Function at 0x10002a30
Capabilities:
Check for debugger via api
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10004e58
push 0x1000312a
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x314], ebx
test byte [ebx + 0xc], 1
je 0x10002ba7
cmp dword [ebx + 0x14], 6
jb 0x10002ba7
cmp dword [ebx + 0x18], 1
jb 0x10002ba7
push 0x104
lea eax, [ebp - 0x240]
push eax
lea eax, [ebx + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
mov dword [ebp - 0x328], 0x10
lea eax, [ebp - 0x240]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x30], 0xaac56b
mov dword [ebp - 0x2c], 0x11d0cd44
mov dword [ebp - 0x28], 0xc000c28c
mov dword [ebp - 0x24], 0xee95c24f
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x35c], 0x34
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x350], 2
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x348], 1
mov dword [ebp - 0x340], 1
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x330], 0
lea eax, [ebp - 0x328]
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
call edi
mov esi, eax
mov dword [ebp - 0x340], 2
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
call edi
test esi, esi
jne 0x10002f39
mov eax, dword [ebx + 0xc]
test al, 2
je 0x10002c36
mov dword [ebp - 0x304], 0
mov esi, dword [ebx + 0x138]
mov ecx, dword [ebx + 0x13c]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [ebp - 0x30c], ecx
je 0x10002c33
or eax, 0xffffffff
mov edi, dword [esi + 4]
xor edx, edx
test edi, edi
je 0x10002c14
mov ebx, dword [esi]
movzx ecx, byte [ebx + edx]
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x10004190]
inc edx
cmp edx, edi
jb 0x10002bf0
mov ebx, dword [ebp - 0x314]
mov ecx, dword [ebp - 0x30c]
not eax
cmp eax, dword [esi + 8]
jne 0x10002f39
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
add esi, 0xc
cmp eax, ecx
jb 0x10002be2
mov eax, dword [ebx + 0xc]
test al, 4
je 0x10002df0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x10002f39
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x30c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 0x30c], 0
jne 0x10002f39
mov dword [ebp - 4], 0
push 0xdeadc0de
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
push str.ZwSetInformationObject
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x314], eax
mov word [ebp - 0x308], 0x100
mov dword [ebp - 4], 1
call esi
mov edi, eax
mov dword [ebp - 0x31c], edi
push 0
push 0
push 0
lea eax, [ebp - 0x304]
push eax
push edi
push edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call esi
push 2
lea eax, [ebp - 0x308]
push eax
push 4
push dword [ebp - 0x304]
call dword [ebp - 0x314]
push 1
push 0
push 0
lea eax, [ebp - 0x304]
push eax
push edi
push dword [ebp - 0x304]
push edi
call esi
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebx + 4], 0
jne 0x10002f39
cmp dword [ebx + 0x1c], 0
je 0x10002e86
lea eax, [ebp - 0x318]
cdq
push edx
push eax
push 0
push 8
lea eax, [ebp - 0x28]
cdq
push edx
push eax
push 0
push 0x1e
push 0xffffffffffffffff
push 0xffffffffffffffff
push 5
push 0
push dword [ebx + 0x158]
call fcn.10001530
add esp, 0x34
cmp eax, 0xc0000353
jne 0x10002f39
test edx, edx
jne 0x10002f39
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x24]
jne 0x10002f39
or ecx, 0xffffffff
mov esi, dword [ebx + 0x28]
test esi, esi
je 0x10002d98
mov edi, dword [ebx + 0x2c]
nop
movzx eax, byte [edi + edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x10004190]
inc edx
cmp edx, esi
jb 0x10002d80
not ecx
cmp ecx, dword [ebx + 0x30]
jne 0x10002f39
lea eax, [ebp - 0x320]
cdq
push edx
push eax
push 0
push 8
push edx
push eax
push 0
push 0x1e
push 0xffffffffffffffff
push 0xffffffffffffffff
push 5
push 0
push dword [ebx + 0x158]
call fcn.10001530
add esp, 0x34
cmp eax, 0xc0000353
jne 0x10002df0
test edx, edx
jne 0x10002df0
cmp dword [ebp - 0x320], 8
jne 0x10002f39
cmp dword [ebp - 0x31c], edx
jne 0x10002f39
test byte [ebx + 0xc], 8
je 0x10002f40
push 0x2c8
push 0
lea eax, [ebp - 0x2fc]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x300], 0x10010
lea eax, [ebp - 0x300]
push eax
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10002e61
cmp dword [ebp - 0x2fc], 0
jne 0x10002f39
cmp dword [ebp - 0x2f8], 0
jne 0x10002f39
cmp dword [ebp - 0x2f4], 0
jne 0x10002f39
cmp dword [ebp - 0x2f0], 0
jne 0x10002f39
push 0x10002190
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
int3
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x31c]
push eax
push 0x1e
push 0xffffffffffffffff
mov eax, dword [ebx + 0x154]
call eax
cmp eax, 0xc0000353
jne 0x10002f39
cmp dword [ebp - 0x31c], 0
jne 0x10002f39
or ecx, 0xffffffff
mov esi, dword [ebx + 0x28]
xor edx, edx
test esi, esi
je 0x10002ede
mov edi, dword [ebx + 0x2c]
movzx eax, byte [edi + edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x10004190]
inc edx
cmp edx, esi
jb 0x10002ec6
not ecx
cmp ecx, dword [ebx + 0x30]
jne 0x10002f39
lea eax, [ebp - 0x314]
push eax
push 4
push eax
push 0x1e
push 0xffffffffffffffff
mov eax, dword [ebx + 0x154]
call eax
cmp eax, 0xc0000353
jne 0x10002df0
cmp dword [ebp - 0x314], 4
jmp 0x10002dea
mov eax, 1
jmp 0x10002f42
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret