Function at 0x1009a3c0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
lea eax, [esp + 0x50]
push eax
call fcn.10165350
add esp, 4
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
pxor xmm0, xmm0
movdqu xmmword [esp + 0x40], xmm0
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x40]
push 2
push 0x10
push ebx
push 0
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
cmp eax, 0xc0000000
jb 0x1009a41b
push 0x10
push ebx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1009a9ec
movdqu xmm0, xmmword [esp + 0x40]
movdqa xmmword [esp + 0x80], xmm0
movzx edx, byte [esp + 0x8a]
movzx ecx, byte [esp + 0x88]
movzx esi, byte [esp + 0x89]
movzx eax, byte [esp + 0x86]
shl edx, 8
and cl, 0x3f
and al, 0xf
or esi, edx
movzx edx, byte [esp + 0x87]
or cl, 0x80
or al, 0x40
movzx ecx, cl
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0x8c]
movd xmm1, edx
movzx edx, byte [esp + 0x8b]
pinsrw xmm1, esi, 1
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x8e]
pinsrw xmm1, edx, 2
movzx edx, byte [esp + 0x8d]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x8f]
movd dword [esp + 0x40], xmm0
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x38], 0
pinsrw xmm1, edx, 3
pextrw edx, xmm0, 2
pshufd xmm0, xmm1, 0x55
mov word [esp + 0x44], dx
mov byte [esp + 0x46], al
movd dword [esp + 0x47], xmm1
movd dword [esp + 0x4b], xmm0
pxor xmm0, xmm0
mov byte [esp + 0x4f], cl
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x18], xmm0
lea edx, [esp + 0x40]
lea ecx, [esp + 0x18]
push 0
call fcn.10197ca0
add esp, 4
lea ebx, [esp + 0x64]
xor edx, edx
mov ecx, ebx
push 0x24
call fcn.10099430
add esp, 4
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x38]
mov dword [ecx + eax + 0x20], edx
movsd xmm0, qword [esp + 0x30]
movsd qword [ecx + eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x28]
movsd qword [ecx + eax + 0x10], xmm0
movsd xmm0, qword [esp + 0x18]
movq xmm1, qword [esp + 0x20]
movq qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
add eax, 0x24
movq xmm0, qword [esp + 0x64]
mov dword [esp + 0x20], eax
movq qword [esp + 0x18], xmm0
mov esi, dword [esp + 0x18]
push eax
push esi
push edi
push dword [esp + 0x20]
push ebx
call fcn.1016ca40
add esp, 0x14
cmp dword [esp + 0x1c], 0
je 0x1009a5a6
mov eax, dword [0x1044eff8]
push esi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x54], 0
mov dword [esp + 0x3c], ebx
je 0x1009a5c3
mov eax, dword [0x1044eff8]
push dword [esp + 0x50]
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
movdqa xmm0, xmmword [0x10334d10]
mov esi, dword [esp + 0x64]
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x34], 0
mov word [esp + 0x38], 0
mov dword [esp + 0x18], 0
movdqu xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
mov byte [esp + 0x35], 1
mov byte [esp + 0x38], 1
mov byte [esp + 0x37], 1
lea edi, [esp + 0x40]
mov edx, esi
lea eax, [esp + 0x18]
mov ecx, edi
push eax
push ebx
call fcn.101746e0
add esp, 8
cmp byte [esp + 0x40], 4
jne 0x1009a62a
mov edx, dword [esp + 0x44]
jmp 0x1009a63a
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
cmp al, 4
jne 0x1009aa45
sub esp, 8
lea ecx, [esp + 0x80]
mov dword [esp + 0x1c], edx
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10175c40
add esp, 0x18
cmp byte [esp + 0x78], 4
jne 0x1009a746
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x90], eax
push ebx
push esi
lea eax, [esp + 0x20]
push eax
call fcn.1002ad90
add esp, 0xc
cmp dword [esp + 0x18], 0
jne 0x1009aa83
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1009aa83
mov eax, dword [edi + 0x34]
mov ebx, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
push dword [ebp + 0x18]
push ebx
push esi
push dword [esp + 0x9c]
push dword [esp + 0x20]
push dword [edi + 0x30]
lea ecx, [esp + 0x30]
push ecx
call eax
add esp, 0x1c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1009a86b
movq xmm0, qword [esp + 0x1c]
test ebx, ebx
mov dword [esp + 0x10], eax
movdqa xmmword [esp + 0x90], xmm0
je 0x1009a96b
setns al
js 0x1009aac0
mov byte [esp + 0xa0], al
mov eax, dword [0x1044f00c]
mov edi, dword [0x1044eff8]
movzx eax, byte [eax]
mov eax, dword [edi]
test eax, eax
jne 0x1009a71c
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1009a72f
mov dword [edi], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x1009a970
movzx eax, byte [esp + 0xa0]
push ebx
push eax
call fcn.1001ac80
add esp, 8
jmp 0x1009aacc
mov eax, dword [esp + 0x78]
cmp al, 4
je 0x1009aa6d
mov edx, dword [esp + 0x7c]
mov ecx, eax
mov byte [esp + 0x50], al
shr eax, 0x18
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], 0x20
mov byte [esp + 0x38], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], 0
mov dword [esp + 0x30], 0x10334d20
shr ecx, 8
mov byte [esp + 0x53], al
mov word [esp + 0x51], cx
mov dword [esp + 0x54], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.10167360
add esp, 8
test al, al
jne 0x1009aa99
mov eax, dword [esp + 0x40]
movq xmm0, qword [esp + 0x44]
mov dword [esp + 0x90], eax
movdqa xmmword [esp + 0xa0], xmm0
push ebx
push esi
lea eax, [esp + 0x20]
push eax
call fcn.101769e0
add esp, 0xc
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x74], eax
cmove esi, eax
test edi, edi
je 0x1009a8c6
setns al
js 0x1009aab9
mov byte [esp + 0xc], al
mov eax, dword [0x1044f00c]
mov ebx, dword [0x1044eff8]
movzx eax, byte [eax]
mov eax, dword [ebx]
test eax, eax
jne 0x1009a848
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1009a857
mov dword [ebx], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ebx, eax
test eax, eax
jne 0x1009a8cb
movzx eax, byte [esp + 0xc]
push edi
push eax
call fcn.1001ac80
add esp, 8
jmp 0x1009aacc
test ebx, ebx
je 0x1009a999
setns al
js 0x1009aac7
mov byte [esp + 0x10], al
mov eax, dword [0x1044f00c]
mov edi, dword [0x1044eff8]
movzx eax, byte [eax]
mov eax, dword [edi]
test eax, eax
jne 0x1009a89f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1009a8b2
mov dword [edi], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x1009a99e
movzx eax, byte [esp + 0x10]
push ebx
push eax
call fcn.1001ac80
add esp, 8
jmp 0x1009aacc
mov ebx, 1
push edi
push esi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [esp + 0x10], 0
mov eax, dword [esp + 0x90]
movdqa xmm0, xmmword [esp + 0xa0]
mov byte [esi + 0x18], 1
mov dword [esi + 0xc], eax
movq qword [esi + 0x10], xmm0
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
je 0x1009a91d
cmp dword [esp + 0x74], 0
je 0x1009a91d
mov eax, dword [0x1044eff8]
push dword [esp + 0x10]
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0x50], 3
jne 0x1009a9bf
mov esi, dword [esp + 0x54]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x1009a957
cmp dword [ebx + 8], 9
jb 0x1009a948
mov edi, dword [edi - 4]
mov eax, dword [0x1044eff8]
push edi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x1044eff8]
push esi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [ebp + 8]
jmp 0x1009a9bf
mov edi, 1
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x10]
movdqa xmm0, xmmword [esp + 0x90]
mov byte [esi + 0x18], 1
mov dword [esi + 0xc], eax
movq qword [esi + 0x10], xmm0
jmp 0x1009a9b7
mov edi, 1
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [ebp + 8]
mov byte [esi + 0x18], 0
mov dword [esi + 0xc], 0
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0x68], 0
je 0x1009a9e2
mov eax, dword [0x1044eff8]
push dword [esp + 0x64]
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x78]
add esi, 0x80000000
mov dword [esp + 0x18], 0x1043db24
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x78], esi
mov dword [esp + 0x68], 0x10067180
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 1
lea eax, [esp + 0x18]
push 0x1043db80
push eax
call fcn.100272b0
add esp, 8
jmp 0x1009aacc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
push 0x10335134
push 0x10334ea0
lea eax, [esp + 0x20]
push eax
push 0x2b
push 0x10334e74
call fcn.10027650
add esp, 0x14
jmp 0x1009aacc
push 0x10335154
push 0x2b
push 0x10334ec0
call fcn.10027330
add esp, 0xc
jmp 0x1009aacc
push 0x10335144
push 0x2b
push 0x10334ec0
call fcn.10027330
add esp, 0xc
jmp 0x1009aacc
lea eax, [esp + 0x60]
push 0x10334dbc
push 0x10334e64
push eax
push 0x37
push 0x10334d38
call fcn.10027650
add esp, 0x14
jmp 0x1009aacc
call fcn.1001ac40
jmp 0x1009aacc
call fcn.1001ac40
jmp 0x1009aacc
call fcn.1001ac40
ud2