Function at 0x140009330
Capabilities:
Check os version
Identify system language via api
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1b38]
mov eax, 0x1c38
call fcn.14002b150
sub rsp, rax
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x1b10], rax
mov rbx, r8
mov rsi, rcx
lea rdx, [rbp + 0x10e0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x10e0]
mov edx, 0x5c
call fcn.140024180
xor edi, edi
test rax, rax
je 0x140009391
mov word [rax], di
lea rdx, [rbp + 0x10e0]
mov ecx, 0x30
call qword [sym.imp.SETUPAPI.dll_SetupAddToSourceListW]
lea r8, [rsp + 0x60]
lea rdx, [0x1400455c0]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140009405
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
lea rdx, str.MystDeviceVerify
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Install.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400575d8], rax
test rax, rax
je 0x14000aad7
mov qword [rsp + 0x1c20], r15
test rbx, rbx
je 0x1400094a9
lea rdx, [0x1400452e0]
mov rcx, rbx
call fcn.140023df0
test rax, rax
je 0x1400094a9
movzx ecx, word [0x14005799c]
mov ebx, 0x3ff
mov r15d, edi
and ecx, ebx
dec ecx
je 0x14000945d
cmp ecx, 0xc
jne 0x140009463
mov r15d, 1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
mov edx, 0x66
mov r8, rax
mov eax, 0x25a
test r15d, r15d
lea r9, [0x14000ab00]
cmovne edx, eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x1400575d8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14000aacf
lea rcx, str.Msftedit.dll
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x1c68], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea rcx, [rbp + 0x5d2]
xor edx, edx
mov r8d, 0x206
mov qword [0x1400575d0], rsi
mov r12, rax
mov qword [rsp + 0x68], rax
mov word [rbp + 0x5d0], di
call fcn.140027190
lea rcx, [rbp + 0x12f2]
xor edx, edx
mov r8d, 0x81e
mov word [rbp + 0x12f0], di
call fcn.140027190
lea rcx, [rbp + 0x1d2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x1d0], di
call fcn.140027190
lea rcx, [rbp + 0xae2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0xae0], di
call fcn.140027190
lea rdx, [rbp + 0x12f0]
mov r8d, 0x410
mov rcx, rsi
mov qword [rbp + 0xa8], 7
mov qword [rbp + 0xa0], rdi
mov word [rbp + 0x90], di
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [rbp + 0x12f0], di
jne 0x14000957b
mov r8, rdi
jmp 0x140009590
lea rax, [rbp + 0x12f0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140009586
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x1c28], r14
call fcn.14000d3f0
lea rcx, [rbp + 0xee2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0xee0], di
call fcn.140027190
lea rcx, [rbp + 0x7e2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x7e0], di
call fcn.140027190
lea rcx, [rbp + 0xd2]
xor edx, edx
mov r8d, 0xfe
mov word [rbp + 0xd0], di
call fcn.140027190
lea rcx, [rbp + 0x9e2]
xor edx, edx
mov r8d, 0xfe
mov word [rbp + 0x9e0], di
call fcn.140027190
lea rcx, [rbp + 0xce2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0xce0], di
call fcn.140027190
movzx ecx, word [0x14005799c]
mov r15d, 1
lea r8, [rbp + 0x9e0]
mov edx, r15d
call fcn.140005ba0
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0xd0]
lea edx, [r15 + 3]
call fcn.140005ba0
lea rsi, [0x140055390]
lea r8d, [r15 + 0x6f]
mov rcx, rsi
xor edx, edx
call fcn.140027190
lea rax, [rbp + 0x9e0]
or r9d, 0xffffffff
mov qword [0x140055390], rax
lea rax, [rbp + 0xd0]
mov r8, rbx
mov qword [0x1400553a0], rax
lea rax, [rbp + 0xee0]
mov edx, r15d
mov qword [0x140055398], rax
lea rax, [rbp + 0x12f0]
xor ecx, ecx
mov qword [0x1400553c0], rax
lea rax, [rbp + 0xce0]
mov dword [rsp + 0x28], edi
mov qword [0x1400553c8], rdi
mov qword [0x1400553d8], rdi
mov dword [0x1400553e0], 0xffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
lea eax, [rax*2 + 2]
mov r8, rbx
mov edx, r15d
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xce0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0xce0]
mov qword [0x1400553b0], rax
lea rax, [rbp + 0xce0]
test rax, rax
je 0x140009887
mov rax, qword [0x1400575f0]
mov dword [rsp + 0x40], edi
test rax, rax
jne 0x140009754
call fcn.140021790
mov qword [0x1400575f0], rax
test rax, rax
je 0x140009799
mov r8, qword [rbp + 0x1b58]
xor edx, edx
lea r9, [rsp + 0x40]
lea ecx, [rdx + 0x28]
call rax
mov rbx, rax
test rax, rax
je 0x140009799
mov rdx, qword [0x1400553b0]
lea rax, vtable.CInstallCmdConfig.0
mov rcx, rbx
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x18], edi
mov qword [rbx], rax
mov qword [rbx + 0x1c], r15
call fcn.140010980
jmp 0x14000979c
mov rbx, rdi
mov qword [0x1400553f8], rbx
cmp dword [rbx + 0x1c], r15d
jne 0x140009887
cmp dword [rbx + 0x20], 4
jne 0x140009887
lea rcx, [rbp + 0x3d0]
mov ebx, r15d
mov dword [rbp + 0x3d0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400097df
cmp dword [rbp + 0x3d4], 6
cmovae ebx, edi
mov rax, qword [0x1400553f8]
cmp dword [rax + 8], r15d
jne 0x14000982e
cmp dword [rax + 0xc], r15d
jne 0x14000982e
test ebx, ebx
jne 0x14000982e
cmp dword [rax + 0x14], r15d
jne 0x14000980e
call fcn.140008280
test eax, eax
mov rax, qword [0x1400553f8]
cmove edi, r15d
cmp dword [rax + 0x10], r15d
jne 0x140009822
mov rcx, rsi
call fcn.140008340
test eax, eax
cmove edi, r15d
mov rcx, qword [0x1400575d8]
jmp 0x14000aa76
movzx ecx, word [0x14005799c]
mov ebx, 0x3ff
mov esi, edi
and ecx, ebx
dec ecx
je 0x140009847
cmp ecx, 0xc
jne 0x14000984a
mov esi, r15d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
test esi, esi
mov r8, rax
mov eax, 0x25a
mov edx, 0x66
lea r9, [0x14000ab00]
cmovne edx, eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x1400575d8]
jmp 0x14000aa76
lea rcx, str.PRINTUI.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000aa66
lea rdx, str.PrintUIEntryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000aa5d
mov rcx, qword [0x1400553b0]
test rcx, rcx
je 0x140009940
lea rdx, [0x140045214]
call fcn.140024230
test rax, rax
je 0x140009940
mov rax, qword [0x1400553f8]
cmp dword [rax + 0x20], r15d
je 0x14000993a
movzx ecx, word [0x14005799c]
mov ebx, 0x3ff
mov esi, edi
and ecx, ebx
dec ecx
je 0x140009901
cmp ecx, 0xc
jne 0x140009904
mov esi, r15d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
test esi, esi
mov r8, rax
mov eax, 0x25a
mov edx, 0x66
lea r9, [0x14000ab00]
cmovne edx, eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x14000aa5d
movzx r9d, r15b
jmp 0x140009943
xor r9d, r9d
lea r8, [rbp + 0x5d0]
lea rdx, [rbp + 0x12f0]
call fcn.140009010
test al, al
je 0x14000aa5d
lea r8, [rbp + 0x5d0]
lea rcx, [rbp + 0x1d0]
mov edx, 0x100
mov qword [rsp + 0x1c30], r13
call fcn.140024568
mov rcx, qword [0x1400553b0]
lea rdx, [rbp + 0x5d0]
call fcn.140008c60
mov r14d, edi
mov rbx, rax
mov qword [0x1400553b0], rax
lea rax, [rbp + 0x5d0]
mov qword [0x1400553a8], rax
lea rax, [rbp + 0x5d0]
mov qword [0x1400553b8], rax
test rbx, rbx
je 0x140009df0
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x140045330]
mov rcx, rbx
call fcn.140024230
mov rbx, rax
test rax, rax
je 0x140009df0
lea rdx, str._npf
mov r8d, 4
mov rcx, rax
call fcn.1400244e0
test eax, eax
je 0x140009a4f
lea rdx, [0x140045190]
mov r8d, 3
mov rcx, rbx
call fcn.1400244e0
test eax, eax
je 0x140009a4f
lea rdx, [0x140045338]
mov r8d, 3
mov rcx, rbx
call fcn.1400244e0
test eax, eax
je 0x140009a4f
lea rdx, str._nhpes
mov r8d, 6
mov rcx, rbx
call fcn.1400244e0
test eax, eax
jne 0x140009a58
add rbx, 2
jmp 0x1400099d0
mov eax, dword [0x140057e00]
test r15b, al
jne 0x140009ac8
mov rdx, qword [0x1400553b0]
or eax, r15d
mov qword [0x140057e38], 7
mov qword [0x140057e30], rdi
mov word [0x140057e20], di
mov dword [0x140057e00], eax
cmp word [rdx], di
jne 0x140009a96
mov r8, rdi
jmp 0x140009aaa
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140009aa0
lea rcx, [0x140057e20]
call fcn.14000d3f0
lea rcx, [0x140038f50]
call fcn.140024168
mov eax, dword [0x140057e00]
lea r14, [0x140057de0]
test al, 2
jne 0x140009b27
or eax, 2
mov qword [0x140057df8], 7
mov qword [0x140057df0], rdi
mov word [0x140057de0], di
mov dword [0x140057e00], eax
cmp word [rbx + 4], di
jne 0x140009b00
mov r8, rdi
jmp 0x140009b0f
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2 + 4], di
jne 0x140009b04
lea rdx, [rbx + 4]
mov rcx, r14
call fcn.14000d3f0
lea rcx, [0x140038ec0]
call fcn.140024168
mov r13, qword [0x140057df0]
mov r12, qword [0x140057de0]
mov r10, qword [0x140057df8]
test r13, r13
je 0x140009c1b
cmp r10, 8
mov rax, r14
mov rdx, r14
cmovae rax, r12
cmovae rdx, r12
lea r9, [rax + r13*2]
cmp rdx, r9
jae 0x140009bc6
movzx r8d, word [rdx]
mov ecx, 2
lea rax, [0x14004521c]
cmp word [rax], r8w
je 0x140009b8a
add rax, 2
dec rcx
jne 0x140009b70
add rdx, 2
cmp rdx, r9
jb 0x140009b60
jmp 0x140009bc6
cmp r10, 8
mov rax, r14
cmovae rax, r12
sub rdx, rax
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140009bc6
cmp rdx, r13
jae 0x140009bc6
mov r8, r13
mov rcx, r14
call fcn.14000ca80
mov r13, qword [0x140057df0]
mov r12, qword [0x140057de0]
mov r10, qword [0x140057df8]
test r13, r13
je 0x140009c1b
cmp r10, 8
mov rax, r14
mov rsi, r14
cmovae rax, r12
cmovae rsi, r12
lea r8, [rax + r13*2]
cmp rsi, r8
jae 0x140009c1b
nop word [rax + rax]
movzx edx, word [rsi]
mov rcx, r15
lea rax, [0x140045350]
nop dword [rax]
cmp word [rax], dx
je 0x140009c93
add rax, 2
dec rcx
jne 0x140009c00
add rsi, 2
cmp rsi, r8
jb 0x140009bf0
or rsi, 0xffffffffffffffff
cmp rsi, 0xffffffffffffffff
jne 0x140009c7b
test r13, r13
je 0x140009c77
cmp r10, 8
mov rax, r14
mov rsi, r14
cmovae rax, r12
cmovae rsi, r12
lea r8, [rax + r13*2]
cmp rsi, r8
jae 0x140009c77
nop word [rax + rax]
movzx edx, word [rsi]
mov rcx, r15
lea rax, [0x140045354]
nop dword [rax]
cmp word [rax], dx
je 0x140009ca9
add rax, 2
dec rcx
jne 0x140009c60
add rsi, 2
cmp rsi, r8
jb 0x140009c50
or rsi, 0xffffffffffffffff
inc rsi
test r13, r13
je 0x140009d1b
cmp r13, 0xffffffffffffffff
jbe 0x140009cbc
or rcx, 0xffffffffffffffff
jmp 0x140009cc0
cmp r10, 8
mov rax, r14
cmovae rax, r12
sub rsi, rax
sar rsi, 1
jmp 0x140009c1f
cmp r10, 8
mov rax, r14
cmovae rax, r12
sub rsi, rax
sar rsi, 1
jmp 0x140009c7b
lea rcx, [r13 - 1]
mov rax, r14
cmp r10, 8
cmovae rax, r12
lea rbx, [rax + rcx*2]
nop
movzx edx, word [rbx]
mov rcx, r15
lea rax, [0x140045350]
nop dword [rax]
cmp word [rax], dx
je 0x140009d01
add rax, 2
dec rcx
jne 0x140009ce0
mov rcx, r14
call fcn.14000d060
cmp rbx, rax
je 0x140009d1b
sub rbx, 2
jmp 0x140009cd0
mov r10, qword [0x140057df8]
mov rax, r14
cmp r10, 8
cmovae rax, r12
sub rbx, rax
sar rbx, 1
jmp 0x140009d26
mov r10, qword [0x140057df8]
or rbx, 0xffffffffffffffff
cmp rbx, 0xffffffffffffffff
jne 0x140009d9f
test r13, r13
je 0x140009d9b
cmp r13, rbx
jbe 0x140009d3b
or rcx, rbx
jmp 0x140009d3f
lea rcx, [r13 - 1]
mov rax, r14
cmp r10, 8
cmovae rax, r12
lea rbx, [rax + rcx*2]
nop
movzx edx, word [rbx]
mov rcx, r15
lea rax, [0x140045354]
nop dword [rax]
cmp word [rax], dx
je 0x140009d81
add rax, 2
dec rcx
jne 0x140009d60
mov rcx, r14
call fcn.14000d060
cmp rbx, rax
je 0x140009d9b
sub rbx, 2
jmp 0x140009d50
mov rcx, qword [0x140057df8]
mov rax, r14
cmp rcx, 8
cmovae rax, r12
sub rbx, rax
sar rbx, 1
jmp 0x140009da6
or rbx, 0xffffffffffffffff
mov rcx, qword [0x140057df8]
dec rbx
cmp rsi, 0xffffffffffffffff
je 0x140009dde
cmp rbx, 0xffffffffffffffff
je 0x140009dde
cmp rsi, r13
jae 0x140009dde
cmp rbx, r13
jae 0x140009dde
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, r14
call fcn.14000c8e0
mov r12, qword [0x140057de0]
mov rcx, qword [0x140057df8]
cmp rcx, 8
cmovae r14, r12
mov qword [0x1400553a8], r14
mov r14d, r15d
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0x7e0]
mov edx, 2
call fcn.140005ba0
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0xee0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [0x140045370]
lea rcx, [rbp + 0x70]
mov r8d, 3
mov ebx, edi
mov qword [rbp + 0x88], 7
mov qword [rbp + 0x80], rdi
mov word [rbp + 0x70], di
call fcn.14000d3f0
mov rcx, qword [0x1400553b0]
test rcx, rcx
je 0x140009e90
cmp qword [rbp + 0x88], 8
lea rdx, [rbp + 0x70]
cmovae rdx, qword [rbp + 0x70]
call fcn.140024230
test rax, rax
je 0x140009e90
mov rcx, qword [rbp + 0x80]
mov edx, 0xffdf
test word [rax + rcx*2], dx
jne 0x140009e90
mov ebx, r15d
mov r14d, r15d
lea rax, [rsp + 0x50]
mov ecx, 2
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, ecx
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
mov eax, dword [rsp + 0x54]
mov ecx, 0x40
add eax, 0x400
mov edx, eax
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x140009f24
mov ecx, dword [rsp + 0x54]
lea rax, [rsp + 0x50]
mov r9, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 2
mov r8d, ecx
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
test eax, eax
jne 0x140009f24
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, rdi
movsxd r13, ebx
test r12, r12
je 0x14000a0b9
mov esi, edi
cmp dword [rsp + 0x50], edi
jbe 0x14000a0b9
movsxd r14, r14d
nop
mov eax, esi
lea r8, [rbp + 0x5d0]
imul r9, rax, 0x88
mov rax, qword [r9 + r12 + 0x20]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140009f74
add rax, 2
test ecx, ecx
jne 0x140009f60
test edx, edx
jne 0x140009f7d
test r14, r14
je 0x140009fb5
mov rax, qword [r9 + r12 + 8]
lea r8, [rbp + 0x1d0]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140009fa4
add rax, 2
test ecx, ecx
jne 0x140009f90
test edx, edx
jne 0x14000a04d
cmp r14, r15
jne 0x14000a04d
cmp qword [0x1400553b0], rdi
mov ebx, r15d
je 0x140009fd2
mov rax, qword [0x1400553f8]
cmp dword [rax + 0x20], ebx
jne 0x140009fd2
test r14, r14
jne 0x14000a034
mov rcx, qword [r9 + r12 + 8]
lea rdx, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterW]
test eax, eax
je 0x14000a034
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.StaticMode
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], edi
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
test eax, eax
jne 0x14000a029
cmp dword [rsp + 0x40], edi
je 0x14000a029
test r13, r13
cmove ebx, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
lea rcx, str.HPPrtInit
mov rdx, r15
mov dword [0x1400553d8], ebx
call fcn.140017ad0
test ebx, ebx
jne 0x14000a05b
inc esi
cmp esi, dword [rsp + 0x50]
jb 0x140009f40
jmp 0x14000a0b9
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0x7e0]
mov edx, 6
call fcn.140005ba0
mov eax, esi
lea rdx, [rbp + 0x7e0]
imul rbx, rax, 0x88
mov r8, qword [rbx + r12 + 8]
lea rcx, [rbp + 0xae0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0xae0]
lea rcx, [rbp + 0x1d0]
mov qword [0x1400553a0], rax
mov r8, qword [rbx + r12 + 8]
mov edx, 0x100
call fcn.140024568
mov eax, dword [rsp + 0x50]
mov esi, 0x25b
mov qword [0x1400553e8], r12
mov dword [0x1400553f0], eax
