Function at 0x14000d190
Capabilities:
Check if file exists
Delete registry value
Get thread local storage value
Get token membership
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor esi, esi
mov qword [rbp - 0x58], r9
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x60], r8
mov qword [rbp + 0x58], rdx
mov rdi, r8
mov qword [rsp + 0x78], rcx
mov r15, rcx
mov dword [rsp + 0x68], 0x7b
mov r14d, 1
mov qword [rbp - 8], rsi
mov r13, rcx
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x78], rsi
test rcx, rcx
je 0x14000d218
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], si
jne 0x14000d200
inc rax
cmp rax, 0x21b
ja 0x140033520
cmp dword [0x1400aae30], esi
mov qword [rsp + 0x238], r12
mov r12d, 2
je 0x140033532
test r15, r15
je 0x14000d258
lea rdx, str._NoCache
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rdi, rax
test rax, rax
jne 0x1400335f9
mov rdi, qword [rsp + 0x60]
mov rcx, qword [0x1400aae20]
mov edx, 8
lea r8d, [rdx + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x20], rax
mov r12, rax
test rax, rax
je 0x14003361c
mov dword [rax], 0x6060
mov qword [rax + 0x38], rbx
mov qword [rax + 0x40], rsi
mov qword [rax + 0x50], 0
mov dword [rax + 0x58], esi
mov qword [rax + 0x60], rsi
test r13, r13
je 0x14000d303
mov rax, rbx
cmp word [r13 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14000d2a3
mov rcx, qword [0x1400aae20]
lea r14d, [rax*2 + 2]
mov r8d, r14d
mov edx, 8
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14003366d
mov r8d, esi
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov qword [r12 + 0x48], rdi
test rdi, rdi
je 0x1400336b7
mov rdi, qword [rsp + 0x60]
mov r14d, 1
test rdi, rdi
je 0x14000d313
cmp qword [rdi + 8], 0
jne 0x14000d790
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, dword [0x1400aa9b4]
mov esi, eax
cmp ecx, 0xffffffff
je 0x1400336d3
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsGetValue]
xor r15d, r15d
lea rdx, [rbp + 0x14]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
mov edi, eax
test eax, eax
jne 0x14000d911
cmp dword [rbp + 0x14], 4
jne 0x1400336f4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
lea r9, [rbp + 0x18]
mov r8d, r14d
mov rcx, rax
lea edx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenThreadToken]
test eax, eax
je 0x140033740
lea rax, [rbp + 8]
mov dword [rbp + 0x60], edi
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 2]
mov dword [rsp + 0x48], r15d
lea rcx, [rbp + 0x60]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], r15d
mov dl, 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov word [rbp + 0x64], 0x500
mov qword [rbp + 8], r15
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140033722
mov rdx, qword [rbp + 8]
lea r8, [rbp + 4]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_CheckTokenMembership]
test eax, eax
je 0x140033704
cmp dword [rbp + 4], edi
jne 0x1400336fc
mov edi, r15d
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_FreeSid]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
test edi, edi
js 0x140033764
jne 0x14000d78b
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r15
test r13, r13
je 0x14000d901
xor ecx, ecx
mov byte [rbp + 0x30], 0
mov qword [rbp - 0x80], rcx
mov r14d, ecx
mov qword [rbp + 0x28], rcx
mov edi, r15d
mov qword [rsp + 0x70], rbx
mov esi, r15d
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x48], 0x58
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
mov edx, 0xe
lea r9, [rsp + 0x70]
mov rcx, rax
lea r8d, [rdx - 0xd]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenThreadToken]
test eax, eax
je 0x14000d4c9
xor edx, edx
lea rcx, [rbp + 0x70]
lea r8d, [rdx + 0x58]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14003379c
mov r9d, dword [rbp - 0x48]
lea rax, [rbp - 0x48]
lea r8, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov edx, 0x19
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_GetTokenInformation]
test eax, eax
je 0x1400337a3
mov rcx, qword [rbp + 0x70]
mov edx, 0x42
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_IsWellKnownSid]
test eax, eax
jne 0x1400337b0
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400338df
test edi, edi
je 0x1400338ca
mov r15, rcx
mov qword [rsp + 0x70], rbx
mov qword [rbp + 0x28], r15
mov rcx, rbx
test esi, esi
jne 0x1400338e8
mov rax, qword [rbp - 0x50]
cmp rax, 0xffffffffffffffff
jne 0x1400338fa
cmp rcx, 0xffffffffffffffff
jne 0x140033911
test edi, edi
je 0x14000d520
test r14d, r14d
jne 0x140033921
xor eax, eax
lea rdx, [rbp - 0x80]
mov ecx, 0x2001f
mov qword [rbp - 0x68], rax
mov r14d, eax
mov qword [rbp - 0x80], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
mov edi, eax
test eax, eax
jne 0x14003392a
mov rsi, qword [rbp - 0x80]
xor edi, edi
test rsi, rsi
je 0x140033984
cmp word [r13], 0x5c
jne 0x14000d6a0
cmp word [r13 + 2], 0x5c
jne 0x14000d6a0
nop dword [rax]
inc rbx
cmp word [r13 + rbx*2], r14w
jne 0x14000d570
cmp rbx, 0x21b
jae 0x140033a10
mov rcx, qword [0x1400aae20]
mov edx, 8
mov r8d, 0x462
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400339b2
lea r8, str.PrintersConnections_
mov edx, 0x231
sub r8, rax
mov rcx, rax
nop
lea rax, [rdx + 0x7ffffdcd]
test rax, rax
je 0x14000d5e8
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000d5e8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000d5c0
jmp 0x1400339fe
test rdx, rdx
je 0x1400339fe
xor r10d, r10d
lea rax, [rdi + 0x2a]
mov word [rcx], r10w
cmp rax, r13
je 0x14000d645
mov r9, r13
mov r8d, 0x21c
sub r9, rax
mov rdx, rax
lea rcx, [r8 + 0x7ffffde2]
test rcx, rcx
je 0x14000d638
movzx ecx, word [rdx + r9]
test cx, cx
je 0x14000d638
mov word [rdx], cx
add rdx, 2
sub r8, 1
jne 0x14000d610
jmp 0x140033a07
test r8, r8
je 0x140033a07
mov word [rdx], r10w
cmp word [rax], r10w
je 0x14000d664
mov ecx, 0x2c
cmp word [rax], 0x5c
je 0x14000d89f
add rax, 2
cmp word [rax], r10w
jne 0x14000d650
lea rax, [rbp - 0x68]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [0x1400aae20]
mov r8, rdi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
test ebx, ebx
je 0x140033a1a
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.PrintersDevModePerUser
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000d6e2
mov r14, r13
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140033a26
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x14000d743
mov ecx, dword [rbp - 0x70]
cmp ecx, 0x48
jae 0x140033a41
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140033af6
cmp r15, 0xffffffffffffffff
je 0x14000d782
test r15, r15
je 0x14000d779
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadToken]
test eax, eax
je 0x140033b43
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rdi, rdi
jne 0x140033b4f
mov rdi, qword [rsp + 0x60]
mov r14d, dword [rbp + 0x1a0]
xor eax, eax
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
cmp r14d, 4
je 0x14000d8a7
cmp r14d, 3
je 0x140033b81
cmp dword [rbp + 0x1a8], 0
mov r12d, 3
je 0x14000d93f
mov r15, qword [0x1400aad38]
lea eax, [r14 - 3]
cmp eax, 1
lea rdi, [rbp - 0x40]
lea eax, [r14 - 3]
mov esi, r12d
cmova esi, r14d
cmp eax, 1
mov rbx, qword [r15 + 0x1e8]
cmova rdi, rcx
mov rcx, rbx
call qword [0x1400719c8]
mov r9, rdi
mov dword [rsp + 0x20], esi
mov rdi, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
mov r8, rdi
mov rcx, r13
call rbx
mov ebx, eax
cmp eax, 1
jne 0x14000d924
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x20]
mov edi, 1
mov qword [rcx + 8], r15
mov rax, qword [rbp - 0x60]
mov qword [rcx + 0x10], rax
mov rax, qword [rbp + 0x58]
mov qword [rax], rcx
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, qword [0x1400aae20]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13, rsi
jne 0x140033d64
mov eax, edi
mov r12, qword [rsp + 0x238]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140024ca0
add rsp, 0x240
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov word [rax], cx
jmp 0x14000d65a
mov eax, dword [rcx + 0x30]
mov dword [r12 + 0x54], eax
mov eax, dword [rcx + 0x34]
mov dword [r12 + 0x58], eax
mov eax, dword [rcx]
mov dword [rbp - 0x3c], eax
mov rax, qword [rcx + 8]
mov qword [rbp - 0x30], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x28], rax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x20], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x1c], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x18], eax
movzx eax, word [rcx + 0x24]
mov word [rbp - 0x14], ax
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x38], 0x28
mov dword [rbp - 0x40], 0x38
jmp 0x14000d7cd
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
jmp 0x14000d78b
cmp eax, 0x6bd
jne 0x1400336de
mov edi, r15d
jmp 0x14000d3fe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x68]
call fcn.14000aabc
cmp ebx, 2
je 0x14000da77
lea rcx, [0x1400aaa28]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov rcx, r13
call fcn.14000a750
lea rcx, [0x1400aaa28]
mov r15, rax
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
test r15, r15
jne 0x140033bba
mov rbx, qword [rbp - 8]
mov esi, ebx
mov rcx, r13
call fcn.14000fb68
mov r15, rax
test esi, esi
jne 0x140033c68
test r15, r15
jne 0x140033c99
mov rax, qword [0x1400aad38]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rax]
test r15, r15
je 0x14000da25
cmp r15, rbx
je 0x14000da1d
lea eax, [r14 - 3]
cmp eax, 1
ja 0x140033cf6
mov edi, r12d
lea eax, [r14 - 3]
cmp eax, 1
ja 0x140033cfe
lea rbx, [rbp - 0x40]
mov rcx, qword [r15 + 8]
lea rdx, str.win32spl.dll
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov r9, qword [rsp + 0x60]
lea r8, [rbp - 0x60]
test eax, eax
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rbx
mov rdx, rsi
mov qword [rsp + 0x20], rax
cmovne rdx, r13
mov rcx, r15
call fcn.14000a9cc
sub eax, 1
je 0x14000d83c
cmp eax, 1
je 0x14000da25
mov rbx, qword [rbp - 8]
mov r15, qword [r15]
test r15, r15
jne 0x14000d9a7
mov rcx, qword [rbp + 0x20]
call fcn.14000e14c
mov ecx, dword [rsp + 0x68]
mov ebx, 0x709
cmp ecx, 0x7b
cmove ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
xor eax, eax
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, ebx
jne 0x14000da7e
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x14000d858
test byte [rax + 0x1c], 0x80
je 0x14000d858
jmp 0x140033d35
mov rsi, qword [rsp + 0x78]
jmp 0x14000da25
cmp eax, 5
je 0x14000da51
jmp 0x140033d07
mov ecx, 0x709
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
xor eax, eax
jmp 0x14000d87e
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea r8, str.RouterPreInitEvent
xor edx, edx
mov ecx, r12d
mov rsi, rax
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_OpenEventW]
mov rdi, rax
test rax, rax
jne 0x1400335b0
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x140033590
test byte [rax + 0x1c], 0x20
je 0x140033590
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
lea edx, [rdi + 0x15]
mov r9d, eax
lea r8, [0x140075f40]
mov rcx, qword [rcx + 0x10]
call fcn.14003d1e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
xor r8d, r8d
lea rcx, [0x140075b90]
mov edx, eax
call fcn.140053ce8
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ExitProcess]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rsi, rsi
je 0x1400335e5
mov rcx, rsi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x1400335e5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, eax
mov ecx, 0x69
call fcn.140053b48
or edx, 0xffffffff
call fcn.1400101c8
mov rdi, qword [rsp + 0x60]
xor esi, esi
jmp 0x14000d232
mov rcx, r15
call sym.spoolsv.exe_PrvDllAllocSplStr
mov r13, rax
test rax, rax
je 0x1400336cc
sub rdi, r15
sar rdi, 1
mov word [rax + rdi*2], si
jmp 0x14000d253
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140033659
test byte [rcx + 0x1c], 0x20
je 0x140033659
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075f50]
mov edx, 0xa
lea r9d, [rdx + 0x5e]
call fcn.14003d1e0
cmp r13, r15
je 0x1400336cc
mov rcx, r13
call sym.spoolsv.exe_PrvDllFreeSplStr
xor eax, eax
jmp 0x14000d876
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x14000d2ea
test byte [rcx + 0x1c], 0x20
je 0x14000d2ea
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075f50]
mov edx, 0xa
mov r9d, r14d
call fcn.14003d1e0
nop
jmp 0x14000d2ea
cmp r13, r15
je 0x1400336c4
mov rcx, r13
call sym.spoolsv.exe_PrvDllFreeSplStr
mov rcx, r12
call fcn.14000e14c
xor eax, eax
jmp 0x14000d876
xor r15d, r15d
mov eax, r15d
jmp 0x14000d333
test eax, eax
jle 0x14000d3fe
movzx edi, ax
or edi, 0x80070000
jmp 0x14000d3fe
mov edi, r14d
jmp 0x14000d3fe
mov edi, r14d
jmp 0x14000d3ea
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x14000d3ea
movzx edi, ax
or edi, 0x80070000
jmp 0x14000d3ea
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x14000d3f4
movzx edi, ax
or edi, 0x80070000
jmp 0x14000d3f4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140033755
movzx edi, ax
or edi, 0x80070000
cmp edi, 0x800703f0
cmove edi, r15d
jmp 0x14000d3fe
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140033795
test byte [rcx + 0x1c], 0x20
je 0x140033795
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075fb0]
mov edx, 0xe
mov r9d, edi
call fcn.14003d1e0
test edi, edi
jmp 0x14000d40e
xor ecx, ecx
jmp 0x14000d48b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
mov rcx, qword [rsp + 0x70]
mov eax, 0
cmp rcx, 0xffffffffffffffff
mov edx, 0x8e
mov r14d, 1
cmove rcx, rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov eax, 2
mov r9d, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400337fc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_RevertToSelf]
test eax, eax
jne 0x140033813
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
xor edx, edx
mov dword [rbp], 0x44
lea r9, [rbp]
mov r15d, r14d
lea r8, [rbp + 0xd0]
lea ecx, [rdx + 0x43]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x140033844
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
xor edx, edx
lea rcx, [rbp + 0x70]
lea r8d, [rdx + 0x58]
call sub.msvcrt.dll_memset
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x70], rax
lea r8, [rbp + 0x70]
mov eax, 0
mov dword [rbp + 0x78], 0x60
cmp rcx, 0xffffffffffffffff
cmove rcx, rax
lea r9d, [rax + 0x58]
lea edx, [rax + 0x19]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_SetTokenInformation]
test eax, eax
jne 0x140033898
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
mov rdx, qword [rbp - 0x50]
mov eax, 0
cmp rdx, 0xffffffffffffffff
cmove rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadToken]
test eax, eax
jne 0x1400338c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x14000d4c9
mov edi, r14d
jmp 0x14000d4c9
test r15d, r15d
je 0x1400338df
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadToken]
mov rcx, qword [rsp + 0x70]
mov r15, qword [rbp - 0x80]
jmp 0x14000d4f3
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rcx, qword [rsp + 0x70]
jmp 0x14000d4fb
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x50], rbx
jmp 0x14000d509
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
jmp 0x14000d513
mov byte [rbp + 0x30], 1
jmp 0x14000d520
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
cmp edi, 5
je 0x140033968
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140033968
test byte [rcx + 0x1c], 0x20
je 0x140033968
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075fb0]
mov edx, 0xb
mov r9d, edi
call fcn.14003d1e0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140033977
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edi, edi
mov esi, edi
mov qword [rbp - 0x80], rdi
jmp 0x14000d54c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 5
jne 0x14003399c
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rsi, rax
test rsi, rsi
jne 0x14000d555
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x14000d6eb
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x1400339f1
test byte [rcx + 0x1c], 0x20
je 0x1400339f1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075f50]
mov edx, 0xa
mov r9d, 0x462
call fcn.14003d1e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x14000d696
sub rcx, 2
jmp 0x14000d5f1
sub rdx, 2
jmp 0x14000d641
mov ebx, 0x57
jmp 0x14000d696
lea r14, str.DevMode
jmp 0x14000d6e2
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov ebx, eax
jmp 0x14000d753
call sym.spoolsv.exe_PrvDllAllocSplMem
mov qword [rbp - 0x78], rax
mov rdi, rax
test rax, rax
jne 0x140033a5f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x14000d747
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140033ad7
mov r8d, dword [rbp - 0x70]
mov r9d, 0x8007000d
cmp r8, 0x4c
jb 0x140033ab2
movzx eax, word [rdi + 0x44]
movzx ecx, word [rdi + 0x46]
add eax, ecx
cdqe
cmp r8, rax
jb 0x140033ab2
mov rcx, rdi
call fcn.14000a520
mov r9d, eax
mov ecx, r9d
call fcn.140005408
mov ebx, eax
test eax, eax
je 0x140033ae9
mov rcx, qword [rbp - 0x68]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
mov eax, 2
cmove ebx, eax
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
xor esi, esi
mov edi, esi
mov qword [rbp - 0x78], rsi
jmp 0x140033aeb
xor esi, esi
cmp ebx, 2
cmove ebx, esi
jmp 0x14000d749
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
cmp ebx, 5
je 0x140033b34
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140033b34
test byte [rcx + 0x1c], 0x20
je 0x140033b34
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075fe0]
mov edx, 0xb
mov r9d, ebx
call fcn.14003d1e0
lea rcx, [rbp + 0x28]
call fcn.14000fcdc
nop
jmp 0x14000d78b
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ExitProcess]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140033b68
mov rax, qword [rcx]
mov qword [rbp + 0x38], rax
mov eax, dword [rcx + 0x10]
mov dword [rbp + 0x48], eax
jmp 0x140033b6f
mov qword [rbp + 0x38], rsi
mov dword [rbp + 0x48], esi
mov qword [rbp + 0x40], rdi
lea rdi, [rbp + 0x38]
mov qword [rsp + 0x60], rdi
jmp 0x14000d790
mov eax, dword [rcx + 4]
mov dword [rbp - 0x3c], eax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x30], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x28], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x20], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x1c], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x18], eax
movzx eax, word [rcx + 0x2c]
mov word [rbp - 0x14], ax
mov rax, qword [rcx + 0x30]
jmp 0x14000d8ea
mov rbx, qword [r15 + 0x1e8]
lea eax, [r14 - 3]
cmp eax, 1
lea rdi, [rbp - 0x40]
lea eax, [r14 - 3]
mov esi, r12d
cmova esi, r14d
mov rcx, rbx
cmp eax, 1
cmova rdi, qword [rbp - 0x58]
call qword [0x1400719c8]
mov r9, rdi
mov dword [rsp + 0x20], esi
mov rdi, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
mov r8, rdi
mov rcx, r13
call rbx
mov ebx, eax
test eax, eax
jne 0x140033c13
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x32
jne 0x140033c3c
jmp 0x140033c18
cmp eax, 0x32
jne 0x140033c33
mov rbx, qword [r15 + 0x20]
mov rcx, rbx
call qword [0x1400719c8]
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, r13
call rbx
mov ebx, eax
cmp ebx, 1
je 0x14000d837
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x68]
call fcn.14000aabc
cmp ebx, 2
je 0x14000da77
mov rbx, r15
mov esi, 1
mov qword [rbp - 8], rbx
jmp 0x14000d973
cmp rax, rbx
je 0x14000d986
lea rcx, [0x1400aaa28]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov rcx, r13
call fcn.14006566c
lea rcx, [0x1400aaa28]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
nop
jmp 0x14000d986
cmp r15, rbx
je 0x14000da77
lea eax, [r14 - 3]
mov r9, rdi
cmp eax, 1
lea rcx, [rbp - 0x40]
lea eax, [r14 - 3]
mov rdx, r13
cmova r12d, r14d
lea r8, [rbp - 0x60]
cmp eax, 1
mov dword [rsp + 0x30], r12d
lea rax, [rsp + 0x68]
cmova rcx, qword [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14000a9cc
mov rsi, qword [rsp + 0x78]
cmp eax, 1
je 0x14000d83c
jmp 0x14000da25
mov edi, r14d
jmp 0x14000d9bc
mov rbx, qword [rbp - 0x58]
jmp 0x14000d9cd
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x14000d858
test byte [rax + 0x1c], 0x20
je 0x14000d858
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0xb
jmp 0x140033d40
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0xa
mov rcx, qword [0x1400a92b0]
lea r8, [0x140075f90]
mov r9, rsi
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14004f108
nop
jmp 0x14000d858
mov rcx, r13
call sym.spoolsv.exe_PrvDllFreeSplStr
nop
jmp 0x14000d874