Function at 0x140012af0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11f0
call fcn.140047820
sub rsp, rax
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rsp + 0x1240], rbx
mov rax, qword [0x1400666f0]
xor rax, rsp
mov qword [rsp + 0x11e0], rax
mov r13, rdx
mov qword [rsp + 0xa0], rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov r12, rbx
mov qword [rsp + 0x68], rbx
mov rax, qword [rcx + 0x18]
cmp dword [rax - 0x10], ebx
je 0x140012b8c
lea edx, [rbx + 0x5c]
add rcx, 0x18
call fcn.14000f3d0
xor edx, edx
lea r8d, [rbx + 0x5c]
lea rcx, [rsi + 0x18]
call fcn.14000f2e0
xor edx, edx
lea r8d, [rbx + 0x5c]
lea rcx, [rsi + 0x18]
call fcn.14000f2e0
mov r12, qword [rsi + 0x18]
mov qword [rsp + 0x68], r12
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, r12
call sub.WINSPOOL.DRV_EnumPrintProcessorsW
mov ecx, dword [rsp + 0x48]
call fcn.140015f00
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x20], ecx
mov r9, rax
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r12
call sub.WINSPOOL.DRV_EnumPrintProcessorsW
test eax, eax
je 0x140013403
call fcn.140018084
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x140012c1a
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb0], rax
movsxd rax, dword [rsp + 0x44]
mov dword [rsi + 0x10], eax
mov rbx, rax
mov eax, 0x10
mul rbx
mov rbp, 0xffffffffffffffff
cmovo rax, rbp
add rax, 8
cmovb rax, rbp
mov rcx, rax
call fcn.140015f00
test rax, rax
je 0x140012c8d
mov dword [rax], ebx
lea rdi, [rax + 8]
lea rax, [0x1400126c0]
mov qword [rsp + 0x20], rax
lea r9, [0x140012720]
mov r8d, ebx
lea edx, [rbp + 0x11]
mov rcx, rdi
call fcn.14002b460
xor ebx, ebx
jmp 0x140012c92
xor ebx, ebx
mov rdi, rbx
mov qword [rsi + 8], rdi
lea rcx, [rsp + 0x98]
call fcn.1400129f0
nop
mov r14d, ebx
cmp dword [rsp + 0x44], 0
jbe 0x1400133b2
mov r15, rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
nop word [rax + rax]
mov rdx, qword [rax]
movsxd r9, r14d
shl r9, 4
add r9, qword [rsi + 8]
test rdx, rdx
jne 0x140012ce7
mov ecx, ebx
jmp 0x140012cf8
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.140008b00
call fcn.140018084
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
je 0x1400133a7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdx, qword [r13]
mov r8d, dword [rdx - 0x10]
test r8d, r8d
je 0x140012db3
lea rcx, [rdx - 0x18]
lea rdi, [rax - 0x18]
cmp rcx, rdi
je 0x140012d8a
cmp dword [rdi + 0x10], 0
jl 0x140012d80
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012d80
call fcn.140008d20
mov rbx, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012d73
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
xor ebx, ebx
jmp 0x140012d8a
lea rcx, [rsp + 0x50]
call fcn.140008b00
xor eax, eax
mov rcx, rbp
lea rdi, str.Environments_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.Environments_
lea rcx, [rsp + 0x50]
call fcn.140006480
jmp 0x140012dda
xor eax, eax
mov rcx, rbp
lea rdi, str.SYSTEMCurrentControlSetControlPrintEnvironments_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SYSTEMCurrentControlSetControlPrintEnvironments_
lea rcx, [rsp + 0x50]
call fcn.140008b00
mov r8, qword [rsp + 0x98]
lea rdx, str._sPrint_Processors_
lea rcx, [rsp + 0x50]
call fcn.140009870
mov rdx, qword [rsi + 8]
mov rdx, qword [r15 + rdx]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140006480
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x40], 0x800
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, str.Driver
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.140018084
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
je 0x14001339c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x1e0]
lea r13, [rsp + 0x1e0]
shr r13, 0x10
test r13, r13
jne 0x140012edf
movzx edi, ax
mov ecx, edi
call fcn.140018070
test rax, rax
je 0x140012ffa
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400079d0
mov rbx, qword [rsp + 0x60]
xor edi, edi
jmp 0x140012ffc
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x1e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140012f56
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140012ff6
cmp dword [rdx + 0x10], eax
jge 0x140012f27
cmp dword [rbx - 0xc], eax
jl 0x140013365
xor edi, edi
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x140012ffc
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012f3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
xor edi, edi
jmp 0x140012ffc
mov r12d, dword [rbx - 0x10]
lea rsi, [rsp + 0x1e0]
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140012f8a
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140008c30
mov rbx, qword [rsp + 0x60]
cmp rsi, r12
ja 0x140012fae
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + rsi*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
mov rcx, rbx
call fcn.140029c4c
jmp 0x140012fcf
movsxd rax, edi
lea r12, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
lea r8, [rsp + 0x1e0]
mov rcx, rbx
call fcn.140029bb4
test edi, edi
js 0x140013391
cmp edi, dword [rbx - 0xc]
jg 0x140013391
mov dword [rbx - 0x10], edi
xor edi, edi
mov word [r12 + rbx], di
mov rsi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x68]
jmp 0x140012ffc
xor edi, edi
jmp 0x140012ffc
xor edi, edi
mov r8d, dword [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x1e0]
call fcn.140029a10
mov dword [rsp + 0x40], 0x800
mov rax, qword [rsi + 8]
lea rdx, str.winprint
mov rcx, qword [r15 + rax]
call fcn.14002b5dc
test eax, eax
je 0x14001305a
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x1e0]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r12
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryW
jmp 0x1400130cc
mov dword [rsp + 0xc0], 0x114
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0xc4], 4
jne 0x1400130b1
cmp dword [rsp + 0xc8], 0
jne 0x1400130b1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x1e0]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r12
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryW
jmp 0x1400130cc
mov dword [rsp + 0x40], 0x800
mov edx, 0x800
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.140018084
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
je 0x140013386
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x1e0]
test r13, r13
jne 0x140013128
movzx edi, ax
mov ecx, edi
call fcn.140018070
test rax, rax
je 0x140013235
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400079d0
jmp 0x140013235
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x1e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x1400131a0
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140013235
cmp dword [rdx + 0x10], eax
jge 0x14001316e
cmp dword [rsi - 0xc], eax
jl 0x140013370
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x140013235
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013184
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x60]
jmp 0x140013235
mov r13d, dword [rsi - 0x10]
lea r12, [rsp + 0x1e0]
sub r12, rsi
sar r12, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400131d4
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140008c30
mov rsi, qword [rsp + 0x58]
cmp r12, r13
ja 0x1400131f8
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rsi + r12*2]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r13
mov rcx, rsi
call fcn.140029c4c
jmp 0x140013219
movsxd rax, edi
lea r13, [rax + rax]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0x1e0]
mov rcx, rsi
call fcn.140029bb4
test edi, edi
js 0x14001337b
cmp edi, dword [rsi - 0xc]
jg 0x14001337b
mov dword [rsi - 0x10], edi
xor eax, eax
mov word [r13 + rsi], ax
lea rdx, [0x140051060]
lea rcx, [rsp + 0x58]
call fcn.1400128f0
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140006480
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 8]
lea rsi, [r15 + rdx + 8]
mov rdx, qword [rsp + 0x58]
lea rbx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rbx, rdi
je 0x1400132c2
cmp dword [rdi + 0x10], 0
jl 0x1400132b6
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x1400132b6
mov rcx, rbx
call fcn.140008d20
mov r12, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400132ac
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [r12 + 0x18]
mov qword [rsi], rax
jmp 0x1400132c2
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.140008b00
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, ebp
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400132eb
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001330b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001332a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r14d
mov rax, qword [rsp + 0x88]
add rax, 8
mov qword [rsp + 0x88], rax
add r15, 0x10
cmp r14d, dword [rsp + 0x44]
jae 0x1400133b2
mov rsi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0xa0]
xor ebx, ebx
jmp 0x140012cd0
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80070057
call fcn.1400065f0
int3
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80004005
call fcn.1400065f0
nop
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80004005
call fcn.1400065f0
nop
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov rcx, qword [rsp + 0x80]
call fcn.140015f08
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400133e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140013403
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x11e0]
xor rcx, rsp
call fcn.140029b10
mov rbx, qword [rsp + 0x1240]
add rsp, 0x11f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret