Function at 0x14004893c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x1400f9a00]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, [0x1400ce044]
push rdx
call fcn.14013d032
xor ebx, ebx
mov r13b, bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
lea r8d, [rbx + 0x26]
lea rdx, str.SYSTEMControlSet001ControlCIConfig
lea rcx, [rbp - 0x59]
call fcn.140040268
nop
mov qword [rbp - 0x69], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9d, 0x2011f
lea r8, [rbp - 0x59]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x69]
call fcn.1400441a8
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 7
jbe 0x140048a13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048a0e
push rdx
call fcn.140136ccd
int3
call fcn.1400c1d84
movdqa xmm0, xmmword [0x1400cf2a0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x59], bx
mov rsi, qword [rbp - 0x69]
test rsi, rsi
setne r15b
mov r14d, 1
test rsi, rsi
je 0x140048b64
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea r8d, [r14 + 0x1e]
lea rdx, str.VulnerableDriverBlocklistEnable
lea rcx, [rbp - 0x29]
call fcn.140040268
mov dword [rbp - 0x71], ebx
mov dword [rbp - 0x79], 4
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova r8, qword [rbp - 0x29]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r9d, [r14 + 0xf]
mov rcx, rsi
call fcn.14012a216
int3
mov eax, 0x80000000
test r15b, r15b
je 0x140048ba2
add rax, rsi
cmp rax, 5
jbe 0x140048b9b
cmp rsi, 0xffffffff80000007
je 0x140048b9b
cmp rsi, 0xffffffff80000060
je 0x140048b9b
cmp rsi, 0xffffffff80000050
je 0x140048b9b
mov rcx, rsi
call fcn.140135032
int3
mov rsi, rbx
mov qword [rbp - 0x69], rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 0x28
lea rdx, str.SYSTEMControlSet001ControlDeviceGuard
lea rcx, [rbp - 0x29]
call fcn.140040268
nop
mov qword [rbp - 0x61], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9d, 0x2011f
lea r8, [rbp - 0x29]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x61]
call fcn.1400441a8
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 7
jbe 0x140048c38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048c33
push rbp
call fcn.14013d218
int3
call fcn.1400c1d84
movdqa xmm0, xmmword [0x1400cf2a0]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], bx
mov rdi, qword [rbp - 0x61]
test rdi, rdi
setne r12b
test rdi, rdi
je 0x140048ef1
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov r8d, 0x21
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x59]
call fcn.140040268
mov dword [rbp - 0x71], ebx
mov dword [rbp - 0x79], 4
lea r8, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova r8, qword [rbp - 0x59]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rdi
push rax
call fcn.1401198f5
mov ebx, eax
mov r15d, dword [rbp - 0x71]
test eax, eax
cmovne r15d, eax
mov rdx, qword [rbp - 0x41]
cmp rdx, 7
jbe 0x140048d0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048d0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048d0a
push rdi
call fcn.14013c1d4
int3
call fcn.1400c1d84
test ebx, ebx
jne 0x140048d84
xor ebx, ebx
test r15d, r15d
je 0x140048d86
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
lea r8d, [rbx + 0x21]
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x59]
call fcn.140040268
nop
mov dword [rbp - 0x79], ebx
lea rdx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rdx, qword [rbp - 0x59]
lea ecx, [rbx + 4]
mov dword [rsp + 0x28], ecx
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
mov rcx, rdi
push rdi
call fcn.140134939
test eax, eax
jne 0x140049325
lea rcx, [rbp - 0x59]
call fcn.140052e14
mov r13b, r14b
jmp 0x140048d86
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov r8d, 0x1f
lea rdx, str.RequireMicrosoftSignedBootChain
lea rcx, [rbp - 0x59]
call fcn.140040268
mov dword [rbp - 0x71], ebx
mov dword [rbp - 0x79], 4
lea r8, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova r8, qword [rbp - 0x59]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rdi
call fcn.14013907f
int3
test r12b, r12b
je 0x140048f2f
mov eax, 0x80000000
add rax, rdi
cmp rax, 5
jbe 0x140048f28
cmp rdi, 0xffffffff80000007
je 0x140048f28
cmp rdi, 0xffffffff80000060
je 0x140048f28
cmp rdi, 0xffffffff80000050
je 0x140048f28
mov rcx, rdi
push rcx
call fcn.140112723
mov rdi, rbx
mov qword [rbp - 0x61], rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov r8d, 0x32
lea rdx, str.SYSTEMControlSet001ControlDeviceGuardScenarios
lea rcx, [rbp - 0x59]
call fcn.140040268
nop
mov qword [rbp - 0x71], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9d, 0x2011f
lea r8, [rbp - 0x59]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x71]
call fcn.1400441a8
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 7
jbe 0x140048fc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048fc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048fc0
call fcn.1401306b5
int3
call fcn.1400c1d84
movdqa xmm0, xmmword [0x1400cf2a0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x59], bx
mov rbx, qword [rbp - 0x71]
xor r12d, r12d
test rbx, rbx
setne r15b
test rbx, rbx
je 0x14004913e
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea r8d, [r12 + 0x1f]
lea rdx, str.HypervisorEnforcedCodeIntegrity
lea rcx, [rbp - 0x29]
call fcn.140040268
mov dword [rbp - 0x79], r12d
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova rdx, qword [rbp - 0x29]
lea ecx, [r12 + 4]
mov dword [rsp + 0x28], ecx
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
mov rcx, rbx
call fcn.14011ca90
int3
test r15b, r15b
mov r15d, 0x80000000
je 0x14004917e
lea rax, [rbx + r15]
cmp rax, 5
jbe 0x140049177
cmp rbx, 0xffffffff80000007
je 0x140049177
cmp rbx, 0xffffffff80000060
je 0x140049177
cmp rbx, 0xffffffff80000050
je 0x140049177
mov rcx, rbx
call fcn.14014015a
int3
mov rbx, r12
mov qword [rbp - 0x71], rbx
test r13b, r13b
je 0x140049214
movdqa xmm0, xmmword [0x1400cf5d0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400cf500]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400cf530]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400cf5b0]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x100cadc
mov rdx, r12
lea eax, [rdx + 0x78]
xor byte [rbp + rdx - 0x29], al
add rdx, r14
cmp rdx, 0x42
jb 0x1400491c5
mov byte [rbp + 0x1a], r12b
lea rdx, [rbp - 0x29]
mov rcx, qword [0x1400c64d8]
call fcn.14003fbc0
lea rdx, [0x140041c40]
mov rcx, rax
push rdi
call fcn.14011da2c
mov ecx, 0x2710
push rbx
call fcn.14012eb58
lea rcx, str.shutdown__r
call fcn.14013c218
int3
test rbx, rbx
je 0x140049248
lea rax, [rbx + r15]
cmp rax, 5
jbe 0x140049248
cmp rbx, 0xffffffff80000007
je 0x140049248
cmp rbx, 0xffffffff80000060
je 0x140049248
cmp rbx, 0xffffffff80000050
je 0x140049248
mov rcx, rbx
push rbp
call fcn.14012d56c
nop
test rdi, rdi
je 0x14004927c
lea rax, [rdi + r15]
cmp rax, 5
jbe 0x14004927c
cmp rdi, 0xffffffff80000007
je 0x14004927c
cmp rdi, 0xffffffff80000060
je 0x14004927c
cmp rdi, 0xffffffff80000050
je 0x14004927c
mov rcx, rdi
call fcn.1401046b2
int3
test rsi, rsi
je 0x1400492af
lea rax, [rsi + r15]
cmp rax, 5
jbe 0x1400492af
cmp rsi, 0xffffffff80000007
je 0x1400492af
cmp rsi, 0xffffffff80000060
je 0x1400492af
cmp rsi, 0xffffffff80000050
je 0x1400492af
mov rcx, rsi
push rcx
call fcn.14013c6bd
mov al, r14b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c2060
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x29]
call fcn.1400424a0
lea rdx, [0x1400f1018]
lea rcx, [rbp - 0x29]
call fcn.1400c307a
nop
lea r8, str.Cannot_write_DWORD_value:_RegSetValueExW_failed.
mov edx, eax
lea rcx, [rbp - 0x29]
call fcn.1400424a0
lea rdx, [0x1400f1018]
lea rcx, [rbp - 0x29]
call fcn.1400c307a
int3