Function at 0x140001c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
lea rbp, str.Enabled
lea rdi, str.Disabled
mov ebx, eax
test eax, eax
jne 0x140001d99
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, str.VulnerableDriverBlocklistEnable
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x28], rax
mov r9d, 0x10
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x58], 4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ebx, eax
test eax, eax
jne 0x140001d08
cmp dword [rsp + 0x5c], 4
jne 0x140001d5e
cmp dword [rsp + 0x40], esi
lea rdx, str.Driver_Blocklist:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rdi
cmovne rbx, rbp
call fcn.1400039b0
mov rcx, rax
mov rdx, rbx
call fcn.1400039b0
jmp 0x140001d7c
cmp ebx, 2
jne 0x140001d5e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Value_
call fcn.1400039b0
mov rcx, rax
lea rdx, str.VulnerableDriverBlocklistEnable
call fcn.1400039b0
mov rcx, rax
lea rdx, str._not_found_in_registry_path_
call fcn.1400039b0
mov rcx, rax
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
call fcn.1400039b0
mov rcx, rax
lea rdx, str.._It_might_be_using_default_settings.
call fcn.1400039b0
jmp 0x140001d7c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_read_Driver_Blocklist_status._Error_code:
call fcn.1400039b0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140003b90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001e16
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp ebx, 2
jne 0x140001dd1
lea rdx, str.Registry_path_
call fcn.1400039b0
mov rcx, rax
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
call fcn.1400039b0
mov rcx, rax
lea rdx, str._not_found._It_might_be_using_default_settings_or_the_feature_is_disabled.
call fcn.1400039b0
jmp 0x140001e06
lea rdx, str.Failed_to_open_registry_path_
call fcn.1400039b0
mov rcx, rax
lea rdx, str.SYSTEMCurrentControlSetControlCIConfig
call fcn.1400039b0
mov rcx, rax
lea rdx, str.._Error_code:
call fcn.1400039b0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140003b90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001ee6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, str.SecureBootEnabled
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x28], rax
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov ebx, eax
test eax, eax
jne 0x140001eb2
lea rdx, str.Secure_Boot:
call fcn.1400039b0
cmp dword [rsp + 0x40], esi
mov rcx, rax
cmovne rdi, rbp
mov rdx, rdi
call fcn.1400039b0
jmp 0x140001ec9
lea rdx, str.Failed_to_read_Secure_Boot_status._Error_code:
call fcn.1400039b0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140003b90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001f09
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Secure_Boot_key_not_found._It_might_be_disabled_or_the_system_uses_default_settings.
call fcn.1400039b0
lea rdx, [0x140003b90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140004740
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret