Function at 0x140098e50
Capabilities:
Access peb ldr_data
Get uefi variable
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x30], r8
test r8, r8
je 0x14009975e
mov qword [rsp + 0x38], rdx
movabs rax, 0xcbf29ce484222325
movabs r13, 0x100000001b3
mov r10, qword [rsp + 0x30]
shr r10, 0x27
and r10d, 0x1ff
mov qword [rsp + 0x40], r9
lea rbx, [r10 + r9]
mov r11d, ebx
shr r11d, 0x10
mov edx, ebx
shr edx, 0x18
mov rdi, rbx
shr rdi, 0x20
mov rsi, rbx
shr rsi, 0x28
mov rbp, rbx
shr rbp, 0x30
mov r14, rbx
shr r14, 0x38
movzx r9d, bl
mov r8, r9
xor r8, rax
imul r8, r13
movzx eax, bh
xor r8, rax
imul r8, r13
movzx r11d, r11b
xor r8, r11
imul r8, r13
xor r8, rdx
imul r8, r13
movzx edi, dil
xor r8, rdi
imul r8, r13
movzx r12d, sil
xor r8, r12
imul r8, r13
movzx r15d, bpl
xor r8, r15
imul r8, r13
xor r8, r14
imul r8, r13
and r8, qword [rcx + 0xa0]
mov r14, qword [rcx + 0x78]
mov qword [rsp + 0x28], rcx
mov rsi, qword [rcx + 0x88]
mov rbp, r8
shl rbp, 4
mov rbp, qword [rsi + rbp + 8]
cmp rbp, r14
je 0x140098fd1
movabs r13, 0xff00000000000000
and r13, rbx
shl r15, 0x30
or r15, r13
shl r12, 0x28
or r12, r15
shl rdi, 0x20
or rdi, r12
shl rdx, 0x18
or rdx, rdi
shl r11, 0x10
or r11, rdx
shl rax, 8
or rax, r11
or rax, r9
cmp rax, qword [rbp + 0x10]
je 0x140098faf
add r8, r8
mov rdx, qword [rsi + r8*8]
nop
cmp rbp, rdx
je 0x140098fd1
mov rbp, qword [rbp + 8]
cmp rax, qword [rbp + 0x10]
jne 0x140098fa0
cmp rbp, r14
je 0x140098fd1
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x140098fd1
mov r12, qword [rsp + 0x38]
mov qword [r12 + 8], rdx
mov rbp, qword [rsp + 0x28]
jmp 0x140099129
mov rax, qword [rsp + 0x40]
lea rax, [rax + r10*8]
mov r12, qword [rsp + 0x38]
mov qword [r12], rax
mov qword [rsp + 0x48], 0
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x38]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 8
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rsi, qword gs:[0x30]
lea rax, [rsp + 0x58]
mov qword [rsi + 0x870], rax
mov qword [rsi + 0x858], 0xdead
mov qword [rsi + 0x860], 0x8461028
mov qword [rsi + 0x5b8], rcx
lea rdx, str.SecureBoot
lea r14, [rsp + 0x90]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8f], 0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x8f]
lea r9, [rsp + 0x88]
mov rcx, r14
mov rdx, rbp
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rsi + 0x5b8]
mov qword [rbp + 0x270], rax
mov qword [rsi + 0x870], 0
mov qword [rsi + 0x5b8], 0
mov rax, qword [rsp + 0x48]
mov qword [r12 + 8], rax
test rax, rax
je 0x14009975e
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x90], rbx
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x90]
call fcn.14009a870
mov rax, qword [rsp + 0x58]
mov rcx, qword [r12 + 8]
mov qword [rax + 0x18], rcx
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x14009975e
movabs r13, 0x8a97b0004e7feab
movabs rcx, 0xfffffffff000
mov rax, rdx
and rax, rcx
mov rbx, qword [rsp + 0x30]
shr rbx, 0x1e
movzx r9d, bl
and ebx, 0x1ff
lea ecx, [rbx + rax]
mov r11d, edx
shr r11d, 0x10
mov r10d, edx
shr r10d, 0x18
mov rsi, rdx
shr rsi, 0x20
shr rdx, 0x28
mov r8, r9
movabs rdi, 0xcbf29ce484222325
xor r8, rdi
movabs r15, 0x100000001b3
imul r8, r15
movzx ecx, ch
xor r8, rcx
imul r8, r15
movzx edi, r11b
xor r8, rdi
imul r8, r15
xor r8, r10
imul r8, r15
movzx r14d, sil
xor r8, r14
imul r8, r15
movzx r15d, dl
xor r8, r15
imul r8, r13
and r8, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xb8]
mov rsi, qword [rbp + 0xc8]
mov r11, r8
shl r11, 4
mov r11, qword [rsi + r11 + 8]
cmp r11, rdx
je 0x140099256
shl r15, 0x28
shl r14, 0x20
or r14, r15
shl r10, 0x18
or r10, r14
shl rdi, 0x10
or rdi, r10
shl rcx, 8
or rcx, rdi
or rcx, r9
cmp rcx, qword [r11 + 0x10]
je 0x14009922f
add r8, r8
mov r8, qword [rsi + r8*8]
nop dword [rax + rax]
cmp r11, r8
je 0x140099256
mov r11, qword [r11 + 8]
cmp rcx, qword [r11 + 0x10]
jne 0x140099220
cmp r11, rdx
je 0x140099256
mov rdx, qword [r11 + 0x18]
test rdx, rdx
je 0x140099256
mov qword [r12 + 0x18], rdx
mov r15, qword [rsp + 0x28]
movabs r13, 0xfffffffff000
jmp 0x1400993bd
lea rax, [rax + rbx*8]
mov qword [r12 + 0x10], rax
mov qword [rsp + 0x48], 0
mov r15, qword [rsp + 0x28]
mov rcx, qword [r15 + 0x38]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 8
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rsi, qword gs:[0x30]
lea rax, [rsp + 0x58]