lea r14d, [rsi + 1]
call fcn.140005ce0
mov ebx, 0x67
test eax, eax
mov rax, qword [0x1400553b0]
cmovne ebx, esi
test rax, rax
je 0x14000a0fa
mov rcx, qword [0x1400553f8]
cmp dword [rcx + 8], edi
jne 0x14000a13d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
lea r9, [0x14000aea0]
mov r8, rax
lea rax, [0x140055390]
movzx edx, bx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, r15
jne 0x14000a326
mov rcx, qword [0x1400553f8]
mov rax, qword [0x1400553b0]
mov r8d, dword [rcx + 0x20]
cmp r8d, 2
je 0x14000a292
test rax, rax
je 0x14000a159
cmp r8d, r15d
je 0x14000a292
test r13, r13
jne 0x14000a292
call fcn.140005ce0
mov ebx, 0x68
test eax, eax
cmovne ebx, r14d
cmp r8d, 4
jne 0x14000a19c
cmp dword [rcx + 0x14], r15d
jne 0x14000a19c
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0xd0]
lea edx, [r13 + 0x3b]
call fcn.140005ba0
mov rcx, qword [0x1400553f8]
cmp dword [rcx + 0x20], 4
jne 0x14000a1c0
cmp dword [rcx + 0x10], r15d
jne 0x14000a1c0
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0xd0]
mov edx, 0x39
call fcn.140005ba0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
lea r9, [0x14000b1b0]
mov r8, rax
lea rax, [0x140055390]
movzx edx, bx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, r15
je 0x14000a20a
cmp rax, 0x70
jne 0x14000a326
mov rax, qword [0x1400553f8]
mov dword [rax + 0x20], edi
jmp 0x14000a0d3
mov rcx, qword [0x1400553f8]
cmp dword [rcx + 0x20], 3
jne 0x14000a292
cmp dword [0x1400553d8], edi
jne 0x14000a292
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1d0]
xor r8d, r8d
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterW]
test eax, eax
je 0x14000a28b
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0x7e0]
mov edx, 6
mov dword [0x1400553d8], r15d
call fcn.140005ba0
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0xae0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0xae0]
mov qword [0x1400553a0], rax
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
mov rcx, qword [0x1400553f8]
cmp dword [rcx + 0x20], 4
jne 0x14000a2ce
cmp dword [rcx + 0x14], r15d
jne 0x14000a2bd
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0xd0]
mov edx, 0x3b
call fcn.140005ba0
mov rcx, qword [0x1400553f8]
cmp dword [rcx + 0x20], 4
jne 0x14000a2ce
mov edx, 0x39
cmp dword [rcx + 0x10], r15d
je 0x14000a2d3
mov edx, 4
movzx ecx, word [0x14005799c]
lea r8, [rbp + 0xd0]
call fcn.140005ba0
call fcn.140005ce0
mov ecx, 0x25d
test eax, eax
mov ebx, 0x69
cmovne ebx, ecx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x1400575d8]
mov r8, rax
lea rax, [0x140055390]
lea r9, [0x14000b8a0]
movzx edx, bx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, str.HPPrtInit
xor edx, edx
call fcn.140017ad0
lea rcx, str.HPPrtInit
call fcn.140017fd0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x1400553e0], edi
jne 0x14000aa42
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a5ac
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea rdx, str.Device
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3d0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a5a1
mov rdx, qword [0x1400553a8]
lea rcx, [rbp + 0x3d0]
call fcn.140024230
mov rcx, qword [0x1400553b0]
test rax, rax
jne 0x14000a55f
test rcx, rcx
je 0x14000a5a1
lea rdx, [0x140045338]
call fcn.140024230
test rax, rax
jne 0x14000a5a1
mov rdx, qword [0x1400553a8]
lea r8, [rbp + 0x1d0]
sub r8, rdx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rdx + r8 - 2], ax
test ax, ax
jne 0x14000a420
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a500
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3d0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a4f3
lea rcx, [rbp + 0x1d0]
sub rcx, 2
nop
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x14000a4a0
mov eax, dword [0x14004546c]
mov dword [rcx], eax
lea rcx, [rbp + 0x1d0]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x14000a4c0
lea r8, [rbp + 0x3d0]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14000a4e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a52f
lea rax, [rbp + 0x1d0]
sub rax, 2
nop dword [rax + rax]
cmp word [rax + 2], di
lea rax, [rax + 2]
jne 0x14000a510
movups xmm0, xmmword [0x140045470]
movups xmm1, xmmword [0x140045480]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
lea rcx, [rbp + 0x1d0]
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14000a540
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1d0]
jmp 0x14000a584
test rcx, rcx
je 0x14000a5a1
lea rdx, [0x140045338]
call fcn.140024230
test rax, rax
je 0x14000a5a1
mov dword [rsp + 0x28], 2
lea rax, [0x140044d3c]
mov rcx, qword [rsp + 0x58]
lea rdx, str.Device
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1400553f8]
cmp dword [rax + 0x20], 2
jne 0x14000aa42
cmp dword [rax + 8], edi
jne 0x14000aa42
cmp dword [rax + 0xc], edi
jne 0x14000aa42
movups xmm0, xmmword [str.hpbuio64.dll]
movzx eax, word [0x1400454a8]
movsd xmm1, qword [0x1400454a0]
mov rdx, qword [0x1400553a8]
lea rcx, [rbp + 0x3d0]
mov qword [rbp - 0x50], 7
movsd qword [rbp + 0xc0], xmm1
movups xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xc8], ax
mov qword [rbp - 0x58], rdi
mov word [rbp - 0x68], di
call fcn.140019870
xor r8d, r8d
cmp qword [rbp + 0x480], rdi
jne 0x14000a641
mov rax, qword [rbp + 0x3d0]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x3d0]
call qword [rax + 0x50]
jmp 0x14000a655
lea rdx, [rbp + 0x470]
lea rcx, [rbp - 0x68]
or r9, 0xffffffffffffffff
call fcn.14000c8e0
cmp word [rbp + 0xb0], di
jne 0x14000a663
mov r8, rdi
jmp 0x14000a67a
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x14000a670
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x68]
call fcn.14000d280
mov rdx, qword [0x1400553a8]
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rdi
mov word [rsp + 0x78], di
cmp word [rdx], di
jne 0x14000a6ac
mov r8, rdi
jmp 0x14000a6ba
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x14000a6b0
lea rcx, [rsp + 0x78]
call fcn.14000d3f0
movzx esi, word [0x14005799c]
mov r14, qword [0x1400575d8]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
lea r13, vtable.DialogBase.0
xor ecx, ecx
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], r13
mov word [rbp - 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, 0x3ff
movzx eax, ax
mov r12d, 0xd
and ax, bx
cmp r15w, ax
je 0x14000a722
mov byte [rbp - 0x20], dil
cmp r12w, ax
jne 0x14000a726
mov byte [rbp - 0x20], r15b
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, vtable.CDataCollectionAgreementDlg.0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov byte [rbp - 0x18], r15b
mov qword [rbp + 8], 7
mov qword [rbp - 0x40], rax
mov qword [rbp], rdi
mov word [rbp - 0x10], di
call fcn.14000c8e0
cmp qword [rbp - 0x50], 8
lea rax, [rbp - 0x68]
cmovae rax, qword [rbp - 0x68]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x48], rax
mov word [rbp + 0x10], si
call fcn.14000f6b0
cmp qword [rbp - 0x70], 8
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rdi
jb 0x14000a7cd
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000a7cd
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14000a7c4
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000a7cd
lea rcx, [rsp + 0x48]
xor edx, edx
call rax
lea rcx, [rbp - 0x40]
call fcn.14000ed50
test eax, eax
jne 0x14000a7ec
lea rcx, str.Admin_Password_Set_on_the_device__No_additional_dialogue_will_be_shown
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000a994
cmp eax, 2
jne 0x14000a819
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call qword [rax + 8]
test al, al
jne 0x14000a994
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
mov edx, 0x1f8
call qword [rax + 0x10]
jmp 0x14000a994
cmp eax, r15d
jne 0x14000a994
mov rdx, qword [0x1400553a8]
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rdi
mov word [rsp + 0x78], di
cmp word [rdx], di
jne 0x14000a844
mov r8, rdi
jmp 0x14000a85a
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x14000a850
lea rcx, [rsp + 0x78]
call fcn.14000d3f0
movzx esi, word [0x14005799c]
mov r14, qword [0x1400575d8]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
xor ecx, ecx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], rdi
mov word [rbp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
and ax, bx
cmp r15w, ax
je 0x14000a8b0
mov byte [rbp + 0x40], dil
cmp r12w, ax
jne 0x14000a8b4
mov byte [rbp + 0x40], r15b
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x30], rax
lea rax, vtable.CDataCollectionNotificationDlg.0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov qword [rbp + 0x60], 7
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x20], rax
mov word [rbp + 0x48], di
call fcn.14000c8e0
cmp qword [rbp - 0x70], 8
mov word [rbp + 0x68], si
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x30], rdi
jb 0x14000a936
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000a936
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14000a92d
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000a936
lea rcx, [rsp + 0x48]
xor edx, edx
call rax
mov rax, qword [rbp + 0x20]
lea rcx, [rbp + 0x20]
call qword [rax + 8]
test al, al
jne 0x14000a955
mov rax, qword [rbp + 0x20]
lea rcx, [rbp + 0x20]
mov edx, 0x1f5
call qword [rax + 0x10]
cmp qword [rbp + 0x60], 8
jb 0x14000a994
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000a994
mov r8, qword [0x1400575e8]
test r8, r8
jne 0x14000a98a
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000a99b
lea rcx, [rsp + 0x48]
xor edx, edx
call r8
mov r8, qword [0x1400575e8]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000a9b3
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov r8, qword [0x1400575e8]
cmp qword [rbp + 8], 8
jb 0x14000a9eb
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000a9eb
test r8, r8
jne 0x14000a9e1
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000a9eb
lea rcx, [rsp + 0x48]
xor edx, edx
call r8
lea rcx, [rbp + 0x3d0]
mov qword [rbp + 8], 7
mov qword [rbp], rdi
mov word [rbp - 0x10], di
call fcn.140019920
cmp qword [rbp - 0x50], 8
jb 0x14000aa42
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000aa42
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14000aa39
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000aa42
lea rcx, [rsp + 0x48]
xor edx, edx
call rax
lea rcx, [rbp + 0x70]
call fcn.14000c740
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x1c30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1400575d8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rbp + 0xa8], 8
mov r14, qword [rsp + 0x1c28]
mov r12, qword [rsp + 0x1c68]
jb 0x14000aacd
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000aacd
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14000aac4
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000aacd
lea rcx, [rsp + 0x68]
xor edx, edx
call rax
mov eax, edi
mov r15, qword [rsp + 0x1c20]
mov rcx, qword [rbp + 0x1b10]
xor rcx, rsp
call fcn.140023790
add rsp, 0x1c38
pop rdi
pop rsi
pop rbx
pop rbp
ret