Function at 0x140098030
Capabilities:
Get uefi variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
vmovaps xmmword [rsp + 0xb0], xmm6
mov dword [rsp + 0x28], edx
mov rsi, rcx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rcx + 0x50]
mov qword [rsp + 0x30], 0
mov rcx, qword [rcx + 0x38]
lea r14, [rsp + 0x30]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x80], rdi
mov rbx, qword gs:[0x30]
lea r12, [rsp + 0x60]
mov qword [rbx + 0x870], r12
mov qword [rbx + 0x858], 0xdead
mov qword [rbx + 0x860], 0x8461028
mov qword [rbx + 0x5b8], rcx
lea rdx, str.SecureBoot
lea r15, [rsp + 0x98]
mov rcx, r15
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8c], 0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x90], 0
lea r13, [rsp + 0x90]
mov qword [rsp + 0x20], r13
lea rax, [rsp + 0x8c]
lea rbp, [rsp + 0x58]
mov rcx, r15
mov r15, rax
mov rdx, rsi
mov r8, rax
mov r9, rbp
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rbx + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [rbx + 0x870], 0
mov qword [rbx + 0x5b8], 0
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140098461
add rax, 0x448
vxorps xmm6, xmm6, xmm6
vmovaps xmmword [rsp + 0x40], xmm6
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0x10
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x80], r14
mov rdi, qword gs:[0x30]
mov qword [rdi + 0x870], r12
mov qword [rdi + 0x858], 0xdead
mov qword [rdi + 0x860], 0x8461028
mov qword [rdi + 0x5b8], rcx
lea rdx, str.SecureBoot
lea rbx, [rsp + 0x98]
mov rcx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8c], 0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov rdx, rsi
mov r8, r15
mov r9, rbp
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rdi + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [rdi + 0x870], 0
mov qword [rdi + 0x5b8], 0
mov eax, dword [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov r12, rbp
nop word [rax + rax]
mov r13, qword [rsp + 0x40]
mov rbx, r13
add rbx, 0xfffffffffffffbb8
je 0x140098260
lea rax, [r13 - 8]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
mov r14, qword gs:[0x30]
lea rbp, [rsp + 0x60]
mov qword [r14 + 0x870], rbp
mov qword [r14 + 0x858], 0xdead
mov qword [r14 + 0x860], 0x8461028
mov qword [r14 + 0x5b8], rcx
lea rbp, [rsp + 0x98]
mov rcx, rbp
lea rdx, str.SecureBoot
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x97], 0
mov dword [rsp + 0x90], 1
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x20], r15
mov rcx, rbp
mov rdx, rsi
lea r8, [rsp + 0x97]
lea rdi, [rsp + 0x90]
mov r9, rdi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [r14 + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [r14 + 0x870], 0
mov qword [r14 + 0x5b8], 0
mov r14, qword [rsp + 0x58]
vmovaps xmmword [rsp + 0x30], xmm6
mov rax, qword [rsi + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0x10
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x80], r12
mov r13, qword gs:[0x30]
lea rcx, [rsp + 0x60]
mov qword [r13 + 0x870], rcx
mov qword [r13 + 0x858], 0xdead
mov qword [r13 + 0x860], 0x8461028
mov qword [r13 + 0x5b8], rax
mov rcx, rbp
lea rdx, str.SecureBoot
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x97], 0
mov dword [rsp + 0x90], 1
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x20], r15
mov rcx, rbp
mov rdx, rsi
lea r8, [rsp + 0x97]
mov r9, rdi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [r13 + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [r13 + 0x870], 0
mov qword [r13 + 0x5b8], 0
vmovaps xmm0, xmmword [rsp + 0x30]
vmovaps xmmword [rsp + 0x40], xmm0
cmp r14, qword [rsp + 0x28]
je 0x140098463
test r14, 0xfffffffffffffffb
jne 0x140098260
xor ebx, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400a1e40
mov rax, rbx
vmovaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret