Function at 0x1401374a0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x2c8
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
lea rcx, [0x14033bd0c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [rsp + 0x30], 0
mov edx, 8
lea rcx, [rsp + 0x298]
call fcn.14000b310
lea rdx, str.SYSTEMControlSet001ControlCIConfig
lea rcx, [rsp + 0xa8]
call fcn.14000ef30
nop
lea r8, [rsp + 0xa8]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x298]
call fcn.14012d670
nop
lea rcx, [rsp + 0xa8]
call fcn.14000ee20
lea rcx, [rsp + 0x298]
call fcn.140069d60
movzx eax, al
test eax, eax
je 0x1401375e1
lea rdx, str.VulnerableDriverBlocklistEnable
lea rcx, [rsp + 0xc8]
call fcn.14000ef30
nop
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x298]
call fcn.14012da50
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xc8]
call fcn.14000ee20
lea rcx, [rsp + 0x2a0]
call fcn.140144a90
movzx eax, al
test eax, eax
je 0x1401375e1
lea rcx, [rsp + 0x2a0]
call fcn.140144ab0
cmp dword [rax], 0
je 0x1401375e1
lea rdx, [0x140346e70]
lea rcx, [rsp + 0xe8]
call fcn.14000ef30
nop
xor r8d, r8d
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x298]
call fcn.14012d930
nop
lea rcx, [rsp + 0xe8]
call fcn.14000ee20
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x298]
call fcn.14012d6e0
mov edx, 8
lea rcx, [rsp + 0x288]
call fcn.14000b310
lea rdx, str.SYSTEMControlSet001ControlDeviceGuard
lea rcx, [rsp + 0x108]
call fcn.14000ef30
nop
lea r8, [rsp + 0x108]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x288]
call fcn.14012d670
nop
lea rcx, [rsp + 0x108]
call fcn.14000ee20
lea rcx, [rsp + 0x288]
call fcn.140069d60
movzx eax, al
test eax, eax
je 0x1401377b1
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rsp + 0x128]
call fcn.14000ef30
nop
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x288]
call fcn.14012da50
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x128]
call fcn.14000ee20
lea rcx, [rsp + 0x2a8]
call fcn.140144a90
movzx eax, al
test eax, eax
je 0x140137704
lea rcx, [rsp + 0x2a8]
call fcn.140144ab0
cmp dword [rax], 0
je 0x140137704
lea rdx, [0x140346fc0]
lea rcx, [rsp + 0x148]
call fcn.14000ef30
nop
xor r8d, r8d
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x288]
call fcn.14012d930
nop
lea rcx, [rsp + 0x148]
call fcn.14000ee20
mov byte [rsp + 0x30], 1
lea rdx, str.RequireMicrosoftSignedBootChain
lea rcx, [rsp + 0x168]
call fcn.14000ef30
nop
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x288]
call fcn.14012da50
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x168]
call fcn.14000ee20
lea rcx, [rsp + 0x2b0]
call fcn.140144a90
movzx eax, al
test eax, eax
je 0x1401377b1
lea rcx, [rsp + 0x2b0]
call fcn.140144ab0
cmp dword [rax], 0
je 0x1401377b1
lea rdx, [0x140346f40]
lea rcx, [rsp + 0x188]
call fcn.14000ef30
nop
xor r8d, r8d
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x288]
call fcn.14012d930
nop
lea rcx, [rsp + 0x188]
call fcn.14000ee20
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x288]
call fcn.14012d6e0
mov edx, 8
lea rcx, [rsp + 0x290]
call fcn.14000b310
lea rdx, str.SYSTEMControlSet001ControlDeviceGuardScenarios
lea rcx, [rsp + 0x1a8]
call fcn.14000ef30
nop
lea r8, [rsp + 0x1a8]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x290]
call fcn.14012d670
nop
lea rcx, [rsp + 0x1a8]
call fcn.14000ee20
lea rcx, [rsp + 0x290]
call fcn.140069d60
movzx eax, al
test eax, eax
je 0x1401378b5
lea rdx, str.HypervisorEnforcedCodeIntegrity
lea rcx, [rsp + 0x1c8]
call fcn.14000ef30
xor r9d, r9d
lea r8, [rsp + 0x1c8]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x290]
call fcn.14012d9d0
mov rcx, rax
call fcn.1400dbde0
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0x1c8]
call fcn.14000ee20
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x1401378b5
lea rdx, [0x140347060]
lea rcx, [rsp + 0x1e8]
call fcn.14000ef30
nop
xor r8d, r8d
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x290]
call fcn.14012d930
nop
lea rcx, [rsp + 0x1e8]
call fcn.14000ee20
lea rcx, [rsp + 0x290]
call fcn.14012d6e0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1401379ee
lea rax, [rsp + 0x208]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x68], rax
lea rdx, str.Gsxnygc_Gsvv_Bocdkbd
mov rcx, qword [rsp + 0x68]
call fcn.14000f350
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.14012e330
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x38], rax
lea rdx, str.Nbsfob_sxcdkvvon
mov rcx, qword [rsp + 0x38]
call fcn.14000f350
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14012e330
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x20], 0
mov r9d, 6
mov r8d, 0xa
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14012df00
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.shutdown__r
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [rsp + 0x32], 0
lea rcx, [rsp + 0x290]
call fcn.14012d6c0
nop
lea rcx, [rsp + 0x288]
call fcn.14012d6c0
nop
lea rcx, [rsp + 0x298]
call fcn.14012d6c0
movzx eax, byte [rsp + 0x32]
jmp 0x140137a21
mov byte [rsp + 0x33], 1
lea rcx, [rsp + 0x290]
call fcn.14012d6c0
nop
lea rcx, [rsp + 0x288]
call fcn.14012d6c0
nop
lea rcx, [rsp + 0x298]
call fcn.14012d6c0
movzx eax, byte [rsp + 0x33]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x2c8
ret