Function at 0x14000dea0
Capabilities:
Copy file
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor sil, sil
mov qword [rbp - 1], 7
xor r14d, r14d
mov qword [rbp - 9], r14
mov word [rbp - 0x19], r14w
lea rdi, [rcx + 0x20]
lea rbx, [0x140054dd0]
mov rdx, rbx
mov rcx, rdi
call fcn.140013680
mov rcx, qword [rdi]
lea r12d, [r14 + 1]
or r15, 0xffffffffffffffff
cmp rax, rcx
je 0x14000df9c
lea r8, [rax + 0x20]
mov r10, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14000df2c
mov r8, qword [r8]
cmp qword [0x140054de8], 8
cmovae rbx, qword [0x140054dd0]
mov r9, r10
mov r11, qword [0x140054de0]
cmp r11, r10
cmovb r9, r11
test r9, r9
jmp 0x14000df74
movzx edx, word [r8]
cmp word [rbx], dx
jne 0x14000df68
add rbx, 2
add r8, 2
dec r9
jmp 0x14000df74
mov r9d, r12d
cmp word [rbx], dx
cmovb r9d, r15d
jmp 0x14000df79
jne 0x14000df52
mov r9d, r14d
movsxd rdx, r9d
test r9d, r9d
jne 0x14000df94
cmp r11, r10
jae 0x14000df8b
mov edx, r15d
jmp 0x14000df94
mov edx, r14d
cmp r11, r10
setne dl
test edx, edx
mov qword [rbp - 0x79], rax
jns 0x14000dfa0
mov qword [rbp - 0x79], rcx
lea rax, [rbp - 0x79]
mov rax, qword [rax]
cmp rax, rcx
je 0x14000e2ba
lea rdx, [rax + 0x40]
lea rax, [rbp - 0x19]
cmp rax, rdx
je 0x14000dfcc
mov r9, r15
xor r8d, r8d
lea rcx, [rbp - 0x19]
call fcn.14000c8e0
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r14
mov word [rbp + 7], r14w
mov dword [rbp - 0x69], r14d
mov eax, 2
mov r13d, 0x400
mul r13
mov rdi, rax
cmovo rdi, r15
mov rbx, r14
mov dword [rbp - 0x71], r14d
mov rax, qword [0x1400575f0]
test rax, rax
jne 0x14000e01a
call fcn.140021790
mov qword [0x1400575f0], rax
test rax, rax
je 0x14000e02d
mov r8, qword [rbp + 0x5f]
lea r9, [rbp - 0x71]
mov edx, r12d
mov rcx, rdi
call rax
mov rbx, rax
mov qword [rbp - 0x49], 7
mov qword [rbp - 0x51], r14
mov word [rbp - 0x61], r14w
mov r9, r15
xor r8d, r8d
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x61]
call fcn.14000c8e0
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x39]
call fcn.14000e330
nop
mov qword [rbp - 0x79], r14
lea r8, [rbp - 0x79]
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000e0bd
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000e0f5
mov eax, dword [rbp - 0x29]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
mov dword [rsp + 0x28], eax
cmovae rcx, qword [rbp - 0x39]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
xor r8d, r8d
lea rdx, str.CFMFileName
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000e22f
cmp qword [rbp - 0x29], 0
je 0x14000e201
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rbx
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
mov edi, dword [rbp - 0x69]
cmp edi, 0x800
jbe 0x14000e184
shr edi, 1
sub edi, 0xffffff80
mov rcx, rbx
call fcn.14001ffe0
mov ecx, edi
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.140020070
mov rbx, rax
test rax, rax
je 0x14000e184
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
cmp word [rbx], 0
jne 0x14000e18f
mov r8, r14
jmp 0x14000e19d
mov r8, r15
inc r8
cmp word [rbx + r8*2], 0
jne 0x14000e192
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.14000d3f0
mov r8d, 3
lea rdx, [0x140046150]
lea rcx, [rbp + 7]
call fcn.14000d280
mov r9, r15
xor r8d, r8d
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14000c7a0
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movzx esi, sil
test eax, eax
cmovne esi, r12d
mov qword [rbp - 0x71], rbx
mov r8, qword [0x1400575e8]
test r8, r8
jne 0x14000e225
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000e236
mov edx, r12d
lea rcx, [rbp - 0x71]
call r8
mov r8, qword [0x1400575e8]
cmp qword [rbp - 0x21], 8
jb 0x14000e273
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x71], rax
test rax, rax
je 0x14000e273
test r8, r8
jne 0x14000e263
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000e273
xor edx, edx
lea rcx, [rbp - 0x71]
call r8
mov r8, qword [0x1400575e8]
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x39], r14w
cmp qword [rbp + 0x1f], 8
jb 0x14000e2c1
mov rax, qword [rbp + 7]
mov qword [rbp - 0x71], rax
test rax, rax
je 0x14000e2c1
test r8, r8
jne 0x14000e2b1
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000e2c1
xor edx, edx
lea rcx, [rbp - 0x71]
call r8
mov r8, qword [0x1400575e8]
cmp qword [rbp - 1], 8
jb 0x14000e2f7
mov rcx, qword [rbp - 0x19]
mov qword [rbp - 0x79], rcx
test rcx, rcx
je 0x14000e2f7
test r8, r8
jne 0x14000e2ee
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000e2f7
xor edx, edx
lea rcx, [rbp - 0x79]
call r8
movzx eax, sil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret