Function at 0x140009d90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov r15d, 0x80070057
test rcx, rcx
je 0x140009f7a
cmp word [rcx], 0x5c
jne 0x140009f7a
cmp word [rcx + 2], 0x5c
jne 0x140009f7a
mov r8d, 9
lea rdx, str.http:__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x140009f7a
mov r8d, 0xa
lea rdx, str.https:__
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x140009f7a
cmp word [rbx], 0
je 0x140009e40
mov r8d, 6
lea rdx, str.CSR
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x140009f7a
xor r12d, r12d
mov r14d, r12d
add rbx, 4
je 0x140009ec9
mov ecx, 0x40e
call fcn.140024914
mov r14, rax
test rax, rax
je 0x140009f7a
mov r8, rbx
mov qword [rbp - 0x41], rax
sub r8, rax
mov edx, 0x207
mov r9d, r12d
lea rcx, [rdx + 0x7ffffdf7]
test rcx, rcx
je 0x140009e9c
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140009e9c
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140009e74
jmp 0x14002a794
test rdx, rdx
je 0x14002a794
mov word [rax], r12w
test r9d, r9d
js 0x14002a7a3
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140009ec9
mov word [rax], r12w
test r14, r14
je 0x140009f7a
test byte [0x1400ab340], 2
jne 0x14002a7eb
mov rdi, qword [0x1400aae98]
mov qword [rbp - 0x59], r12
lea rcx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
inc dword [rdi + 0x6c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
lea rbx, [rdi + 0x80]
mov dword [rdi + 0x68], eax
mov rsi, r12
mov r15d, 1
test rbx, rbx
je 0x140009f3b
mov rsi, qword [rbx + 0x10]
test rbx, rbx
je 0x140009f3b
cmp rsi, rbx
je 0x140009f3b
mov rcx, qword [rsi + 0x30]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14002a800
mov r15d, r12d
add dword [rdi + 0x6c], 0xffffffff
mov eax, dword [rdi + 0x6c]
jne 0x140009f48
mov dword [rdi + 0x68], r12d
lea rcx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
mov rsi, qword [rbp - 0x59]
test rsi, rsi
jne 0x14002a865
cmp r15d, 1
je 0x140009fa5
test byte [0x1400ab340], 2
jne 0x14002a96a
mov rcx, r14
call fcn.140024954
mov eax, r15d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140024ca0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r12
mov rcx, r14
mov rsi, rax
call fcn.140020794
test eax, eax
je 0x14002a884
lea rcx, [rbp - 0x29]
call fcn.1400165c0
lea rcx, [rbp - 1]
call fcn.1400165c0
lea r9, [rbp - 1]
mov byte [rsp + 0x20], r12b
lea r8, [rbp - 0x29]
mov rdx, r14
mov rcx, rdi
call fcn.140015fa4
mov r15d, eax
test eax, eax
jne 0x14002a909
lea r8, [rbp - 0x29]
mov rdx, r14
mov rcx, rdi
call fcn.140024708
mov r15d, eax
lea rcx, [rbp - 1]
call fcn.140016520
lea rcx, [rbp - 0x29]
call fcn.140016520
mov rcx, rsi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x140009f65
jmp 0x14002a95b
sub rax, 2
mov r9d, 0x8007007a
jmp 0x140009ea5
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x14002a7d9
test byte [rcx + 0x1c], 0x20
je 0x14002a7d9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075fd0]
mov dword [rsp + 0x20], r9d
mov edx, 0xb
mov r9, rbx
call fcn.14004f108
lea rcx, [rbp - 0x41]
call fcn.140022bd4
mov r14, qword [rbp - 0x41]
jmp 0x140009ec9
mov r8, r14
lea rdx, [0x140092f28]
call fcn.140064384
nop
jmp 0x140009edf
lea r8, [rbp - 0x59]
mov rdx, r14
mov rcx, rsi
call fcn.1400691f8
mov r15d, eax
test eax, eax
je 0x14002a81f
mov rsi, qword [rsi + 0x10]
jmp 0x140009f19
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov rdx, qword [rbp - 0x59]
sub eax, dword [rdx + 0x38]
cmp eax, dword [rdi + 4]
jbe 0x14002a85c
mov rcx, qword [rdx + 0x10]
mov r15d, 1
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov qword [rdx + 0x10], rdx
mov qword [rdx + 0x18], rdx
jmp 0x140009f3b
mov qword [rbp - 0x59], r12
jmp 0x140009f3b
mov rax, qword [rsi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x1400719c8]
mov edx, 1
mov rcx, rsi
call rbx
nop
jmp 0x140009f5f
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x14002a8fe
lea r8, [rbp - 0x51]
mov qword [rbp - 0x51], r12
mov rdx, rdi
call fcn.140069694
mov rcx, rdi
mov ebx, eax
call fcn.140024954
test ebx, ebx
jne 0x14002a8fe
lea ecx, [rbx + 0x40]
call fcn.140024914
test rax, rax
je 0x14002a8fe
mov rdx, r14
mov rcx, rax
call fcn.14001665c
mov rdi, rax
test rax, rax
je 0x14002a8fe
cmp dword [rax + 0x3c], r12d
jl 0x14002a8e5
mov rcx, qword [rbp - 0x51]
mov rdx, rax
mov rcx, qword [rcx + 0x48]
call fcn.140016590
test eax, eax
jns 0x14002a8fe
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x1400719c8]
mov edx, 1
mov rcx, rdi
call rbx
mov r15d, 0x80004005
jmp 0x14000a01e
cmp ax, 0x2af9
jne 0x14000a00c
lea rax, [0x1400ab2c0]
mov dword [rbp - 0x39], 0x67727473
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x31], rax
mov rcx, r14
call fcn.140069090
mov rbx, qword [rbp - 0x31]
mov r15d, eax
test eax, eax
jne 0x14002a94d
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140068994
mov r15d, eax
mov rdx, rbx
call fcn.140016834
nop
jmp 0x14000a00c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ExitProcess]
mov r8, r14
lea rdx, [0x140092db8]
call fcn.140064384
nop
jmp 0x140009f72