Function at 0x14007dc30
Capabilities:
Disable device guard features via registry on windows
Disable system features via registry on windows
Execute command
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, [0x1401b10a0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r15b, r15b
xor r12d, r12d
mov qword [rbp + 0x17], r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
lea r8d, [r12 + 0x26]
lea rdx, str.SYSTEMControlSet001ControlCIConfig
lea rcx, [rbp - 0x49]
call fcn.140008450
nop
lea r8, [rbp - 0x49]
lea rcx, [rbp + 0x17]
call fcn.1400737d0
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007dcf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dcf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007dcf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov r13d, 0x80000000
mov rsi, qword [rbp + 0x17]
test rsi, rsi
je 0x14007dec5
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov r8d, Ordinal_32
lea rdx, str.VulnerableDriverBlocklistEnable
lea rcx, [rbp - 0x21]
call fcn.140008450
mov dword [rbp + 0xf], r12d
mov dword [rbp + 7], 4
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae r8, qword [rbp - 0x21]
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test eax, eax
je 0x14007dd88
xor bl, bl
jmp 0x14007dd8d
mov edi, dword [rbp + 0xf]
mov bl, 1
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14007ddd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ddcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007ddcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
cmp bl, 1
jne 0x14007de90
test edi, edi
je 0x14007de90
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r12w
mov r8d, Ordinal_32
lea rdx, str.VulnerableDriverBlocklistEnable
lea rcx, [rbp - 0x21]
call fcn.140008450
nop
mov dword [rbp + 7], r12d
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14007e5f1
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14007de8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007de88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007de88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov r15b, 1
lea rax, [rsi + r13]
cmp rax, 5
jbe 0x14007debe
cmp rsi, 0xffffffff80000007
je 0x14007debe
cmp rsi, 0xffffffff80000060
je 0x14007debe
cmp rsi, 0xffffffff80000050
je 0x14007debe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r12w
mov r8d, Ordinal_41
lea rdx, str.SYSTEMControlSet001ControlDeviceGuard
lea rcx, [rbp - 0x21]
call fcn.140008450
nop
lea r8, [rbp - 0x21]
lea rcx, [rbp + 0x1f]
call fcn.1400737d0
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14007df46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007df41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007df41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r12w
mov rdi, qword [rbp + 0x1f]
test rdi, rdi
je 0x14007e28d
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x49]
call fcn.140008450
mov dword [rbp + 0xf], r12d
mov dword [rbp + 7], 4
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r14d, eax
test eax, eax
je 0x14007dfd4
xor bl, bl
jmp 0x14007dfda
mov r14d, dword [rbp + 0xf]
mov bl, 1
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007e01d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e018
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e018
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
cmp bl, 1
jne 0x14007e0de
test r14d, r14d
je 0x14007e0de
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x49]
call fcn.140008450
nop
mov dword [rbp + 7], r12d
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, qword [rbp - 0x49]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14007e614
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007e0db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e0d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e0d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov r15b, 1
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov r8d, Ordinal_32
lea rdx, str.RequireMicrosoftSignedBootChain
lea rcx, [rbp - 0x49]
call fcn.140008450
mov dword [rbp + 0xf], r12d
mov dword [rbp + 7], 4
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r14d, eax
test eax, eax
je 0x14007e14e
xor bl, bl
jmp 0x14007e154
mov r14d, dword [rbp + 0xf]
mov bl, 1
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007e197
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e192
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e192
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
cmp bl, 1
jne 0x14007e258
test r14d, r14d
je 0x14007e258
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov r8d, Ordinal_32
lea rdx, str.RequireMicrosoftSignedBootChain
lea rcx, [rbp - 0x49]
call fcn.140008450
nop
mov dword [rbp + 7], r12d
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, qword [rbp - 0x49]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14007e637
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007e255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e250
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov r15b, 1
lea rax, [rdi + r13]
cmp rax, 5
jbe 0x14007e286
cmp rdi, 0xffffffff80000007
je 0x14007e286
cmp rdi, 0xffffffff80000060
je 0x14007e286
cmp rdi, 0xffffffff80000050
je 0x14007e286
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0xf], r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.SYSTEMControlSet001ControlDeviceGuardScenarios
lea rcx, [rbp - 0x49]
call fcn.140008450
nop
lea r8, [rbp - 0x49]
lea rcx, [rbp + 0xf]
call fcn.1400737d0
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14007e30e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e309
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov rbx, qword [rbp + 0xf]
test rbx, rbx
je 0x14007e4ba
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov r8d, Ordinal_32
lea rdx, str.HypervisorEnforcedCodeIntegrity
lea rcx, [rbp - 0x21]
call fcn.140008450
mov dword [rbp + 7], r12d
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r14b
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14007e3d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e3cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e3cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
test r14b, r14b
je 0x14007e485
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r12w
mov r8d, Ordinal_32
lea rdx, str.HypervisorEnforcedCodeIntegrity
lea rcx, [rbp - 0x21]
call fcn.140008450
nop
mov dword [rbp + 7], r12d
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14007e5ce
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14007e485
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e480
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
lea rax, [rbx + r13]
cmp rax, 5
jbe 0x14007e4b3
cmp rbx, 0xffffffff80000007
je 0x14007e4b3
cmp rbx, 0xffffffff80000060
je 0x14007e4b3
cmp rbx, 0xffffffff80000050
je 0x14007e4b3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rbp + 0xf], rbx
test r15b, r15b
je 0x14007e4ff
lea rdx, str.Settings_have_been_prepared_and_will_be_restarted_after_10_seconds
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140084010
lea rdx, [0x1400841e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.shutdown__r
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r14b, r14b
jmp 0x14007e502
mov r14b, 1
test rbx, rbx
je 0x14007e536
lea rax, [rbx + r13]
cmp rax, 5
jbe 0x14007e536
cmp rbx, 0xffffffff80000007
je 0x14007e536
cmp rbx, 0xffffffff80000060
je 0x14007e536
cmp rbx, 0xffffffff80000050
je 0x14007e536
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rdi, rdi
je 0x14007e56a
lea rax, [rdi + r13]
cmp rax, 5
jbe 0x14007e56a
cmp rdi, 0xffffffff80000007
je 0x14007e56a
cmp rdi, 0xffffffff80000060
je 0x14007e56a
cmp rdi, 0xffffffff80000050
je 0x14007e56a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rsi, rsi
je 0x14007e59d
lea rax, [rsi + r13]
cmp rax, 5
jbe 0x14007e59d
cmp rsi, 0xffffffff80000007
je 0x14007e59d
cmp rsi, 0xffffffff80000060
je 0x14007e59d
cmp rsi, 0xffffffff80000050
je 0x14007e59d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, r14b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14012e570
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x49]
call fcn.140073910
lea rdx, [0x1401c7b20]
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x49]
call fcn.140073910
lea rdx, [0x1401c7b20]
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x21]
call fcn.140073910
lea rdx, [0x1401c7b20]
lea rcx, [rbp - 0x21]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x21]
call fcn.140073910
lea rdx, [0x1401c7b20]
lea rcx, [rbp - 0x21]
call sub.VCRUNTIME140.dll__CxxThrowException
int3