Function at 0x100035090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x98
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov r14, rdx
mov r13, rcx
mov r12, 0xffffffffffffffff
mov rbp, r12
mov dword [rax - 0x58], 0x14
xor r15d, r15d
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov dword [rdx + 0x10], r15d
lea ecx, [r12 + 0x15]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x100035127
mov rcx, qword [r13]
test rcx, rcx
je 0x100035120
lock dec dword [rcx + 8]
jne 0x10003511c
test rcx, rcx
je 0x10003511c
mov rax, qword [rcx]
lea edx, [rsi + 1]
call qword [rax]
mov qword [r13], r15
xor eax, eax
jmp 0x10003536a
mov rax, qword [r13]
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x100035322
nop
nop
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
test rbx, rbx
je 0x100035150
lock inc dword [rbx + 8]
mov qword [rsp + 0x48], rbx
mov rcx, qword [rbx + 0x18]
cmp dword [rcx - 0x10], 0
je 0x100035188
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
jmp 0x1000351b3
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rbp, 0xffffffffffffffff
je 0x1000352ae
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
xor r9d, r9d
mov r8, rsi
lea rdx, [rsp + 0x44]
mov rcx, rbp
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
test eax, eax
jne 0x100035238
nop
cmp eax, 0x7a
jne 0x100035305
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
test eax, eax
je 0x100035219
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x1000352e8
mov rsi, rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
xor r9d, r9d
mov r8, rsi
lea rdx, [rsp + 0x44]
mov rcx, rbp
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
test eax, eax
je 0x1000351e0
lea r8, [rbx + 0x20]
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call fcn.100049fc0
test eax, eax
je 0x1000352cb
mov eax, dword [rsp + 0x44]
cmp eax, 0x14
jbe 0x100035260
mov eax, 0x14
mov dword [rsp + 0x44], eax
jmp 0x100035264
test eax, eax
je 0x10003527f
mov rcx, r14
mov r8, rsi
sub r8, r14
mov edx, eax
nop
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
dec rdx
jne 0x100035270
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, r12
lock dec dword [rbx + 8]
jne 0x10003529e
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
test rdi, rdi
jne 0x100035140
jmp 0x100035322
mov edi, r15d
lock dec dword [rbx + 8]
jne 0x1000352c4
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
jmp 0x100035327
mov edi, r15d
lock dec dword [rbx + 8]
jne 0x1000352e1
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
jmp 0x100035327
mov edi, r15d
lock dec dword [rbx + 8]
jne 0x1000352fe
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
jmp 0x100035327
mov edi, r15d
lock dec dword [rbx + 8]
jne 0x10003531b
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x48], r15
jmp 0x100035327
mov edi, 1
test rsi, rsi
je 0x100035335
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
cmp rbp, 0xffffffffffffffff
je 0x100035345
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [r13]
test rcx, rcx
je 0x100035368
lock dec dword [rcx + 8]
jne 0x100035364
test rcx, rcx
je 0x100035364
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov qword [r13], r15
mov eax, edi
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
add rsp, 0x98
ret