mov qword [rsi + 0x870], rax
mov qword [rsi + 0x858], 0xdead
mov qword [rsi + 0x860], 0x8461028
mov qword [rsi + 0x5b8], rcx
lea rdx, str.SecureBoot
lea r14, [rsp + 0x90]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8f], 0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x8f]
lea r9, [rsp + 0x88]
mov rcx, r14
mov rdx, r15
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rsi + 0x5b8]
mov qword [r15 + 0x270], rax
mov qword [rsi + 0x870], 0
mov qword [rsi + 0x5b8], 0
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x18], rax
test rax, rax
je 0x14009975e
lea rcx, [r15 + 0xb0]
mov rax, qword [r12 + 8]
movabs r13, 0xfffffffff000
and rax, r13
or rax, rbx
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x90]
call fcn.14009a870
mov rax, qword [rsp + 0x58]
mov rcx, qword [r12 + 0x18]
mov qword [rax + 0x18], rcx
mov rdx, qword [r12 + 0x18]
test rdx, rdx
je 0x14009975e
mov rax, rdx
and rax, r13
mov rbx, qword [rsp + 0x30]
shr rbx, 0x15
movzx r8d, bl
and ebx, 0x1ff
mov ecx, ebx
or ecx, eax
shr ecx, 8
mov r10d, edx
shr r10d, 0x10
mov r9d, edx
shr r9d, 0x18
mov rsi, rdx
shr rsi, 0x20
shr rdx, 0x28
movabs rbp, 0xcbf29ce484222325
xor rbp, r8
movabs r14, 0x100000001b3
imul rbp, r14
and ecx, 0xf1
xor rbp, rcx
imul rbp, r14
movzx r11d, r10b
xor rbp, r11
imul rbp, r14
xor rbp, r9
imul rbp, r14
movzx edi, sil
xor rbp, rdi
imul rbp, r14
movzx r14d, dl
xor rbp, r14
movabs rdx, 0x8a97b0004e7feab
imul rbp, rdx
and rbp, qword [r15 + 0x120]
mov rdx, qword [r15 + 0xf8]
mov rsi, qword [r15 + 0x108]
mov qword [rsp + 0x28], rbp
mov r10, rbp
shl r10, 4
mov r10, qword [rsi + r10 + 8]
cmp r10, rdx
je 0x1400994d7
shl r14, 0x28
shl rdi, 0x20
or rdi, r14
shl r9, 0x18
or r9, rdi
shl r11, 0x10
or r11, r9
shl rcx, 8
or rcx, r11
or rcx, r8
cmp rcx, qword [r10 + 0x10]
je 0x1400994bf
mov r8, qword [rsp + 0x28]
add r8, r8
mov r8, qword [rsi + r8*8]
cmp r10, r8
je 0x1400994d7
mov r10, qword [r10 + 8]
cmp rcx, qword [r10 + 0x10]
jne 0x1400994b0
cmp r10, rdx
je 0x1400994d7
mov rcx, qword [r10 + 0x18]
test rcx, rcx
je 0x1400994d7
mov qword [r12 + 0x28], rcx
jmp 0x14009962f
lea rax, [rax + rbx*8]
mov qword [r12 + 0x20], rax
mov qword [rsp + 0x48], 0
mov rcx, qword [r15 + 0x38]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 8
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rsi, qword gs:[0x30]
lea rax, [rsp + 0x58]
mov qword [rsi + 0x870], rax
mov qword [rsi + 0x858], 0xdead
mov qword [rsi + 0x860], 0x8461028
mov qword [rsi + 0x5b8], rcx
lea rdx, str.SecureBoot
lea r14, [rsp + 0x90]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8f], 0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x8f]
lea r9, [rsp + 0x88]
mov rcx, r14
mov rdx, r15
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rsi + 0x5b8]
mov qword [r15 + 0x270], rax
mov qword [rsi + 0x870], 0
mov qword [rsi + 0x5b8], 0
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x28], rax
test rax, rax
je 0x14009975e
lea rcx, [r15 + 0xf0]
mov rax, qword [r12 + 0x18]
and rax, r13
or rax, rbx
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x90]
call fcn.14009a870
mov rax, qword [rsp + 0x58]
mov rcx, qword [r12 + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14009975e
and rcx, r13
mov rax, qword [rsp + 0x30]
shr eax, 0xc
and eax, 0x1ff
lea rax, [rcx + rax*8]
mov qword [r12 + 0x30], rax
mov qword [rsp + 0x48], 0
mov rcx, qword [r15 + 0x38]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 8
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rsi, qword gs:[0x30]
lea rax, [rsp + 0x58]
mov qword [rsi + 0x870], rax
mov qword [rsi + 0x858], 0xdead
mov qword [rsi + 0x860], 0x8461028
mov qword [rsi + 0x5b8], rcx
lea rdx, str.SecureBoot
lea r14, [rsp + 0x90]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x8f], 0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x8f]
lea r9, [rsp + 0x88]
mov rcx, r14
mov rdx, r15
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rsi + 0x5b8]
mov qword [r15 + 0x270], rax
mov qword [rsi + 0x870], 0
mov qword [rsi + 0x5b8], 0
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x38], rax
test rax, rax
je 0x14009975e
and rax, r13
mov rsi, qword [rsp + 0x30]
and esi, 0xfff
or rsi, rax
jmp 0x140099760
xor esi, esi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a1e40
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret