Function at 0x140002be0
Capabilities:
Check for peb beingdebugged flag
Encrypt data using rc4 prga

Disassembly:
mov qword ss:[rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword gs:[0x30]
mov r9d, 0
mov rbx, rcx
mov qword [rbp - 0x30], r8
mov r15d, edx
mov dword [rbp - 0x20], 0xc9854800
mov word [rbp - 0x1c], 0x8948
mov rsi, r8
mov rcx, qword [rax + 0x60]
lea r14d, [r9 + 2]
mov byte [rbp - 0x1a], 0x35
mov r12d, r9d
mov dword [rbp - 0x18], 0x58948
mov dword [rbp - 0x14], 0x8b4c00e8
mov rax, qword [rcx + 0xf0]
mov dword [rbp - 0x10], 0x8b4c0045
mov word [rbp - 0xc], 0x2484
mov dword [rbp - 0x28], 0x8000b9
mov rcx, qword [rax + 8]
mov qword [0x14002bb10], rcx
mov byte [rbp - 0x24], r9b
add r15d, 0xffffff00
je 0x140002df5
mov r13b, byte [rbp - 0x20]
add rbx, 0xb
mov sil, byte [rbp - 0x16]
nop dword [rax]
test r14d, r14d
je 0x140002df1
mov eax, dword [rbp - 0x20]
lea rdi, [rbx - 0xb]
cmp eax, dword [rdi]
jne 0x140002d8f
nop dword [rax + rax]
cmp r13b, byte [rbx - 0xc]
je 0x140002d8f
cmp r13b, byte [rbx - 0xd]
je 0x140002d8f
movzx eax, word ds:[rbp - 0x1c]
cmp ax, word [rbx - 0x11]
jne 0x140002d8f
mov al, byte [rbp - 0x1a]
cmp al, byte [rbx - 0xf]
jne 0x140002d8f
cmp qword [0x14002bb10], r9
jne 0x140002d71
mov ecx, r9d
mov r8, r9
movsxd rax, ecx
mov rdx, rdi
sub rdx, rax
mov eax, dword [rbp - 0x28]
cmp eax, dword [rdx]
jne 0x140002d1d
mov al, byte [rbp - 0x24]
cmp al, byte [rdx + 4]
je 0x140002d2c
inc ecx
inc r8
cmp ecx, 0x80
jle 0x140002d05
jmp 0x140002d71
mov rdx, rdi
mov ecx, r9d
sub rdx, r8
mov r8, r9
movzx r9d, word [rbp - 0x18]
add rdx, 5
movsxd rax, ecx
cmp r9w, word [rax + rdx]
jne 0x140002d52
cmp sil, byte [rax + rdx + 2]
je 0x140002d5e
inc ecx
inc r8
cmp ecx, 0x40
jle 0x140002d41
jmp 0x140002d71
lea rcx, [rdx + r8]
mov eax, dword [rcx + 3]
mov rcx, qword [rax + rcx + 7]
mov qword [0x14002bb10], rcx
mov eax, dword [rbx - 0xe]
lea rcx, str.___CsrPortHandle:_0x_p_n
mov rdx, qword [rax + rdi + 1]
mov qword [0x14002bb18], rdx
call fcn.140001ae0
dec r14d
movzx eax, word [rbp - 0x18]
cmp ax, word [rdi]
jne 0x140002ddc
cmp sil, byte [rdi + 2]
jne 0x140002ddc
movzx eax, word [rbp - 0x15]
cmp ax, word [rbx - 5]
jne 0x140002ddc
mov eax, dword [rbp - 0x13]
cmp eax, dword [rbx]
je 0x140002dbe
mov eax, dword [rbp - 0xf]
cmp eax, dword [rbx]
jne 0x140002ddc
mov al, byte [rbp - 0xb]
cmp al, byte [rbx + 4]
jne 0x140002ddc
mov eax, dword [rbx - 8]
lea rcx, str.___CsrPortMemoryRemoteDelta:_0x_p_n
mov rdx, qword [rax + rbx - 4]
mov qword [0x14002bb20], rdx
call fcn.140001ae0
dec r14d
inc r12d
inc rbx
mov r9d, 0
cmp r12d, r15d
jb 0x140002c99
mov rsi, qword [rbp - 0x30]
mov eax, 0x1db1
cmp word [0x14002bb28], ax
jbe 0x140002e74
test rsi, rsi
je 0x140002e74
lea rdx, str.FreeConsole
mov rcx, rsi
mov r11, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lfence
call r11
mov word [rbp - 0x28], 0x8d48
mov r9b, 0xd
movzx r8d, word [rbp - 0x28]
mov rcx, rax
mov rdx, rax
cmp byte [rdx + 7], 0xe8
jne 0x140002e46
cmp r8w, word [rdx]
jne 0x140002e46
nop
cmp r9b, byte [rdx + 2]
je 0x140002e59
inc rdx
mov rax, rdx
sub rax, rcx
cmp rax, 0x100
jl 0x140002e33
jmp 0x140002e74
mov eax, dword [rdx + 3]
lea rcx, str.___ConhostConsoleHandle:_0x_p_n
mov rdx, qword [rax + rdx + 0x17]
mov qword [0x14002bb30], rdx
call fcn.140001ae0
mov rdx, qword [0x14002bb10]
lea rcx, str.___CsrPortHeap:_0x_p_n
call fcn.140001ae0
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003550
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop r11
lfence
jmp r11