Function at 0x140003d80
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov esi, 0x80070057
test rcx, rcx
je 0x1400041fb
cmp word [rcx], 0x5c
jne 0x1400041fb
cmp word [rcx + 2], 0x5c
jne 0x1400041fb
mov r8d, 9
lea rdx, str.http:__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041fb
mov r8d, 0xa
lea rdx, str.https:__
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041fb
cmp word [rbx], 0
je 0x140003e41
mov r8d, 6
lea rdx, str.CSR
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041fb
lea rdi, [rbx + 4]
xor r12d, r12d
mov ebx, r12d
test rdi, rdi
je 0x140003edf
mov ecx, 0x40e
call fcn.1400130c0
mov qword [rbp - 0x51], rax
mov rbx, rax
test rax, rax
je 0x140003edf
mov r9, rdi
mov edx, 0x207
mov rcx, rax
call fcn.140016958
test eax, eax
js 0x140003e9d
lea edx, [r12 + 0x5c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140003edf
mov word [rax], r12w
jmp 0x140003edf
mov rcx, qword [0x1400b72f8]
lea rdx, [0x1400b72f8]
cmp rcx, rdx
je 0x140003ed2
test byte [rcx + 0x44], 0x20
je 0x140003ed2
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009cd18]
mov edx, 0xb
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.14004d7a8
lea rcx, [rbp - 0x51]
call fcn.14000e324
mov rbx, qword [rbp - 0x51]
mov rdi, r12
test rbx, rbx
je 0x140003efa
mov rdi, rbx
mov rbx, r12
test rbx, rbx
je 0x140003efa
mov rcx, rbx
call fcn.1400130b4
test rdi, rdi
je 0x1400041fb
test byte [0x1400b9540], 2
mov qword [rsp + 0xf8], r15
je 0x140003f23
mov r8, rdi
lea rdx, [0x1400a9c78]
call fcn.14006c4a0
mov r13, qword [0x1400b9520]
mov qword [rbp - 0x59], r12
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r13 + 0x64]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
lea r14, [r13 + 0x78]
mov dword [r13 + 0x60], eax
mov rbx, r12
mov esi, 1
test r14, r14
je 0x140003ff9
mov rbx, qword [r13 + 0x88]
nop
test r14, r14
je 0x140003ff9
cmp rbx, r14
je 0x140003ff9
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140003ff6
lea r8, [rbp - 0x59]
mov rdx, rdi
mov rcx, rbx
call fcn.140071fc4
mov esi, eax
test eax, eax
je 0x140003fb0
mov rbx, qword [rbx + 0x10]
jmp 0x140003f70
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x59]
sub eax, dword [rdx + 0x38]
cmp eax, dword [r13 + 4]
jbe 0x140003ff0
mov rcx, qword [rdx + 0x10]
mov esi, 1
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov qword [rdx + 0x10], rdx
mov qword [rdx + 0x18], rdx
jmp 0x140003ff9
mov qword [rbp - 0x59], r12
jmp 0x140003ff9
mov esi, r12d
add dword [r13 + 0x64], 0xffffffff
mov eax, dword [r13 + 0x64]
jne 0x140004008
mov dword [r13 + 0x60], r12d
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov r15, qword [rsp + 0xf8]
test rcx, rcx
je 0x14000403a
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140098d58]
cmp esi, 1
jne 0x1400041d6
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r12
mov rcx, rdi
mov r14, rax
call fcn.1400730e4
test eax, eax
jne 0x1400040de
mov rsi, qword [rbp - 0x49]
test rsi, rsi
je 0x1400040d4
lea r8, [rbp - 0x41]
mov qword [rbp - 0x41], r12
mov rdx, rsi
call fcn.14007277c
mov rcx, rsi
mov ebx, eax
call fcn.1400130b4
test ebx, ebx
jne 0x1400040d4
lea ecx, [rbx + 0x40]
call fcn.1400130c0
test rax, rax
je 0x1400040d4
mov rdx, rdi
mov rcx, rax
call fcn.140070920
mov r9, rax
test rax, rax
je 0x1400040d4
cmp dword [rax + 0x3c], r12d
jl 0x1400040c0
mov rcx, qword [rbp - 0x41]
mov rdx, rax
mov rcx, qword [rcx + 0x48]
call fcn.140063564
test eax, eax
jns 0x1400040d4
mov rax, qword [r9]
mov edx, 1
mov rcx, r9
mov rax, qword [rax]
call qword [0x140098d58]
mov esi, 0x80004005
jmp 0x1400041af
lea rcx, [0x14007d1c0]
mov dword [rbp - 0x29], 0x74736c74
lea rax, [rbp - 0x21]
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x11], rax
lea r9, [rbp - 1]
lea rax, [rbp - 0x21]
mov qword [rbp + 7], rcx
mov qword [rbp - 9], rax
lea r8, [rbp - 0x29]
lea rax, [rbp + 7]
mov dword [rbp - 0x19], 0x6b6e6c74
mov qword [rbp + 0x17], rax
mov rdx, rdi
lea rax, [rbp + 7]
mov dword [rbp - 1], 0x74736c74
mov rcx, r13
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x6b6e6c74
mov byte [rsp + 0x20], r12b
call fcn.140072e74
mov esi, eax
test eax, eax
jne 0x14000415a
lea r8, [rbp - 0x29]
mov rdx, rdi
mov rcx, r13
call fcn.140070c30
mov esi, eax
jmp 0x14000419d
cmp ax, 0x2af9
jne 0x14000419d
lea rax, [rbp - 0x31]
mov rcx, rdi
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x39]
xor eax, eax
mov dword [rbp - 0x31], eax
call fcn.140071e30
mov esi, eax
test eax, eax
jne 0x140004190
mov rdx, qword [rbp - 0x39]
mov r8, rdi
mov rcx, r13
call fcn.140070db8
mov esi, eax
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp - 0x39]
call fcn.140010ca0
lea rcx, [rbp - 1]
call fcn.14004d998
lea rcx, [rbp - 0x29]
call fcn.14004d998
mov rcx, r14
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x1400041d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
test byte [0x1400b9540], 2
je 0x1400041ee
mov r8, rdi
lea rdx, [0x1400a9bf8]
call fcn.14006c4a0
test rdi, rdi
je 0x1400041fb
mov rcx, rdi
call fcn.1400130b4
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140013430
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret