Function at 0x14000edc0
Capabilities:
Create process on windows
Create thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x658]
sub rsp, 0x730
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov rdi, rdx
mov ebx, ecx
xor r8d, r8d
mov dl, 1
lea rcx, [0x140130128]
call fcn.1400217f0
lea rcx, str.KdsMntSvc:_ServiceMain_started...._n
call fcn.1400213c0
test ebx, ebx
je 0x14000ee3a
mov r8d, 4
lea rdx, str._console
mov rcx, qword [rdi]
call fcn.1400c7cbc
test eax, eax
je 0x14000ee92
xor edx, edx
lea rcx, [0x140176f38]
call fcn.140016bd0
lea rdx, [0x14000eab0]
lea rcx, [0x140130128]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
test rax, rax
jne 0x14000ee7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.KdsMntSvc:_RegisterServiceCtrlHandler___failed__d_n
call fcn.1400213c0
jmp 0x14000f257
mov qword [0x140176f58], rax
mov edx, 4
lea rcx, [0x140176f38]
call fcn.140016f00
mov byte [0x140176f60], 1
call fcn.14001f8b0
mov rcx, rax
lea r8, [0x1401773d0]
xor edx, edx
call fcn.14001ef70
lea rdx, [0x1401773d0]
lea rcx, str.g_dta.wszPluginPath____s__n
call fcn.1400213c0
call fcn.14000c160
lea r8, str..pipekdskdsmntsvc
mov edx, 0x104
lea rcx, [0x140176f80]
call fcn.1400c3900
mov dword [0x140176f70], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea r9, [0x140176f68]
lea r8, [0x140012dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140176f78], rax
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140009010]
xor edx, edx
xor ecx, ecx
call fcn.1400c8058
test rax, rax
je 0x14000ef62
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000ef76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Thread_close_error__u_n
jmp 0x14000ef6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Thread_start_error__u_n
mov edx, eax
call fcn.140021160
mov ecx, 0x104428
call fcn.140027a60
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.1400037e0
mov r15, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call fcn.1400c0ac0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.1400c0ac0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x410]
call fcn.1400c0ac0
mov dword [rsp + 0x58], r12d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x208
lea r9, [rbp + 0x410]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
mov edx, 0x104
lea rcx, [rbp - 0x10]
lea r8, [0x140132250]
lea rax, [rbp - 0x10]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000f035
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000f035
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000f010
jmp 0x14000f03a
test rdx, rdx
jne 0x14000f03e
sub rcx, 2
mov word [rcx], r12w
call fcn.14001f8b0
mov rcx, rax
lea r8, [rbp + 0x200]
xor edx, edx
call fcn.14001ef70
cmp word [rbp + 0x200], 0
je 0x14000f07e
lea r9, [rbp + 0x200]
lea r8, str._sKdsMntSvc.exe
mov edx, 0x104
lea rcx, [rbp - 0x10]
call fcn.140003710
lea rdx, [rbp - 0x10]
lea rcx, str.wszKdsMntSvcExe___s__n
call fcn.1400213c0
mov dword [rsp + 0x20], 0x20019
xor r9d, r9d
lea r8, str.MaxRunningCount
lea rdx, str.SOFTWAREKyoceraKdsMntSvc
mov rcx, 0xffffffff80000002
call fcn.1400224b0
mov edi, eax
mov dword [rsp + 0x20], 0x20019
mov r9d, 1
lea r8, str.TimePeriod
lea rdx, str.SOFTWAREKyoceraKdsMntSvc
mov rcx, 0xffffffff80000002
call fcn.1400224b0
mov r14d, eax
test eax, eax
je 0x14000f0ed
imul esi, r14d, 0x3e8
jmp 0x14000f0f2
mov esi, 0x3e8
mov ebx, r12d
cmp byte [0x140176f60], r12b
je 0x14000f1c4
cmp ebx, edi
jbe 0x14000f1ac
test edi, edi
je 0x14000f1ac
lea rcx, str.KdsMntSvc:_Restart_KdsMntSvc_n
call fcn.1400213c0
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x7c]
call fcn.1400c0ac0
mov dword [rbp - 0x80], 0x68
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140132490]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000f195
lea rcx, str.CreateProcess___running..._n
call fcn.1400213c0
jmp 0x14000f1a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess___failed__ld_n
call fcn.1400213c0
mov ebx, r12d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r14d
cmp byte [0x140176f60], 0
jne 0x14000f102
mov eax, dword [0x1401773cc]
test eax, eax
jle 0x14000f212
mov rdi, r12
mov esi, eax
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x1401773c0]
mov rbx, qword [rdi + rax]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, 0xa0
mov rcx, rbx
call fcn.1400277b4
lea rdi, [rdi + 8]
sub rsi, 1
jne 0x14000f1e0
mov eax, dword [0x1401773cc]
mov rcx, qword [0x1401773c0]
test rcx, rcx
je 0x14000f239
test eax, eax
je 0x14000f239
call fcn.1400277b4
mov qword [0x1401773c0], r12
mov qword [0x1401773c8], 8
test r15, r15
je 0x14000f246
mov rcx, r15
call fcn.14000ea50
mov edx, 1
lea rcx, [0x140176f38]
call fcn.140016f00
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140027790
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret