Function at 0x140010650
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov rdi, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rbx, vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____cdecl___void____ptr64__unsigned_long_int__void____ptr64___void____ptr64__int__struct_std::_Ph_1__const____ptr64___int__wchar_t____ptr64_.0
mov qword [rbp + 0x70], rbx
mov rdx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x78], rdx
movzx edx, byte [rsp + 0x50]
mov byte [rbp + 0x80], dl
xor r13d, r13d
mov dword [rbp + 0x84], r13d
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0xa8], rax
mov dword [rsp + 0x54], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r14d, 1
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140010705
mov ebx, r13d
jmp 0x1400108ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0x120], rbx
mov rcx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x128], rcx
movzx ecx, byte [rsp + 0x50]
mov byte [rbp + 0x130], cl
mov dword [rbp + 0x134], r13d
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x158], rax
mov ebx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rbp + 0x108], r13
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x1400107ca
lea rax, [rbp + 0x120]
cmp rcx, rax
jne 0x1400107b9
mov rax, qword [rcx]
lea rdx, [rbp + 0xd0]
call qword [rax + 8]
mov qword [rbp + 0x108], rax
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x1400107ca
mov rax, qword [rcx]
lea rdx, [rbp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400107c0
mov qword [rbp + 0x108], rcx
mov rcx, r13
mov qword [rbp + 0x158], rcx
mov qword [rbp + 0x110], rbx
test rcx, rcx
je 0x1400107f7
mov rax, qword [rcx]
lea rdx, [rbp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x158], r13
mov rbx, qword [rbp + 0x110]
test rbx, rbx
jne 0x140010860
lea ecx, [rbx + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x140010832
mov qword [rsp + 0x60], rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x140010f57
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x140010858
mov rax, qword [rcx]
lea rdx, [rbp + 0xd0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x108], r13
mov rbx, r13
jmp 0x1400108ed
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
je 0x140010898
mov rbx, qword [rbp + 0x110]
mov rax, r13
mov qword [rbp + 0x110], rax
jmp 0x1400108a2
mov rbx, r13
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x1400108c7
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x140010f5d
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400108ed
mov rax, qword [rcx]
lea rdx, [rbp + 0xd0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x108], r13
mov rcx, r13
mov qword [rbp + 0x198], rcx
mov r8, qword [rbp + 0xa8]
test r8, r8
je 0x14001095f
lea rax, [rbp + 0x70]
mov rcx, r8
cmp r8, rax
jne 0x14001094e
mov rax, qword [r8]
lea rdx, [rbp + 0x160]
call qword [rax + 8]
mov rcx, rax
mov qword [rbp + 0x198], rax
mov r8, qword [rbp + 0xa8]
test r8, r8
je 0x14001095f
mov rax, qword [r8]
lea rcx, [rbp + 0x70]
cmp r8, rcx
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x198]
jmp 0x140010955
mov qword [rbp + 0x198], rcx
mov qword [rbp + 0xa8], r13
mov r8, r13
mov qword [rbp + 0x1a0], rbx
test r8, r8
je 0x140010993
mov rax, qword [r8]
lea rcx, [rbp + 0x70]
cmp r8, rcx
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov qword [rbp + 0xa8], r13
mov rbx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x198]
test rbx, rbx
je 0x140010ee6
mov r8d, 0x104
lea rdx, [rbp + 0x200]
lea rax, [rbp + 0x200]
mov r9, rbx
sub r9, rax
nop word [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x1400109e3
movzx eax, word [r9 + rdx]
test ax, ax
je 0x1400109e3
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x1400109c0
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r13w
jne 0x140010a01
mov word [rbp + 0x200], r13w
jmp 0x140010ee6
mov r8d, 0x104
lea rdx, [rbp + 0x410]
lea rax, [rbp + 0x410]
mov r9, rbx
sub r9, rax
nop dword [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x140010a43
movzx eax, word [r9 + rdx]
test ax, ax
je 0x140010a43
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140010a20
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r13w
jne 0x140010a61
mov word [rbp + 0x410], r13w
jmp 0x140010ee6
lea rdx, [0x14002c738]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [0x14002d900]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140010b24
lea r8d, [rax + 0x30]
lea rdx, [rbp + 0x38]
lea rcx, [fcn.140010650]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
ja 0x140010b24
mov r8d, 0x104
lea rdx, [rbp + 0x410]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, str.kvpet.exe
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140010b24
lea r8, str.kvpet.exe
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140010ed8
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140010ed8
mov rdx, rdi
lea rcx, [rbp + 0xb0]
call fcn.140013fa0
mov eax, dword [rbp + 0xc0]
lea r15d, [rax*2 + 2]
mov dword [rsp + 0x68], 0x18
lea rax, [rbp + 0x10]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x68]
lea rcx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
jne 0x140010bb7
mov r14d, r13d
jmp 0x140010e59
mov edi, r15d
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x140010be2
mov r14d, r13d
jmp 0x140010e4a
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae rdx, qword [rbp + 0xb0]
test r15d, r15d
je 0x140010c25
mov r8, rdi
mov rcx, rbx
test rdx, rdx
je 0x140010c10
call fcn.140016dc0
jmp 0x140010c25
call fcn.1400171d0
call fcn.14001b2dc
mov dword [rax], 0x16
call fcn.14001b18c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____cdecl___void____ptr64__unsigned_long_int__void____ptr64___void____ptr64__int__struct_std::_Ph_1__const____ptr64___int__wchar_t____ptr64_.0
mov qword [rbp + 0x70], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x78], rcx
movzx ecx, byte [rsp + 0x50]
mov byte [rbp + 0x80], cl
mov dword [rbp + 0x84], r13d
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, 0x802
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rbp + 0x1e8], r13
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140010ce1
lea rax, [rbp + 0x70]
cmp rcx, rax
jne 0x140010cd0
mov rax, qword [rcx]
lea rdx, [rbp + 0x1b0]
call qword [rax + 8]
mov qword [rbp + 0x1e8], rax
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140010ce1
mov rax, qword [rcx]
lea rdx, [rbp + 0x70]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140010cd7
mov qword [rbp + 0x1e8], rcx
mov rcx, r13
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0x1f0], rdi
test rcx, rcx
je 0x140010d04
mov rax, qword [rcx]
lea rdx, [rbp + 0x70]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rdi, qword [rbp + 0x1f0]
test rdi, rdi
je 0x140010dea
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x200]
mov qword [rsp + 0x30], rax
lea rax, str._s__s_0x_x__0x_x
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1900
xor r9d, r9d
xor r8d, r8d
mov edx, 0x400
mov rcx, rdi
call fcn.140007bc0
test eax, eax
js 0x140010dea
mov dword [rbp - 0x60], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010df5
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140010de0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140010df8
nop
mov dword [0], r13d
jmp 0x140010de0
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, r13d
mov rax, qword [rbp + 0x1f0]
test rax, rax
je 0x140010e24
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x140010f63
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x140010e4a
mov rax, qword [rcx]
lea rdx, [rbp + 0x1b0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x1e8], r13
test rbx, rbx
je 0x140010e59
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
test rsi, rsi
je 0x140010e68
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140010eae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ea9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f69
call fcn.1400151c0
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r13w
mov rbx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x198]
jmp 0x140010ee9
mov rbx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x198]
mov r14d, r13d
test rbx, rbx
je 0x140010f0a
mov qword [rsp + 0x58], rbx
test rcx, rcx
je 0x140010f51
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x140010f24
mov r8, qword [rcx]
lea rax, [rbp + 0x160]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
nop
mov eax, r14d
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.1400153e0
mov rbx, qword [rsp + 0x780]
add rsp, 0x730
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.14001b1ac
int3