Function at 0x14015f6e0
Capabilities:
Copy file
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e90]
mov eax, 0x1f90
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1e80], rax
mov rdi, rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
lea rdx, str.CBaseOSSpecTypeWin2K::CopyMonitorFile
lea rcx, [rbp - 0x20]
call fcn.14001abe0
nop
lea rsi, [0x1402a8360]
lea r15, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14015f781
test byte [rcx + 0x1c], 1
je 0x14015f781
mov r9, r15
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [r13 + 0x1f]
lea r8, [0x140265800]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605c2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605cd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x30]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x652]
call fcn.1401e7e40
mov r12d, r13d
mov dword [rsp + 0x48], r13d
mov word [rbp + 0x650], r13w
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x650]
lea rdx, str.USEMONITORFILE
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14015f885
test byte [rcx + 0x1c], 4
je 0x14015f885
mov r9, r15
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x20
lea rax, [rbp + 0x650]
mov qword [rsp + 0x20], rax
lea r8, [0x140265800]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
cmp word [rbp + 0x650], r12w
jne 0x14015f939
mov byte [rbp - 0x18], 1
cmp rcx, rsi
je 0x14015f8d3
test byte [rcx + 0x1c], 1
je 0x14015f8d3
cmp qword [0x1402bbdc8], 8
cmovae r15, qword [0x1402bbdb0]
mov edx, 0x21
mov dword [rsp + 0x20], 1
mov r9, r15
lea r8, [0x140265800]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rdx, [rbx - 0x18]
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015f8ff
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14015f92b
lfence
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
mov rcx, r8
call qword [case.0x1400136d6.0]
nop
lea rcx, [rbp - 0x20]
call fcn.14001ace0
jmp 0x140160582
mov edx, 1
lea rcx, [rbp - 0x68]
call fcn.1400041d0
mov edx, 0x104
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605d8
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rsi, [rbp + 0x30]
lea rax, [rbp + 0x30]
mov r14, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x14015f9a3
movzx edx, si
lea rcx, [rsp + 0x38]
call fcn.1400041d0
jmp 0x14015f9cc
lea rcx, [rbp + 0x30]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015f9b0
mov r8d, eax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140004e60
nop
mov r8d, 1
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400044a0
nop
mov rcx, qword [rax]
movzx ebx, word [rcx]
sub ebx, 0x5c
jne 0x14015f9f6
movzx ebx, word [rcx + 2]
movzx eax, r13w
sub ebx, eax
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015fa1e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea r13, [0x140251df8]
test ebx, ebx
je 0x14015fa4c
mov rax, r14
nop dword [rax]
inc rax
cmp word [r13 + rax*2], 0
jne 0x14015fa30
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140007390
lea rcx, [rbp - 0x80]
call fcn.140091e00
nop
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.1400929b0
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605e3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x30]
cmp rax, 0x10000
jae 0x14015faa8
movzx edx, si
lea rcx, [rsp + 0x70]
call fcn.1400041d0
jmp 0x14015facc
lea rcx, [rbp + 0x30]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015fab0
mov r8d, eax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140004e60
nop
mov r8d, 1
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.1400044a0
nop
mov rcx, qword [rax]
movzx ebx, word [rcx]
mov esi, 0x5c
sub ebx, esi
jne 0x14015fafb
movzx ebx, word [rcx + 2]
xor eax, eax
movzx eax, ax
sub ebx, eax
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015fb23
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test ebx, ebx
je 0x14015fb4c
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [r13 + rax*2], 0
jne 0x14015fb30
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.140007390
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xb8]
mov rcx, rdx
call qword [case.0x1400136d6.0]
test eax, eax
jne 0x14015fba7
mov rcx, qword [0x1402bbf58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xb0]
mov rdx, rdi
mov rcx, r8
call qword [case.0x1400136d6.0]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605ee
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rdi, rdi
je 0x14015fbfc
cmp rdi, 0x10000
jae 0x14015fbeb
movzx edx, di
lea rcx, [rsp + 0x50]
call fcn.1400041d0
jmp 0x14015fc0f
mov rax, r14
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x14015fbf0
jmp 0x14015fbfe
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
mov r8d, 1
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400044a0
nop
mov rcx, qword [rax]
movzx ebx, word [rcx]
sub ebx, esi
jne 0x14015fc3b
movzx ebx, word [rcx + 2]
xor esi, esi
movzx eax, si
sub ebx, eax
jmp 0x14015fc3d
xor esi, esi
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015fc65
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test ebx, ebx
je 0x14015fc8c
mov rax, r14
nop dword [rax]
inc rax
cmp word [r13 + rax*2], 0
jne 0x14015fc70
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140007390
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x78]
call fcn.140099a10
nop
lea rcx, [rbp - 0x70]
call fcn.14009ffa0
nop
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1401605f9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x650]
cmp rax, 0x10000
jae 0x14015fcfb
lea rax, [rbp + 0x650]
movzx edx, ax
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x14015fd24
lea rcx, [rbp + 0x650]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015fd05
mov r8d, eax
lea rdx, [rbp + 0x650]
lea rcx, [rsp + 0x40]
call fcn.140004e60
nop
mov edi, esi
mov rbx, qword [rsp + 0x40]
lea rax, [rbx - 0x10]
mov qword [rbp - 0x30], rax
mov eax, dword [rax]
test eax, eax
jle 0x140160325
nop dword [rax]
test edi, edi
js 0x14015fd6d
cmp edi, eax
jge 0x14015fd6d
movsxd rax, edi
lea rcx, [rbx + rax*2]
mov edx, 0x2f
call fcn.1401e71f4
mov r13, rax
test rax, rax
je 0x140160325
sub r13, rbx
sar r13, 1
jmp 0x14015fd70
mov r13d, r14d
test r13d, r13d
js 0x140160325
lfence
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
call fcn.140004d00
add rax, 0x18
mov qword [rsp + 0x68], rax
mov esi, r13d
sub esi, edi
mov r9d, esi
mov r8d, edi
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x40]
call fcn.14002eaa0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140007390
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015fde7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140004d00
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r9d, esi
mov r8d, edi
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002eaa0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140007390
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015fe4d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp + 0x1650]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rbp + 0x1a64]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [rbp + 0x240], ax
mov word [rbp + 0x448], ax
lea r9d, [rax + 1]
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x1650]
lea rcx, [rbp - 0x80]
call fcn.140095700
mov r9d, 1
lea r8, [rbp + 0x448]
lea rdx, [rbp + 0x1a64]
lea rcx, [rbp - 0x80]
call fcn.140095700
cmp word [rbp + 0x448], 0
je 0x14015ff38
lea r8, [rbp + 0x448]
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x70]
call fcn.1400a0940
test eax, eax
jns 0x14015ff38
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015ff06
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14016030e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
jmp 0x14016030e
lfence
mov r10, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp r10, rax
je 0x14015ffb7
test byte [r10 + 0x1c], 4
je 0x14015ffb7
mov rax, qword [rsp + 0x58]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x104
or edx, ecx
jge 0x14015ff8a
mov edx, 0x104
lea rcx, [rsp + 0x58]
call fcn.140004e00
mov rax, qword [rsp + 0x58]
mov r10, qword [0x1402a8360]
mov r9, r15
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x22
mov qword [rsp + 0x20], rax
lea r8, [0x140265800]
mov rcx, qword [r10 + 0x10]
call fcn.140006c90
cmp word [rbp + 0x448], 0
je 0x14016002f
lea r8, [rbp + 0x448]
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x70]
call fcn.1400a0940
test eax, eax
js 0x14016002f
test r12d, r12d
jne 0x14016002f
lea rdx, str.SPOOLER
lea rcx, [rsp + 0x78]
call fcn.14009e950
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
lea r8, [0x140252f48]
lea rdx, str.FIRST_SPOOLER_STOP
mov rcx, r10
call qword [case.0x1400136d6.0]
mov dword [rsp + 0x48], 1
mov r9d, esi
mov r8d, edi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.14002eaa0
mov r15, rax
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140160069
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x14016008d
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1401605b7
lfence
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
or dword [rsp + 0x30], 1
mov r15, qword [r15]
movsxd r12, dword [r15 - 0x10]
mov rdx, qword [rsp + 0x38]
movsxd rsi, dword [rdx - 0x10]
lea edi, [r12 + rsi]
test edi, edi
js 0x140160604
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1401600ee
lfence
mov edx, edi
lea rcx, [rbp - 0x78]
call fcn.140004e00
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rbp - 0x78]
add rsi, rsi
je 0x140160115
test rbx, rbx
jne 0x14016010a
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140160115
mov r8, rsi
mov rcx, rbx
call fcn.1401e7770
mov r8, r12
add r8, r8
lea rcx, [rsi + rbx]
je 0x14016014c
test rcx, rcx
je 0x14016013c
test r15, r15
je 0x140160135
mov rdx, r15
call fcn.1401e7770
jmp 0x14016014c
xor edx, edx
call fcn.1401e7e40
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
cmp edi, dword [rbx - 0xc]
jg 0x140160604
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
lea rcx, [rbx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1401601cb
cmp dword [rdi + 0x10], esi
jl 0x1401601ba
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1401601ba
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1401601ab
lfence
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
mov rbx, qword [rbp - 0x78]
jmp 0x1401601cb
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140004e60
and dword [rsp + 0x30], 0xfffffffe
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401601f5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14016021d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [0x1402a8360]
lea rax, [0x1402a8360]
lea r15, [0x1402bbdb0]
cmp rcx, rax
je 0x14016026f
test byte [rcx + 0x1c], 4
je 0x14016026f
mov r9, r15
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x23
mov qword [rsp + 0x20], rbx
lea r8, [0x140265800]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdi, qword [rsp + 0x68]
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
je 0x1401602b6
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jl 0x140160290
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401602e0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140160309
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov r12d, dword [rsp + 0x48]
lea edi, [r13 + 1]
mov rax, qword [rbp - 0x30]
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
cmp edi, eax
jl 0x14015fd40
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xe50]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0xe50]
lea rdx, str.FIRST_SPOOLER_STOP
mov rcx, r9
call qword [case.0x1400136d6.0]
cmp r12d, 1
jne 0x140160387
lea rdx, str.SPOOLER
lea rcx, [rsp + 0x78]
call fcn.14009e630
jmp 0x1401603b0
lea rdx, [0x140252f48]
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1401603b0
lea rdx, str.Canon_Driver_Information_Assist_Service
lea rcx, [rsp + 0x78]
call fcn.14009e950
mov byte [rbp - 0x18], 1
mov rcx, qword [0x1402a8360]
lea rdi, [0x1402a8360]
cmp rcx, rdi
je 0x1401603fe
test byte [rcx + 0x1c], 1
je 0x1401603fe
mov r9, r15
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x25
mov dword [rsp + 0x20], 1
lea r8, [0x140265800]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140160423
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rcx, [rbp - 0x70]
call fcn.1400a0110
nop
lea rcx, [rsp + 0x78]
call fcn.140099b80
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140160462
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14016048c
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rcx, [rbp - 0x80]
call fcn.140091f70
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401604c0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401604e9
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140160512
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x20], rax
cmp byte [rbp - 0x18], 0
jne 0x140160570
mov rcx, qword [0x1402a8360]
cmp rcx, rdi
je 0x140160570
test byte [rcx + 0x1c], 1
je 0x140160570
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rax, qword [rbp - 0x10]
cmp qword [0x1402bbdc8], 8
cmovae r15, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, r15
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp + 0x10]
call fcn.1400048a0
lea rcx, [rbp - 0x10]
call fcn.1400048a0
mov eax, 1
mov rcx, qword [rbp + 0x1e80]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x1f90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
int3