Function at 0x1400a5b58
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov r14, r9
mov edi, r8d
mov r12d, edx
mov rsi, rcx
mov r13, qword [0x140138308]
xor ebx, ebx
mov r15d, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0x20007c
mov dword [rsp + 0x5c], 0x6f0066
mov dword [rsp + 0x60], 0x630072
mov dword [rsp + 0x64], 0x200065
mov dword [rsp + 0x68], 0x720064
mov dword [rsp + 0x6c], 0x760069
mov dword [rsp + 0x70], 0x720065
mov dword [rsp + 0x74], 0x64002f
mov dword [rsp + 0x78], 0x740061
mov dword [rsp + 0x7c], 0x3a0061
mov dword [rax - 0x258], 0x250020
mov dword [rax - 0x254], 0xa0073
mov word [rax - 0x250], bx
lea rcx, str.hid________Sh953e6deoGg
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test r14, r14
je 0x1400a5c8e
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14000b314
lea r12, [rsi + 0x18]
mov eax, ebx
or rdi, 0xffffffffffffffff
test r12, r12
je 0x1400a5c4a
mov r8, rdi
inc r8
cmp word [r14 + r8*2], bx
jne 0x1400a5c30
test r8, r8
je 0x1400a5c4a
mov rdx, r14
mov rcx, r12
call fcn.140011a60
test eax, eax
je 0x1400a5e2e
lea rcx, [rsi + 0x20]
mov eax, ebx
test rcx, rcx
je 0x1400a5c77
inc rdi
cmp word [r14 + rdi*2], bx
jne 0x1400a5c5d
test rdi, rdi
je 0x1400a5c77
mov r8, rdi
mov rdx, r14
call fcn.140011a60
test eax, eax
je 0x1400a5c86
mov r15d, 1
jmp 0x1400a5e2e
mov rcx, r12
jmp 0x1400a5e28
test edi, edi
jne 0x1400a5cce
lea rax, [0x140116048]
lea r8, str.W32X86
test r12d, r12d
cmovne r8, rax
lea rdx, str.c:windows_system32_spooldrivers_s
lea rcx, [rsp + 0x50]
call fcn.140012124
mov rdx, qword [rsp + 0x50]
lea rcx, str._static:__s_n
call fcn.14000b314
jmp 0x1400a5dcc
cmp dword [rsp + 0x300], ebx
je 0x1400a5d3a
lea rcx, str.__RpcAsyncGetPrinterDriverDirectory:
call fcn.14000b314
mov rax, qword [rsi + 0x10]
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0x20a
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r13
lea rdx, [0x1400f1bba]
lea rcx, [0x1400f1a10]
call qword [sym.imp.RPCRT4.dll_NdrClientCall2]
mov qword [rsp + 0x90], rax
jmp 0x1400a5d93
lea rcx, str.__RpcGetPrinterDriverDirectory:
call fcn.14000b314
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20a
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9, qword [rsi + 0x10]
xor r8d, r8d
lea rdx, [0x1400f1df6]
lea rcx, [0x1400f1cc0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall2]
mov qword [rsp + 0x98], rax
test eax, eax
jne 0x1400a5dbd
lea rdx, [rsp + 0xa0]
lea rcx, [0x1401096d8]
call fcn.14000b314
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140011ad4
jmp 0x1400a5dcc
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x1400a5e2e
lea r9, str.mxdwdrv.dll
lea rdx, str._s3_s
lea rcx, [rsi + 0x18]
call fcn.140012124
test eax, eax
je 0x1400a5e23
lea rcx, [rsi + 0x20]
lea r9, str.mxdwdrv.dll
mov r8, qword [rsp + 0x50]
lea rdx, str._s3_s
call fcn.140012124
test eax, eax
je 0x1400a5e19
mov r15d, 1
jmp 0x1400a5e23
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r15d
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret