Function at 0x14000bcd0
Capabilities:
Copy file
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r12, rcx
xor sil, sil
mov qword [rbp + 0x18], 7
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
lea rbx, [0x140042da0]
mov rdx, rbx
add rcx, 0x28
call fcn.14000fc30
mov qword [rsp + 0x50], rax
mov rcx, qword [r12 + 0x30]
lea r14d, [r13 + 1]
or r15, 0xffffffffffffffff
cmp rax, rcx
je 0x14000bde0
lea rdx, [rax + 0x18]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000bd63
mov rdx, qword [rdx]
cmp qword [0x140042db8], 8
cmovae rbx, qword [0x140042da0]
mov rdi, r8
mov r9, qword [0x140042db0]
cmp r9, r8
cmovb rdi, r9
test rdi, rdi
je 0x14000bdb3
nop dword [rax]
movzx eax, word [rdx]
cmp word [rbx], ax
jne 0x14000bda7
add rbx, 2
add rdx, 2
dec rdi
jne 0x14000bd90
jmp 0x14000bdb3
mov edi, r14d
cmp word [rbx], ax
cmovb edi, r15d
jmp 0x14000bdb6
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x14000bdd0
cmp r9, r8
jae 0x14000bdc7
mov eax, r15d
jmp 0x14000bdd0
mov eax, r13d
cmp r9, r8
setne al
test eax, eax
sets al
test al, al
jne 0x14000bde0
lea rax, [rsp + 0x50]
jmp 0x14000bdea
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov rax, qword [rax]
cmp rax, rcx
je 0x14000c11a
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp]
call fcn.14000ab50
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r13
mov word [rbp - 0x28], r13w
mov dword [rsp + 0x58], r13d
mov eax, 2
mov r12d, 0x400
mul r12
mov rdi, rax
cmovo rdi, r15
mov rbx, r13
mov dword [rsp + 0x60], r13d
mov rax, qword [0x140044d08]
test rax, rax
jne 0x14000be59
call fcn.1400185b0
mov qword [0x140044d08], rax
test rax, rax
je 0x14000be6d
mov r8, qword [rbp + 0x58]
lea r9, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call rax
mov rbx, rax
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x78], r13w
mov r9, r15
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x78]
call fcn.14000ab50
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.14000c190
nop
mov qword [rsp + 0x50], r13
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000bf00
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000bf36
mov eax, dword [rbp - 0x40]
lea eax, [rax + rax + 2]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
mov dword [rsp + 0x28], eax
cmovae rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, r14d
xor r8d, r8d
lea rdx, str.CFMFileName
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000c073
cmp qword [rbp - 0x40], 0
je 0x14000c03f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
mov edi, dword [rsp + 0x58]
cmp edi, 0x800
jbe 0x14000bfc9
shr edi, 1
sub edi, 0xffffff80
mov rcx, rbx
call fcn.140016db0
mov edx, edi
mov eax, 2
mul rdx
cmovo rax, r15
mov rcx, rax
call fcn.140016e40
mov rbx, rax
test rax, rax
je 0x14000bfc9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000b2e0
mov r8d, 3
lea rdx, [0x140037ae0]
lea rcx, [rbp - 0x28]
call fcn.14000b180
mov r9, r15
xor r8d, r8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.14000aa20
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rcx, qword [rbp]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movzx esi, sil
test eax, eax
cmovne esi, r14d
test rbx, rbx
je 0x14000c073
mov qword [rsp + 0x60], rbx
mov rdi, qword [0x140044d10]
test rdi, rdi
jne 0x14000c069
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14000c07a
mov edx, r14d
lea rcx, [rsp + 0x60]
call rdi
mov rdi, qword [0x140044d10]
cmp qword [rbp - 0x38], 8
jb 0x14000c0b8
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000c0b8
test rdi, rdi
jne 0x14000c0a8
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14000c0b8
xor edx, edx
lea rcx, [rsp + 0x70]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x50], r13w
cmp qword [rbp - 0x10], 8
jb 0x14000c107
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000c107
test rdi, rdi
jne 0x14000c0f7
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14000c107
xor edx, edx
lea rcx, [rsp + 0x78]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r13
mov word [rbp - 0x28], r13w
jmp 0x14000c121
mov rdi, qword [0x140044d10]
cmp qword [rbp + 0x18], 8
jb 0x14000c158
mov rcx, qword [rbp]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x14000c158
test rdi, rdi
jne 0x14000c14f
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14000c158
xor edx, edx
lea rcx, [rsp + 0x68]
call rdi
movzx eax, sil
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret