Function at 0x14000bd64
Capabilities:
Check os version
Get system information on windows
Get uefi variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
xor ecx, ecx
lea rdi, [rbp - 0x80]
xor eax, eax
cpuid
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
mov edx, 0x114
mov dword [rsp + 0x68], eax
mov ecx, edx
xor eax, eax
mov dword [rsp + 0x6c], ebx
rep stosb byte [rdi], al
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], edx
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rbp - 0x7c], 6
jb 0x14000c05e
xor r13d, r13d
cmp dword [rbp - 0x7c], 6
jne 0x14000bdcf
cmp dword [rbp - 0x78], r13d
je 0x14000c05e
cmp dword [rbp - 0x74], 0x1db0
je 0x14000c05e
lea r8, [rsp + 0x78]
mov dword [rbp + 0x100], r13d
mov edx, 8
mov word [rbp + 0x104], 0x500
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x108], r13
mov r12b, r13b
mov qword [rsp + 0x78], r13
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x14000c057
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14000c057
lea rax, [rbp + 0x108]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x100]
mov dword [rsp + 0x48], r13d
mov r8d, 0x20
mov dword [rsp + 0x40], r13d
mov dl, 2
mov dword [rsp + 0x38], r13d
mov r15, rdi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
mov ebx, 1
test eax, eax
js 0x14000bf2e
mov rcx, qword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea rax, [0x1400022a0]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 0xf8]
lea rax, [0x140002280]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8d, [rbx + 1]
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
call fcn.14000284c
test eax, eax
js 0x14000bf21
mov r14, qword [rbp + 0xf8]
mov esi, r13d
cmp dword [r14], r13d
jbe 0x14000bf01
mov rcx, qword [rbp + 0x108]
mov edx, esi
add rdx, rdx
mov edi, dword [r14 + rdx*8 + 0x10]
mov rdx, qword [r14 + rdx*8 + 8]
call qword [sym.imp.ntdll.dll_RtlEqualSid]
test al, al
je 0x14000bef5
and dil, 0x14
cmp dil, 4
je 0x14000befe
add esi, ebx
cmp esi, dword [r14]
jb 0x14000becb
jmp 0x14000bf01
mov r12b, bl
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbp + 0xf8]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ntdll.dll_RtlFreeSid]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r12b, r12b
je 0x14000c057
mov edi, 0x16
mov dl, bl
mov ecx, edi
call fcn.1400025a0
mov r9d, ebx
mov byte [rbp + 0xf0], r13b
lea r8, [rbp + 0xf0]
lea rdx, str.8be4df61_93ca_11d2_aa0d_00e098032b8c
lea rcx, str.SecureBoot
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor edx, edx
mov ecx, edi
call fcn.1400025a0
lea r9, [rbp + 0xf8]
mov dword [rsp + 0x60], 8
lea r8d, [rdi - 0xe]
lea rdx, [rsp + 0x60]
lea ecx, [rdi + 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000bfb3
test byte [rsp + 0x64], bl
je 0x14000bfc3
test dword [rsp + 0x64], 0x400
jne 0x14000bfc6
jmp 0x14000bfc3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov ebx, r13d
lea rax, [rsp + 0x68]
mov dword [rbp + 0x100], 4
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0xf0], 4
lea rdx, str.SystemCurrentControlSetControlCIConfig
mov dword [rbp + 0xf8], r13d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c04b
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x100]
lea rax, [rbp + 0xf8]
xor r8d, r8d
lea rdx, str.VulnerableDriverBlocklistEnable
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rbp - 0x74]
mov ecx, ebx
call fcn.14000b8f4
jmp 0x14000c063
mov eax, 0x522
jmp 0x14000c063
mov eax, 0x519
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret