Function at 0x31a08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov rsi, r8
lea rax, str.session_ticket_structure
mov r13, rdx
lea rbp, [rdx + 0x22]
lea r8, str.f:driver_
mov r9d, 0x10b
mov edx, 3
mov qword [rsp + 0x20], rax
mov r14, rcx
call fcn.00044260
cmp rsi, 0x22
jb 0x31d2b
mov rdx, qword [r14 + 0x1b8]
test rdx, rdx
je 0x31d2b
movzx eax, byte [r13 + 0x20]
shl eax, 8
movsxd rdi, eax
movzx eax, byte [r13 + 0x21]
or rdi, rax
lea rax, [rdi + 0x42]
lea r15, [rdi + rbp]
cmp rsi, rax
jne 0x31d2b
xor bl, bl
xor ecx, ecx
mov al, byte [rdx + rcx]
xor al, byte [r13 + rcx]
inc rcx
or bl, al
cmp rcx, 0x10
jb 0x31aad
and dword [rsp + 0x28], 0
lea rax, [rsp + 0xf0]
lea rcx, [rdx + 0x250]
lea r9, [rsi - 0x20]
mov r8, r13
mov edx, 0x10
mov qword [rsp + 0x20], rax
call fcn.000416dc
lea rax, [rsp + 0xf0]
mov rdx, r15
xor r11d, r11d
sub rdx, rax
lea rax, [rsp + r11 + 0xf0]
inc r11
mov cl, byte [rdx + rax]
xor cl, byte [rax]
or bl, cl
cmp r11, 0x20
jb 0x31afb
test bl, bl
je 0x31b21
mov eax, 0xffff8e80
jmp 0x31d30
mov rcx, qword [r14 + 0x1b8]
lea r9, [r13 + 0x10]
mov r8, rdi
xor edx, edx
add rcx, 0x130
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.0003972c
test eax, eax
jne 0x31d30
movzx r8d, byte [r15 - 1]
mov ebx, 0xffff8f00
mov rdx, r8
cmp r8, 2
jbe 0x31b81
lea rcx, [r15 - 2]
lea r9, [rdx - 2]
cmp byte [rcx], r8b
cmovne eax, ebx
dec rcx
sub r9, 1
jne 0x31b6a
test eax, eax
jne 0x31d30
sub rdi, rdx
lea rax, str.session_ticket_cleartext
lea r8, str.f:driver_
mov qword [rsp + 0x30], rdi
mov r9d, 0x13b
mov edx, 3
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.00044260
lea r12, [rdi + rbp]
lea rsi, [rbp + 0x98]
cmp rsi, r12
ja 0x31c8c
mov edi, 0x98
lea rcx, [rsp + 0x50]
mov rdx, rbp
mov r8, rdi
call fcn.0005d130
lea rbp, [rsi + 3]
cmp rbp, r12
ja 0x31c8c
movzx eax, byte [rsi + 1]
movzx ecx, byte [rsi]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 2]
shl ecx, 8
movsxd r13, ecx
or r13, rax
jne 0x31c0f
and qword [rsp + 0xb8], r13
jmp 0x31c81
lea r15, [r13 + rbp]
cmp r15, r12
ja 0x31c8c
mov ecx, 0x240
call fcn.00037798
mov rsi, rax
mov qword [rsp + 0xb8], rax
test rax, rax
jne 0x31c3a
mov ebx, 0xffff8100
jmp 0x31c8c
xor edx, edx
mov r8d, 0x240
mov rcx, rax
call fcn.0005d630
mov r8, r13
mov rdx, rbp
mov rcx, rsi
call fcn.0001ac60
mov ebp, eax
test eax, eax
je 0x31c7e
mov rcx, rsi
call fcn.0001c520
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0xb8], 0
mov ebx, ebp
jmp 0x31c88
mov rbp, r15
cmp rbp, r12
jne 0x31c8c
xor ebx, ebx
test ebx, ebx
je 0x31c9a
lea rcx, reloc.ntoskrnl.exe_IoFreeWorkItem
call fcn.00044148
jmp 0x31cca
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
sub eax, dword [rsp + 0x50]
cmp eax, dword [r14 + 0x210]
jle 0x31cd8
lea rcx, str.session_ticket_expired
call fcn.00044148
mov ebx, 0xffff9280
lea rcx, [rsp + 0x50]
call fcn.0002e074
mov eax, ebx
jmp 0x31d30
mov rdx, qword [r14 + 0xd8]
lea rcx, [rsp + 0x68]
mov r8, qword [rdx + 0x10]
add rdx, 0x18
mov qword [rsp + 0x60], r8
call fcn.0005d130
mov rcx, qword [r14 + 0xd8]
call fcn.0002e074
mov rcx, qword [r14 + 0xd8]
lea rdx, [rsp + 0x50]
mov r8, rdi
call fcn.0005d130
lea rax, [rsp + 0x50]
mov byte [rax], 0
inc rax
sub rdi, 1
jne 0x31d1b
xor eax, eax
jmp 0x31d30
mov eax, 0xffff8f00
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret