Function at 0x140002fb8
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rax - 0x50], 0xfffffffffffffffe
mov r14, rcx
xor edi, edi
mov dword [rax + 0x20], edi
lea rcx, [rax + 0x20]
call qword [sym.imp.api_ms_win_appmodel_unlock_l1_1_0.dll_IsDeveloperModeEnabled]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14000300d
lea edx, [rdi + 0x28]
mov r9d, ebx
mov rcx, qword [rsp + 0xe8]
call fcn.1400028b8
mov eax, ebx
jmp 0x140003514
cmp dword [rsp + 0x108], edi
jne 0x140003022
mov ebx, 0x80070005
mov edx, 0x2c
jmp 0x140002ff6
mov r15d, 1
mov dword [rsp + 0x78], r15d
lea ebx, [r15 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x78]
lea ecx, [rbx + 4]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x70], r15d
mov r8d, ebx
lea rdx, [rsp + 0x70]
lea esi, [rbx - 2]
mov ecx, esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x68], r15d
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx + 5]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
nop
mov qword [rsp + 0x60], rdi
lea r8, [rsp + 0x60]
lea rdx, str.SystemCurrentControlSetControlDeveloperToolsConfigProviders
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
nop dword [rax + rax]
test eax, eax
je 0x1400030df
lea edx, [rbx + 0x32]
mov r9d, eax
mov rcx, qword [rsp + 0xe8]
call fcn.1400028f4
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003006
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140003006
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0x100], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14000314c
mov edx, 0x3a
jmp 0x1400030ae
mov rbx, rdi
mov qword [rsp + 0x70], rbx
mov edx, dword [rsp + 0x100]
inc edx
mov rax, rsi
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140005490
mov rsi, rax
test rax, rax
je 0x140003194
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r8d, dword [rsp + 0xf8]
mov rcx, qword [0x14000c8a8]
sub rcx, qword [0x14000c898]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jae 0x1400031da
mov edx, r8d
call fcn.140003cfc
mov r8d, dword [rsp + 0xf8]
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0xa8], r15b
mov r14d, edi
test r8d, r8d
je 0x1400033a4
mov r9d, dword [rsp + 0x100]
inc r9d
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegEnumKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400034a1
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000348b
lea rdx, str.Startup
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140003432
lea rdx, str.Shutdown
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r13, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x14000342b
mov rax, r12
call qword [0x140008140]
mov r15d, eax
test eax, eax
js 0x1400033d1
lea rax, [rsp + 0x80]
mov r8, qword [0x14000c8a0]
cmp rax, r8
jae 0x140003357
lea rax, [rsp + 0x80]
mov r9, qword [0x14000c898]
cmp r9, rax
ja 0x140003357
lea rcx, [rsp + 0x80]
sub rcx, r9
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
mov rsi, rdx
sar rsi, 2
mov rax, rsi
shr rax, 0x3f
add rsi, rax
cmp r8, qword [0x14000c8a8]
jne 0x14000332c
call fcn.140003c38
mov r8, qword [0x14000c8a0]
mov r9, qword [0x14000c898]
lea rcx, [rsi + rsi*2]
mov rax, qword [r9 + rcx*8]
mov qword [r8], rax
mov qword [r9 + rcx*8], rdi
mov rax, qword [r9 + rcx*8 + 8]
mov qword [r8 + 8], rax
mov rax, qword [r9 + rcx*8 + 0x10]
mov qword [r8 + 0x10], rax
mov rcx, qword [rsp + 0x80]
jmp 0x14000337a
cmp r8, qword [0x14000c8a8]
jne 0x14000336c
call fcn.140003c38
mov r8, qword [0x14000c8a0]
mov qword [r8], rsi
mov rcx, rdi
mov qword [r8 + 8], r12
mov qword [r8 + 0x10], r13
add qword [0x14000c8a0], 0x18
test rcx, rcx
je 0x140003393
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
inc r14d
cmp r14d, dword [rsp + 0xf8]
jb 0x1400031f6
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400033ca
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
jmp 0x140003514
mov rcx, qword [rsp + 0xe8]
mov r9d, r15d
mov edx, 0x5a
call fcn.1400028b8
nop
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
nop
call fcn.140003530
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003423
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, r15d
jmp 0x140003514
mov edx, 0x55
jmp 0x140003437
mov edx, 0x52
mov rcx, qword [rsp + 0xe8]
call fcn.140002918
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
nop
call fcn.140003530
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003483
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, r14d
jmp 0x140003514
mov rcx, qword [rsp + 0xe8]
mov edx, 0x4f
call fcn.140002918
mov esi, eax
jmp 0x1400034b8
mov rcx, qword [rsp + 0xe8]
mov r9d, eax
mov edx, 0x4b
call fcn.1400028f4
mov esi, eax
call fcn.140003530
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400034e4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
jmp 0x140003514
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret