065e30
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065df0
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x58], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rdi, r12
nop word [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x58]
jne 0x180065e78
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065e9d
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 0x38
jl 0x180065e60
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rdi, r12
nop dword [rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x180065efb
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065f20
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065ee0
mov rdi, r12
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x180065f56
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065f7b
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065f40
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x180065fa6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180065fcb
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065f93
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x180065ff6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18006601b
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180065fe3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x148]
mov rsi, rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x140]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x140]
jne 0x18006607f
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800660a4
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180066064
mov rdi, r12
nop dword [rax]
movzx ecx, byte [rsp + rdi + 0x148]
cmp eax, 0x280
jne 0x1800660d6
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800660fb
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x1800660c0
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x30]
cmp eax, 0x280
jne 0x180066126
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18006614b
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180066113
mov rdi, r12
movzx ecx, byte [rsp + rdi + 0x38]
cmp eax, 0x280
jne 0x180066176
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18006619b
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
mov eax, dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180066163
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.180065a50
mov edx, dword [rsp + 0x40]
mov rcx, rbx
call fcn.180065a50
cmp dword [0x18010c1ec], r12d
jne 0x180066259
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdi, r12
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x90]
jne 0x18006621b
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180066240
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 0x68
jl 0x180066200
mov dword [0x18010c1ec], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1800662be
mov rdi, r12
nop dword [rax + rax]
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x48]
jne 0x180066288
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800662ad
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 8
jl 0x180066270
jmp 0x18006631f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, r12
mov dword [rsp + 0x130], eax
nop
cmp dword [rbx + 0x504], 0x280
movzx ecx, byte [rsp + rdi + 0x130]
jne 0x1800662eb
mov dword [rbx + 0x504], r12d
movsxd rax, dword [rbx + 0x504]
add byte [rax + rbx], cl
mov eax, dword [rbx + 0x504]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x180066310
mov rcx, rbx
call fcn.180066780
inc dword [rbx + 0x504]
inc rdi
cmp rdi, 4
jl 0x1800662d0
cmp dword [rbx + 0x518], r12d
je 0x18006635a
mov rcx, qword [rbx + 0x510]
lea r8, [rbx + 0x280]
mov edx, 0x280
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18006635a
lea rdx, [rbx + 0x280]
mov r8d, 0x280
mov rcx, rbx
call fcn.180065b80
mov rcx, rbx
call fcn.180066780
mov dword [rbx + 0x504], ebp
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret