Function at 0x10035030
Capabilities:
Execute anti-debugging instructions
Generate random numbers via winapi
Read file on windows

Disassembly:
push ebp
xor eax, eax
push edi
mov edx, str.Microsoft_Primitive_Provider
push esi
mov ecx, 0x100bf802
push ebx
sub esp, 0xdc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
sub esp, 0x10
test eax, eax
js 0x100350aa
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptGenRandom
sub esp, 0x10
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
sub esp, 8
test ebx, ebx
jns 0x10035188
mov dword [esp], str._dev_urandom
xor eax, eax
mov dword [esp + 4], eax
call sym.avutil_lav_57.dll_mvpriv_open
cmp eax, 0xffffffff
mov ebx, eax
je 0x100350ef
mov dword [esp], ebx
lea eax, [esp + 0x3c]
mov ebp, 4
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll__read
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll__close
cmp esi, 4
je 0x10035188
mov dword [esp], str._dev_random
xor edi, edi
mov dword [esp + 4], edi
call sym.avutil_lav_57.dll_mvpriv_open
cmp eax, 0xffffffff
mov ebx, eax
je 0x10035130
mov dword [esp], ebx
lea eax, [esp + 0x3c]
mov esi, 4
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll__read
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll__close
cmp esi, 4
je 0x10035188
mov eax, dword [0x100d7ec0]
mov edx, dword [0x100d7ec4]
cmp dword [sym.avutil_lav_57.dll_mv_sha_size], 0x78
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
ja 0x10035375
lfence
rdtsc
xor dword [0x100d76f4], eax
lfence
rdtsc
mov ebx, dword [esp + 0x2c]
xor ebp, ebp
xor esi, esi
mov eax, dword [esp + 0x28]
xor dword [0x100d7764], edx
or ebx, eax
mov ebx, 0
jne 0x10035293
jmp 0x10035208
mov eax, dword [esp + 0x3c]
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x100d7ec4]
add ecx, 1
mov dword [0x100d7ec0], ecx
mov edi, ecx
adc ebx, 0
and edi, 0x1ff
mov dword [esp + 0x24], edi
xor edx, edx
cmp esi, 0xc46031b9
mov dword [0x100d7ec4], ebx
setae dl
mov edi, esi
imul edx, edx, 0xc46031b9
sub edi, edx
mov edx, dword [esp + 0x24]
add dword [edx*4 + 0x100d76c0], edi
mov edx, eax
sub edx, ebp
cmp edx, 0x1e
jle 0x10035201
mov edi, 0x40
cmp edi, ecx
mov edi, 0
sbb edi, ebx
jb 0x10035312
test ebp, ebp
mov ebx, eax
cmove ebp, eax
call sub.msvcrt.dll_clock
lea edx, [ebx + esi*2]
mov ecx, dword [0x100d7ec0]
mov esi, eax
sub esi, ebx
cmp eax, edx
jg 0x100351a0
and ecx, 0x1ff
xor edx, edx
imul ebx, dword [ecx*4 + 0x100d76c0], 0x19660d
cmp esi, 0xc46031b9
setae dl
mov edi, esi
imul edx, edx, 0xc46031b9
sub edi, edx
lea edx, [ebx + edi + 0x3c6ef35f]
mov dword [ecx*4 + 0x100d76c0], edx
jmp 0x10035201
and ecx, 0x1ff
xor edx, edx
imul ebx, dword [ecx*4 + 0x100d76c0], 0x19660d
cmp esi, 0xc46031b9
setae dl
mov edi, esi
imul edx, edx, 0xc46031b9
sub edi, edx
lea edx, [ebx + edi + 0x3c6ef35f]
mov dword [ecx*4 + 0x100d76c0], edx
test ebp, ebp
mov ebx, eax
cmove ebp, eax
call sub.msvcrt.dll_clock
lea edx, [ebx + esi*2]
mov ecx, dword [0x100d7ec0]
mov esi, eax
sub esi, ebx
cmp eax, edx
jle 0x10035258
mov ebx, dword [0x100d7ec4]
add ecx, 1
mov dword [0x100d7ec0], ecx
mov edi, ecx
adc ebx, 0
and edi, 0x1ff
mov dword [esp + 0x24], edi
xor edx, edx
cmp esi, 0xc46031b9
mov dword [0x100d7ec4], ebx
setae dl
mov edi, esi
imul edx, edx, 0xc46031b9
sub edi, edx
mov edx, dword [esp + 0x24]
add dword [edx*4 + 0x100d76c0], edi
mov edx, eax
sub edx, ebp
cmp edx, 0x1e
jle 0x1003528c
sub ecx, dword [esp + 0x28]
mov edi, 4
sbb ebx, dword [esp + 0x2c]
cmp edi, ecx
mov edi, 0
sbb edi, ebx
jae 0x1003528c
lfence
rdtsc
lea ebx, [esp + 0x58]
add dword [0x100d787c], eax
mov eax, 0xa0
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.avutil_lav_57.dll_mv_sha_init
mov edx, 0x800
mov ecx, 0x100d76c0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sym.avutil_lav_57.dll_mv_sha_update
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.avutil_lav_57.dll_mv_sha_final
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x54]
add esp, 0xdc
pop ebx
bswap eax
pop esi
bswap edx
add eax, edx
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x4e
xor ebx, ebx
mov dword [esp + 0x10], str.libavutil_random_seed.c
mov dword [esp + 0xc], str.sizeof_tmp____av_sha_size
mov dword [esp + 8], 0x100bf856
mov dword [esp + 4], ebx
mov dword [esp], ebx
call sym.avutil_lav_57.dll_mv_log
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop