Function at 0x180015380
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rsi, rcx
xor edi, edi
mov rax, qword gs:[0x60]
lea r14, [0x1801f3830]
cmp byte [rax + 2], dil
jne 0x1800153e3
test byte [rax + 0x68], 0x70
jne 0x1800153e3
mov ecx, 0xdeadbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180010db0
test eax, eax
jne 0x1800153e3
mov byte [0x180233238], 1
jmp 0x18001552a
movdqa xmm0, xmmword [0x1801fea80]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], dil
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x180015402
lea rdx, [rsp + 0x31]
lea rcx, [0x1802332d8]
call fcn.1800346f0
lea rdx, [0x18022c240]
mov rcx, rsi
call fcn.18000f360
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015525
nop word [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x180015487
cmp cx, 0x7f
ja 0x18001548c
mov byte [rsp + rax + 0x70], cl
inc rax
cmp rax, 0x80
jb 0x180015467
jmp 0x18001548c
mov byte [rsp + rax + 0x70], dil
movzx ecx, byte [rsp + 0x70]
test cl, cl
je 0x1800154bc
lea rax, [rsp + 0x70]
nop word [rax + rax]
cmp cl, 0x41
jl 0x1800154b2
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x1800154b2
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x1800154a0
lea r9, [rsp + 0x70]
mov r8d, 0xffffffff
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x1800154d3
test eax, eax
je 0x180015519
mov r10d, eax
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x1800154f0
not r8d
cmp r8d, 0xeff98489
je 0x180015597
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015460
mov rax, rdi
call rax
call fcn.18000ff30
call fcn.1800101b0
test al, al
jne 0x180015644
mov rax, qword [0x180232fe8]
cmp byte [rax + 2], dil
jne 0x180015644
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015638
nop word [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x18001559d
cmp cx, 0x7f
ja 0x1800155a2
mov byte [rbp + rax - 0x10], cl
inc rax
cmp rax, 0x80
jb 0x180015577
jmp 0x1800155a2
mov rax, qword [r11 + 0x20]
jmp 0x180015528
mov byte [rbp + rax - 0x10], dil
movzx ecx, byte [rbp - 0x10]
test cl, cl
je 0x1800155cc
lea rax, [rbp - 0x10]
nop
cmp cl, 0x41
jl 0x1800155c2
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x1800155c2
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x1800155b0
lea r9, [rbp - 0x10]
mov r8d, 0xffffffff
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x1800155e1
test eax, eax
je 0x18001561a
mov r10d, eax
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x1800155f1
not r8d
cmp r8d, 0xc08079c
je 0x180015632
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015570
mov byte [0x180233238], 1
jmp 0x1800158fe
cmp qword [r11 + 0x20], rdi
jne 0x180015644
mov byte [0x180233238], 1
jmp 0x1800158fe
movdqa xmm0, xmmword [0x1801fea90]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], dil
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x180015663
lea rdx, [rsp + 0x31]
lea rcx, [0x1802332d8]
call fcn.1800346f0
lea rdx, [0x18022c240]
mov rcx, rsi
call fcn.18000f360
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015779
nop word [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x1800156e7
cmp cx, 0x7f
ja 0x1800156ec
mov byte [rbp + rax + 0x70], cl
inc rax
cmp rax, 0x80
jb 0x1800156c7
jmp 0x1800156ec
mov byte [rbp + rax + 0x70], dil
movzx ecx, byte [rbp + 0x70]
test cl, cl
je 0x180015714
lea rax, [rbp + 0x70]
cmp cl, 0x41
jl 0x18001570a
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x18001570a
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x1800156f8
lea r9, [rbp + 0x70]
mov r8d, 0xffffffff
lea rcx, [rbp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x180015730
test eax, eax
je 0x18001576d
mov r10d, eax
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x180015740
not r8d
cmp r8d, 0xeff98489
je 0x18001584a
mov r11, qword [r11]
cmp r11, rbx
jne 0x1800156c0
mov rax, rdi
call rax
cmp byte [0x180233238], dil
jne 0x1800158fe
movdqa xmm0, xmmword [0x1801fea30]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1801fe840]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x6b6365
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1800157c0
lea rdx, [rsp + 0x31]
lea rcx, [0x1802332d8]
call fcn.1800346f0
lea rdx, [0x18022c240]
mov rcx, rsi
call fcn.18000f360
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x1800158f9
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x180015853
cmp cx, 0x7f
ja 0x18001585b
mov byte [rbp + rax + 0xf0], cl
inc rax
cmp rax, 0x80
jb 0x180015827
jmp 0x18001585b
mov rax, qword [r11 + 0x20]
jmp 0x18001577c
mov byte [rbp + rax + 0xf0], dil
movzx ecx, byte [rbp + 0xf0]
test cl, cl
je 0x18001588c
lea rax, [rbp + 0xf0]
nop dword [rax]
cmp cl, 0x41
jl 0x180015882
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x180015882
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x180015870
lea r9, [rbp + 0xf0]
mov r8d, 0xffffffff
lea rcx, [rbp + 0xf0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x1800158a7
test eax, eax
je 0x1800158ed
mov r10d, eax
nop word [rax + rax]
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x1800158c0
not r8d
cmp r8d, 0xeff98489
je 0x180015a2a
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015820
mov rax, rdi
call rax
mov ecx, 0x88
call fcn.1800c1910
mov rbx, rax
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x320], rax
lea rdx, [0x18022c240]
mov rcx, rax
call fcn.180031c50
nop
lea rcx, [rbx + 0x20]
lea rdx, [0x18022c260]
call fcn.180031c50
nop
lea rcx, [rbx + 0x40]
lea rdx, [0x18022c280]
call fcn.180031c50
nop
lea rcx, [rbx + 0x60]
mov rdx, rsi
call fcn.180031c50
nop
lea rax, [0x1800114b0]
mov qword [rbx + 0x80], rax
mov qword [rbp + 0x318], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x180046e50]
xor edx, edx
xor ecx, ecx
call fcn.1800ce3ac
mov qword [rsp + 0x60], rax
test rax, rax
je 0x180015da0
cmp dword [rsp + 0x68], 0
je 0x180015d95
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.1800bd4a8
test eax, eax
jne 0x180015d95
mov rcx, rsi
call fcn.180012700
test al, al
je 0x180015ade
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015ad9
nop
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x180015a33
cmp cx, 0x7f
ja 0x180015a3b
mov byte [rbp + rax + 0x170], cl
inc rax
cmp rax, 0x80
jb 0x180015a07
jmp 0x180015a3b
mov rax, qword [r11 + 0x20]
jmp 0x1800158fc
mov byte [rbp + rax + 0x170], 0
movzx ecx, byte [rbp + 0x170]
test cl, cl
je 0x180015a6c
lea rax, [rbp + 0x170]
nop dword [rax]
cmp cl, 0x41
jl 0x180015a62
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x180015a62
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x180015a50
lea r9, [rbp + 0x170]
mov r8d, 0xffffffff
lea rcx, [rbp + 0x170]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180015a87
test eax, eax
je 0x180015acd
mov r10d, eax
nop word [rax + rax]
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x180015aa0
not r8d
cmp r8d, 0xeff98489
je 0x180015baa
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015a00
mov rax, rdi
call rax
call fcn.180011e20
test al, al
je 0x180015c5e
movdqa xmm0, xmmword [0x1801fe9e0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6162706f
mov word [rsp + 0x44], 0x6b63
mov byte [rsp + 0x46], 0
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180015b20
lea rdx, [rsp + 0x31]
lea rcx, [0x1802332d8]
call fcn.1800346f0
lea rdx, [0x18022c240]
mov rcx, rsi
call fcn.18000f360
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015c59
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x180015bb3
cmp cx, 0x7f
ja 0x180015bbb
mov byte [rbp + rax + 0x1f0], cl
inc rax
cmp rax, 0x80
jb 0x180015b87
jmp 0x180015bbb
mov rax, qword [r11 + 0x20]
jmp 0x180015adc
mov byte [rbp + rax + 0x1f0], 0
movzx ecx, byte [rbp + 0x1f0]
test cl, cl
je 0x180015bec
lea rax, [rbp + 0x1f0]
nop dword [rax]
cmp cl, 0x41
jl 0x180015be2
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x180015be2
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x180015bd0
lea r9, [rbp + 0x1f0]
mov r8d, 0xffffffff
lea rcx, [rbp + 0x1f0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180015c07
test eax, eax
je 0x180015c4d
mov r10d, eax
nop word [rax + rax]
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x180015c20
not r8d
cmp r8d, 0xeff98489
je 0x180015cca
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015b80
mov rax, rdi
call rax
mov rcx, rsi
call fcn.180010950
test al, al
je 0x180015d7d
mov rcx, qword [0x180233058]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180015d7b
nop dword [rax + rax]
mov rdx, qword [r11 + 0x50]
mov rax, rdi
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x180015cd0
cmp cx, 0x7f
ja 0x180015cd8
mov byte [rbp + rax + 0x270], cl
inc rax
cmp rax, 0x80
jb 0x180015ca7
jmp 0x180015cd8
mov rax, qword [r11 + 0x20]
jmp 0x180015c5c
mov byte [rbp + rax + 0x270], 0
movzx ecx, byte [rbp + 0x270]
test cl, cl
je 0x180015d0c
lea rax, [rbp + 0x270]
nop word [rax + rax]
cmp cl, 0x41
jl 0x180015d02
movzx ecx, byte [rax]
cmp cl, 0x5a
jg 0x180015d02
add cl, 0x20
mov byte [rax], cl
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x180015cf0
lea r9, [rbp + 0x270]
mov r8d, 0xffffffff
lea rcx, [rbp + 0x270]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180015d27
test eax, eax
je 0x180015d69
mov r10d, eax
nop word [rax + rax]
movzx edx, r8b
movsx ecx, byte [r9]
xor rdx, rcx
shr r8d, 8
xor r8d, dword [r14 + rdx*4]
lea r9, [r9 + 1]
sub r10, 1
jne 0x180015d40
not r8d
cmp r8d, 0xeff98489
je 0x180015d77
mov r11, qword [r11]
cmp r11, rbx
jne 0x180015ca0
jmp 0x180015d7b
mov rdi, qword [r11 + 0x20]
call rdi
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 1
call fcn.1800bc428
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.1800bc428
int3