Function at 0x140009c90
Capabilities:
Check if file exists
Delete registry value
Get thread local storage value
Get token membership
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x1400a5768]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor ebx, ebx
mov qword [rbp - 0x68], r9
mov qword [rsp + 0x68], r8
mov r14, r9
mov qword [rbp + 0x40], rdx
mov rdi, r8
mov dword [rsp + 0x60], 0x7b
mov r13, rcx
mov qword [rbp - 0x20], rbx
lea rsi, [rbx - 1]
mov qword [rbp - 0x60], rbx
mov r12, rcx
mov dword [rbp - 0x54], ebx
mov qword [rbp - 0x78], rbx
test rcx, rcx
je 0x140009d18
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140009d00
inc rax
cmp rax, 0x21b
ja 0x140014cca
cmp dword [0x1400a6f08], ebx
mov qword [rsp + 0x238], r15
mov r15d, 2
je 0x140014cdc
test r13, r13
je 0x140009d55
lea rdx, str._NoCache
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbx, rax
test rax, rax
jne 0x140014da5
xor ebx, ebx
mov rcx, qword [0x1400a6ef0]
mov edx, 8
lea r8d, [rdx + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x50], rax
mov r15, rax
test rax, rax
je 0x140014dc6
mov dword [rax], 0x6060
mov qword [rax + 0x38], rsi
mov qword [rax + 0x40], rbx
mov qword [rax + 0x50], 0
mov dword [rax + 0x58], ebx
mov qword [rax + 0x60], rbx
test r12, r12
je 0x140009e00
mov rax, rsi
cmp word [r12 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140009da0
mov rcx, qword [0x1400a6ef0]
lea esi, [rax*2 + 2]
mov r8d, esi
mov edx, 8
mov edi, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140014e26
mov r8d, edi
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov qword [r15 + 0x48], rbx
test rbx, rbx
je 0x140014e70
mov rdi, qword [rsp + 0x68]
mov rsi, 0xffffffffffffffff
xor ebx, ebx
test rdi, rdi
je 0x140009e10
cmp qword [rdi + 8], 0
jne 0x14000a2e4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1400a6ee0]
mov edi, eax
cmp ecx, 0xffffffff
je 0x140014e96
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
mov ebx, eax
test eax, eax
jne 0x14000a43d
cmp dword [rbp - 0x40], 4
jne 0x140014eb4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
mov ebx, 1
lea r9, [rbp + 0x20]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 7]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
test eax, eax
je 0x14000a5aa
xor ecx, ecx
mov dword [rbp + 0x60], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 1]
mov dword [rsp + 0x48], ecx
xor r9d, r9d
mov dword [rsp + 0x40], ecx
movzx edx, bl
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea rcx, [rbp + 0x60]
mov word [rbp + 0x64], 0x500
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140014edc
mov rdx, qword [rbp - 0x30]
lea r8, [rbp - 0x3c]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x140014ebe
cmp dword [rbp - 0x3c], 0
jne 0x140009ee8
xor ecx, ecx
mov ebx, ecx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test ebx, ebx
js 0x140014efa
jne 0x14000a2e4
mov rcx, r12
call fcn.14000a5e0
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x78], rax
test r12, r12
je 0x14000a42d
mov qword [rsp + 0x78], rsi
mov edi, eax
mov qword [rsp + 0x70], rsi
mov r15d, eax
mov esi, eax
mov byte [rbp + 0x30], al
mov dword [rbp - 0x58], 0x58
mov r14d, eax
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x28], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
mov ebx, 1
lea r9, [rsp + 0x78]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 0xd]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
test eax, eax
je 0x14000a03c
xor edx, edx
lea r8d, [rbx + 0x57]
lea rcx, [rbp + 0x70]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x140014f32
mov r9d, dword [rbp - 0x58]
lea rax, [rbp - 0x58]
lea r8, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov edx, 0x19
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x140014f39
mov rcx, qword [rbp + 0x70]
mov edx, 0x42
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x140014f47
call qword [sym.imp.KERNELBASE.dll_GetIsEdpEnabled]
mov ebx, eax
test r14d, r14d
jne 0x140014f4f
test eax, eax
jne 0x140014f4f
xor ebx, ebx
cmp qword [rsp + 0x70], 0xffffffffffffffff
mov edi, 1
jne 0x140015093
test esi, esi
jne 0x140014fff
test edi, edi
je 0x14000a033
mov rcx, qword [rsp + 0x78]
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x28], rax
mov rbx, rax
cmp rcx, rax
je 0x14000a02f
mov rbx, rcx
mov qword [rbp - 0x28], rcx
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x28], rbx
test r15d, r15d
jne 0x1400150c4
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
jne 0x1400150d3
mov r15, rcx
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
jne 0x1400150ea
test edi, edi
je 0x14000a06a
test r14d, r14d
jne 0x1400150fa
xor edi, edi
lea rdx, [rbp - 0x48]
mov ecx, 0x2001f
mov qword [rbp - 0x48], rdi
mov r14d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
mov ebx, eax
test eax, eax
jne 0x140015103
mov rsi, qword [rbp - 0x48]
test rsi, rsi
je 0x14001515c
cmp word [r12], 0x5c
jne 0x14000a1e7
cmp word [r12 + 2], 0x5c
jne 0x14000a1e7
mov rax, r15
inc rax
cmp word [r12 + rax*2], di
jne 0x14000a0b5
cmp rax, 0x21b
jae 0x1400151ea
mov rcx, qword [0x1400a6ef0]
mov edx, 8
mov r8d, 0x462
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14001518a
lea r8, [0x14008a930]
mov edx, 0x231
sub r8, rax
mov rcx, rax
lea rax, [rdx + 0x7ffffdcd]
test rax, rax
je 0x14000a129
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000a129
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000a101
jmp 0x1400151d8
test rdx, rdx
je 0x1400151d8
xor r10d, r10d
lea r8, [rdi + 0x2a]
mov word [rcx], r10w
cmp r8, r12
je 0x14000a185
mov r9, r12
mov edx, 0x21c
sub r9, r8
mov rax, r8
lea rcx, [rdx + 0x7ffffde2]
test rcx, rcx
je 0x14000a178
movzx ecx, word [rax + r9]
test cx, cx
je 0x14000a178
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x14000a150
jmp 0x1400151e1
test rdx, rdx
je 0x1400151e1
mov word [rax], r10w
movzx eax, word [r8]
test ax, ax
je 0x14000a1ab
mov ecx, 0x2c
cmp ax, 0x5c
je 0x14000a3c5
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x14000a193
lea rax, [rbp - 0x70]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [0x1400a6ef0]
mov r8, rdi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
test ebx, ebx
je 0x1400151f4
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [0x14008a628]
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000a229
mov r14, r12
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140015200
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x14000a28a
mov ecx, dword [rbp - 0x80]
cmp ecx, 0x48
jae 0x14001521b
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x1400152d9
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xffffffffffffffff
je 0x14000a2c4
mov r15, rdx
test rdx, rdx
je 0x14000a2c4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
test eax, eax
je 0x140015326
cmp r15, 0xffffffffffffffff
je 0x14000a2d3
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rdi, rdi
jne 0x140015332
mov r15, qword [rbp - 0x50]
mov r14, qword [rbp - 0x68]
xor edx, edx
lea rcx, [rbp - 0x18]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
mov ebx, dword [rbp + 0x1a0]
cmp ebx, 4
je 0x14000a3ce
cmp ebx, 3
je 0x140015364
cmp dword [rbp + 0x1a8], 0
mov esi, 3
je 0x14000a46d
mov rdi, qword [0x1400a6f10]
lea eax, [rbx - 3]
mov r8, qword [rsp + 0x68]
lea r9, [rbp - 0x18]
cmp eax, 1
lea rdx, [rbp - 0x60]
mov ecx, esi
lea eax, [rbx - 3]
cmova ecx, ebx
cmp eax, 1
mov rax, qword [rdi + 0x1e8]
mov dword [rsp + 0x20], ecx
cmova r9, r14
mov rcx, r12
call qword [0x140088740]
mov r14d, eax
cmp eax, 1
jne 0x14000a451
mov qword [r15 + 8], rdi
mov ebx, 1
mov rax, qword [rbp - 0x60]
mov qword [r15 + 0x10], rax
mov rax, qword [rbp + 0x40]
mov qword [rax], r15
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, qword [0x1400a6ef0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12, r13
jne 0x14001554b
mov eax, ebx
mov r15, qword [rsp + 0x238]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400106e0
add rsp, 0x240
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov word [r8], cx
jmp 0x14000a19d
mov eax, dword [r14 + 0x30]
mov dword [r15 + 0x54], eax
mov eax, dword [r14 + 0x34]
mov dword [r15 + 0x58], eax
mov eax, dword [r14]
mov dword [rbp - 0x14], eax
mov rax, qword [r14 + 8]
mov qword [rbp - 8], rax
mov rax, qword [r14 + 0x10]
mov qword [rbp], rax
mov eax, dword [r14 + 0x18]
mov dword [rbp + 8], eax
mov eax, dword [r14 + 0x1c]
mov dword [rbp + 0xc], eax
mov eax, dword [r14 + 0x20]
mov dword [rbp + 0x10], eax
movzx eax, word [r14 + 0x24]
mov word [rbp + 0x14], ax
mov rax, qword [r14 + 0x28]
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x10], 0x28
mov dword [rbp - 0x18], 0x38
jmp 0x14000a30b
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0x14000a2e4
cmp eax, 0x6bd
jne 0x140014e9e
xor ecx, ecx
mov ebx, ecx
jmp 0x140009efc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14000a9b0
cmp r14d, 2
je 0x14000a54d
lea rcx, [0x1400a6bf0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rcx, r12
call fcn.140008d58
lea rcx, [0x1400a6bf0]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rdi, rdi
jne 0x1400153a2
mov r14, qword [rbp - 0x20]
mov rcx, r12
call fcn.140008e00
cmp dword [rbp - 0x54], 0
mov rdi, rax
jne 0x140015444
test rdi, rdi
jne 0x140015475
mov rax, qword [0x1400a6f10]
mov rdi, qword [rax]
test rdi, rdi
je 0x14000a54d
cmp rdi, r14
je 0x14000a545
lea eax, [rbx - 3]
cmp eax, 1
ja 0x1400154cb
mov r15d, esi
lea eax, [rbx - 3]
cmp eax, 1
ja 0x1400154d3
lea r14, [rbp - 0x18]
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov r9, qword [rsp + 0x68]
lea r8, [rbp - 0x60]
test eax, eax
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov rdx, r13
mov qword [rsp + 0x20], rax
cmovne rdx, r12
mov rcx, rdi
call fcn.14000a8f4
sub eax, 1
je 0x1400154dc
cmp eax, 1
je 0x14000a54d
mov r14, qword [rbp - 0x20]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14000a4d0
mov rcx, qword [rbp - 0x50]
call fcn.140009300
cmp dword [rsp + 0x60], 0x7b
jne 0x14000a565
mov dword [rsp + 0x60], 0x709
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x709
jne 0x1400154e5
mov rax, qword [0x1400a52b8]
lea rcx, [0x1400a52b8]
cmp rax, rcx
je 0x14000a37e
test byte [rax + 0x1c], 0x80
je 0x14000a37e
jmp 0x14001551c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000a5bf
movzx ebx, ax
or ebx, 0x80070000
cmp ebx, 0x800703f0
je 0x14000a448
jmp 0x140009efc
mov ecx, 0x709
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x14000a3a4
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea r8, str.RouterPreInitEvent
xor edx, edx
mov ecx, r15d
mov rdi, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov rbx, rax
test rax, rax
jne 0x140014d5a
mov rax, qword [0x1400a52b8]
lea rcx, [0x1400a52b8]
cmp rax, rcx
je 0x140014d3a
test byte [rax + 0x1c], 0x20
je 0x140014d3a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1400a52b8]
lea edx, [rbx + 0x15]
mov r9d, eax
lea r8, [0x14008bc78]
mov rcx, qword [rcx + 0x10]
call fcn.140024908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r8d, r8d
lea rcx, [0x14008b620]
mov edx, eax
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rdi, rdi
je 0x140014d8f
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x140014d8f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x69
call fcn.140044768
mov edx, 0xffffffff
call fcn.140040480
mov rdi, qword [rsp + 0x68]
xor ebx, ebx
jmp 0x140009d32
mov rcx, r13
call sym.spoolsv.exe_PrvDllAllocSplStr
mov r12, rax
test rax, rax
je 0x140014e1f
sub rbx, r13
sar rbx, 1
xor ecx, ecx
mov word [rax + rbx*2], cx
jmp 0x140009d53
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x140014e03
test byte [rcx + 0x1c], 0x20
je 0x140014e03
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bc98]
mov edx, 0xa
lea r9d, [rdx + 0x5e]
call fcn.140024908
cmp r12, r13
je 0x140014e1f
test r12, r12
je 0x140014e1f
mov rcx, qword [0x1400a6ef0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x14000a39c
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x140009de5
test byte [rcx + 0x1c], 0x20
je 0x140009de5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bc98]
mov edx, 0xa
mov r9d, esi
call fcn.140024908
nop
jmp 0x140009de5
cmp r12, r13
je 0x140014e87
mov rcx, qword [0x1400a6ef0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r15
call fcn.140009300
xor eax, eax
jmp 0x14000a39c
mov rax, rbx
jmp 0x140009e2d
test eax, eax
jle 0x140009efc
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140009efc
mov ebx, 1
jmp 0x140009efc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140009ee8
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140009ee8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140009ef2
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140009ef2
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x140014f2b
test byte [rcx + 0x1c], 0x20
je 0x140014f2b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bd30]
mov edx, 0xe
mov r9d, ebx
call fcn.140024908
test ebx, ebx
jmp 0x140009f0c
xor ecx, ecx
jmp 0x140009f98
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
jmp 0x14000a033
mov r14d, ebx
jmp 0x140009fd3
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
cmp rcx, 0xffffffffffffffff
mov eax, 2
mov edx, 0x8e
cmove rcx, rsi
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x140014f92
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
jmp 0x14000a033
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
test eax, eax
jne 0x140014faa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
jmp 0x14000a033
mov esi, 1
test ebx, ebx
je 0x140014fca
mov rcx, qword [rsp + 0x70]
mov rbx, rdi
cmp rcx, 0xffffffffffffffff
cmove rcx, rdi
call fcn.140045cb0
jmp 0x140014fcc
xor ebx, ebx
test r14d, r14d
je 0x140009fee
xor edx, edx
mov dword [rbp - 0x38], 0x44
lea r9, [rbp - 0x38]
lea r8, [rbp + 0xd0]
lea ecx, [rdx + 0x43]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x14001501a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xffffffffffffffff
cmove rdx, rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop
jmp 0x14000a007
xor edx, edx
lea rcx, [rbp + 0x7c]
lea r8d, [rdx + 0x4c]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov r9d, 0x58
mov qword [rbp + 0x70], rax
cmp rcx, 0xffffffffffffffff
mov dword [rbp + 0x78], 0x60
lea r8, [rbp + 0x70]
cmove rcx, rbx
lea edx, [r9 - 0x3f]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x14001506b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
jmp 0x140014fff
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
cmove rcx, rbx
call fcn.140062ff4
test eax, eax
jne 0x140009fee
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
jmp 0x140014fff
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140009fff
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
test eax, eax
jne 0x14000a00b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
mov edi, ebx
jmp 0x140009fff
mov ecx, r15d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop
jmp 0x14000a03c
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x70], r15
jmp 0x14000a04e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rsp + 0x78], r15
jmp 0x14000a05d
mov byte [rbp + 0x30], 1
jmp 0x14000a06a
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
cmp ebx, 5
je 0x140015141
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x140015141
test byte [rcx + 0x1c], 0x20
je 0x140015141
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bd30]
mov edx, 0xb
mov r9d, ebx
call fcn.140024908
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140015150
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rsi, rdi
mov qword [rbp - 0x48], rdi
jmp 0x14000a090
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x140015174
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rsi, rax
test rsi, rsi
jne 0x14000a099
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x14000a232
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x1400151c9
test byte [rcx + 0x1c], 0x20
je 0x1400151c9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bc98]
mov edx, 0xa
mov r9d, 0x462
call fcn.140024908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
xor edi, edi
jmp 0x14000a1df
sub rcx, 2
jmp 0x14000a132
sub rax, 2
jmp 0x14000a181
mov ebx, 0x57
jmp 0x14000a1df
lea r14, str.DevMode
jmp 0x14000a229
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov ebx, eax
jmp 0x14000a29a
call sym.spoolsv.exe_PrvDllAllocSplMem
mov qword [rbp - 0x78], rax
mov rdi, rax
test rax, rax
jne 0x140015239
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x14000a28e
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400152b0
mov r8d, dword [rbp - 0x80]
mov r9d, 0x8007000d
cmp r8, 0x4c
jb 0x14001528b
movzx ecx, word [rdi + 0x46]
movzx eax, word [rdi + 0x44]
add rcx, rax
cmp r8, rcx
jb 0x14001528b
mov rcx, rdi
call fcn.140002810
mov r9d, eax
mov ecx, r9d
call fcn.140004768
mov ebx, eax
test eax, eax
je 0x1400152cc
mov rcx, qword [rbp - 0x70]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
mov eax, 2
cmove ebx, eax
mov rcx, qword [0x1400a6ef0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov edi, esi
mov qword [rbp - 0x78], rsi
jmp 0x1400152ce
xor esi, esi
cmp ebx, 2
cmove ebx, esi
jmp 0x14000a290
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
cmp ebx, 5
je 0x140015317
mov rcx, qword [0x1400a52b8]
lea rax, [0x1400a52b8]
cmp rcx, rax
je 0x140015317
test byte [rcx + 0x1c], 0x20
je 0x140015317
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008bd70]
mov edx, 0xf
mov r9d, ebx
call fcn.140024908
lea rcx, [rbp + 0x28]
call fcn.140008fac
nop
jmp 0x14000a2dc
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001534b
mov rax, qword [rcx]
mov qword [rbp + 0x48], rax
mov eax, dword [rcx + 0x10]
mov dword [rbp + 0x58], eax
jmp 0x140015352
mov qword [rbp + 0x48], rsi
mov dword [rbp + 0x58], esi
lea rax, [rbp + 0x48]
mov qword [rbp + 0x50], rdi
mov qword [rsp + 0x68], rax
jmp 0x14000a2dc
mov eax, dword [r14 + 4]
mov dword [rbp - 0x14], eax
mov rax, qword [r14 + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [r14 + 0x18]
mov qword [rbp], rax
mov eax, dword [r14 + 0x20]
mov dword [rbp + 8], eax
mov eax, dword [r14 + 0x24]
mov dword [rbp + 0xc], eax
mov eax, dword [r14 + 0x28]
mov dword [rbp + 0x10], eax
movzx eax, word [r14 + 0x2c]
mov word [rbp + 0x14], ax
mov rax, qword [r14 + 0x30]
jmp 0x14000a416
mov r8, qword [rsp + 0x68]
lea eax, [rbx - 3]
cmp eax, 1
lea r9, [rbp - 0x18]
mov ecx, esi
lea eax, [rbx - 3]
cmova ecx, ebx
lea rdx, [rbp - 0x60]
cmp eax, 1
mov dword [rsp + 0x20], ecx
mov rax, qword [rdi + 0x1e8]
mov rcx, r12
cmova r9, qword [rbp - 0x68]
call qword [0x140088740]
mov r14d, eax
test eax, eax
jne 0x1400153ed
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x32
jne 0x140015415
jmp 0x1400153f2
cmp eax, 0x32
jne 0x14001540b
mov r8, qword [rsp + 0x68]
lea rdx, [rbp - 0x60]
mov rax, qword [rdi + 0x20]
mov rcx, r12
call qword [0x140088740]
mov r14d, eax
cmp r14d, 1
je 0x14000a366
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14000a9b0
cmp r14d, 2
je 0x14000a54d
mov dword [rbp - 0x54], 1
mov r14, rdi
mov qword [rbp - 0x20], rdi
jmp 0x14000a49f
cmp rdi, r14
je 0x14000a4b4
lea rcx, [0x1400a6bf0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rcx, r12
call fcn.14005e39c
lea rcx, [0x1400a6bf0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop
jmp 0x14000a4b4
cmp rdi, r14
je 0x14000a54d
mov r9, qword [rsp + 0x68]
lea eax, [rbx - 3]
cmp eax, 1
lea rcx, [rbp - 0x18]
lea eax, [rbx - 3]
mov rdx, r12
cmova esi, ebx
lea r8, [rbp - 0x60]
cmp eax, 1
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x60]
cmova rcx, qword [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14000a8f4
cmp eax, 1
je 0x14000a366
jmp 0x14000a54d
mov r15d, ebx
jmp 0x14000a4e4
mov r14, qword [rbp - 0x68]
jmp 0x14000a4f4
mov r15, qword [rbp - 0x50]
jmp 0x14000a366
cmp eax, 5
je 0x14000a584
mov rax, qword [0x1400a52b8]
lea rcx, [0x1400a52b8]
cmp rax, rcx
je 0x14000a37e
test byte [rax + 0x1c], 0x20
je 0x14000a37e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, 0xb
jmp 0x140015527
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, 0xa
mov rcx, qword [0x1400a52b8]
lea r8, [0x14008bd10]
mov r9, r13
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14003f0e8
nop
jmp 0x14000a37e
test r12, r12
je 0x14000a39a
mov rcx, qword [0x1400a6ef0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
jmp 0x14000a39a