Function at 0x180008bc8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x20], r9b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov r12, qword [rbp + 0x90]
xor r14d, r14d
mov r10, qword [0x1800b2bf8]
mov r15, r8
mov r13, rcx
mov byte [rbp + 0x78], r14b
mov ebx, r14d
or qword [r12], 0xffffffffffffffff
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x18002dabc
sub rax, qword [r10 + 0x9e8]
add rax, r10
mov esi, dword [rdx + 0x18]
test rax, rax
je 0x180008ea2
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x60], xmm0
psrldq xmm0, 8
movq rax, xmm0
test rax, rax
je 0x18002dac4
sub r10, qword [r10 + 0x9e8]
add rax, r10
mov qword [rsp + 0x68], rax
cmp word [rsp + 0x60], r14w
je 0x180008ea2
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
test esi, esi
jns 0x180008e8c
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
cmp byte [rax + 4], 1
je 0x18002dace
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
nop dword [rax + rax]
test eax, eax
js 0x18002db02
lea rax, [rsp + 0x50]
mov dword [rbp - 0x38], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x38]
mov qword [rbp - 0x30], r14
mov edx, 0x80000000
mov dword [rbp - 0x20], 0x40
lea rcx, [rbp - 0x78]
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x18002dad8
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea rbx, [rsp + 0x50]
test edi, edi
js 0x18002db02
test rbx, rbx
je 0x18002db0e
movzx eax, word [rbx]
add eax, 4
movzx edi, word [rsp + 0x60]
mov r14d, esi
add edi, eax
and r14d, 0x10000000
jne 0x18002db18
xor eax, eax
test r15, r15
je 0x180008d4a
bt esi, 0x1d
jb 0x18002db27
mov sil, al
mov rcx, qword gs:[0x60]
add edi, 2
mov r8d, edi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002db38
mov word [rsp + 0x42], di
xor edi, edi
mov word [rsp + 0x40], cx
test rbx, rbx
je 0x180008dd6
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
lea rdx, [0x180085368]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
lea rax, [rsp + 0x50]
cmp rbx, rax
jne 0x180008dd6
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
test r14d, r14d
jne 0x18002db5d
test sil, sil
jne 0x18002db90
lea rax, [rsp + 0x40]
mov r13d, 0x30
lea r8, [rbp - 0x68]
mov r14d, 0xc0
xorps xmm0, xmm0
mov dword [rbp - 0x68], r13d
mov rcx, r12
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x58], rax
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x60], rdi
cmp byte [rbp + 0x88], dil
jne 0x18002dbc2
mov edx, 0x80000000
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
bt esi, 0x1e
jae 0x180008d13
lea rbx, section..rdata
jmp 0x180008d1c
xor eax, eax
jmp 0x180008e70
mov rax, r14
jmp 0x180008c23
mov qword [rsp + 0x68], r14
jmp 0x180008c5a
mov eax, 0xc0000022
jmp 0x180008e70
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
nop
jmp 0x180008d0b
lea rbx, [0x1800805c8]
jmp 0x180008d13
mov eax, 2
jmp 0x180008d22
movzx eax, word [r13 + 0x18]
add eax, 2
add edi, eax
jmp 0x180008d39
movzx eax, word [r15]
mov sil, 1
add eax, 2
add edi, eax
jmp 0x180008d4d
lea rax, [rsp + 0x50]
cmp rbx, rax
jne 0x18002db53
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov eax, 0xc0000017
jmp 0x180008e70
lea rdx, [0x180085368]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
lea rdx, [r13 + 0x18]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
nop
jmp 0x180008df5
lea rdx, [0x180085368]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
nop
jmp 0x180008dfe
lea rax, [rbp + 0x90]
mov esi, 0x2000f
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
mov r15d, 0xc0000034
jmp 0x18002dce2
cmp byte [rbp + 0x78], dil
jne 0x180008e4e
movaps xmm0, xmmword [rsp + 0x40]
movd eax, xmm0
movdqa xmmword [rsp + 0x70], xmm0
psrldq xmm0, 8
movzx ecx, ax
movq rax, xmm0
shr rcx, 1
mov qword [rsp + 0x48], rax
cmp word [rax + rcx*2], 0x5c
je 0x18002dc51
mov rdx, qword [rsp + 0x78]
movzx ecx, word [rsp + 0x70]
mov eax, 0xfffe
add cx, ax
movzx eax, cx
shr rax, 1
mov word [rsp + 0x70], cx
cmp word [rdx + rax*2], 0x5c
jne 0x18002dc37
lea rax, [rsp + 0x70]
mov dword [rbp - 8], r13d
mov qword [rbp + 8], rax
lea r8, [rbp - 8]
lea rax, [rbp - 0x80]
mov qword [rbp], rdi
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, esi
mov dword [rbp + 0x10], r14d
movdqu xmmword [rbp + 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
test eax, eax
js 0x180008e4e
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea rax, [rbp + 0x90]
mov byte [rbp + 0x78], 1
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x68]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, esi
mov qword [rsp + 0x20], rdi
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r15d
je 0x18002dbf8
jmp 0x180008e4e