Function at 0x140003d50
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov esi, 0x80070057
test rcx, rcx
je 0x1400041cb
cmp word [rcx], 0x5c
jne 0x1400041cb
cmp word [rcx + 2], 0x5c
jne 0x1400041cb
mov r8d, 9
lea rdx, str.http:__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041cb
mov r8d, 0xa
lea rdx, str.https:__
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041cb
cmp word [rbx], 0
je 0x140003e11
mov r8d, 6
lea rdx, str.CSR
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041cb
lea rdi, [rbx + 4]
xor r12d, r12d
mov ebx, r12d
test rdi, rdi
je 0x140003eaf
mov ecx, 0x40e
call fcn.1400130d0
mov qword [rbp - 0x51], rax
mov rbx, rax
test rax, rax
je 0x140003eaf
mov r9, rdi
mov edx, 0x207
mov rcx, rax
call fcn.140016f4c
test eax, eax
js 0x140003e6d
lea edx, [r12 + 0x5c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140003eaf
mov word [rax], r12w
jmp 0x140003eaf
mov rcx, qword [0x1400b72f8]
lea rdx, [0x1400b72f8]
cmp rcx, rdx
je 0x140003ea2
test byte [rcx + 0x44], 0x20
je 0x140003ea2
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009cd18]
mov edx, 0xb
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.14004dac8
lea rcx, [rbp - 0x51]
call fcn.14000e334
mov rbx, qword [rbp - 0x51]
mov rdi, r12
test rbx, rbx
je 0x140003eca
mov rdi, rbx
mov rbx, r12
test rbx, rbx
je 0x140003eca
mov rcx, rbx
call fcn.1400130c4
test rdi, rdi
je 0x1400041cb
test byte [0x1400b9540], 2
mov qword [rsp + 0xf8], r15
je 0x140003ef3
mov r8, rdi
lea rdx, [0x1400a9c68]
call fcn.14006c780
mov r13, qword [0x1400b9530]
mov qword [rbp - 0x59], r12
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r13 + 0x64]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
lea r14, [r13 + 0x78]
mov dword [r13 + 0x60], eax
mov rbx, r12
mov esi, 1
test r14, r14
je 0x140003fc9
mov rbx, qword [r13 + 0x88]
nop
test r14, r14
je 0x140003fc9
cmp rbx, r14
je 0x140003fc9
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140003fc6
lea r8, [rbp - 0x59]
mov rdx, rdi
mov rcx, rbx
call fcn.1400722a4
mov esi, eax
test eax, eax
je 0x140003f80
mov rbx, qword [rbx + 0x10]
jmp 0x140003f40
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x59]
sub eax, dword [rdx + 0x38]
cmp eax, dword [r13 + 4]
jbe 0x140003fc0
mov rcx, qword [rdx + 0x10]
mov esi, 1
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov qword [rdx + 0x10], rdx
mov qword [rdx + 0x18], rdx
jmp 0x140003fc9
mov qword [rbp - 0x59], r12
jmp 0x140003fc9
mov esi, r12d
add dword [r13 + 0x64], 0xffffffff
mov eax, dword [r13 + 0x64]
jne 0x140003fd8
mov dword [r13 + 0x60], r12d
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov r15, qword [rsp + 0xf8]
test rcx, rcx
je 0x14000400a
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140098d68]
cmp esi, 1
jne 0x1400041a6
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r12
mov rcx, rdi
mov r14, rax
call fcn.1400733c4
test eax, eax
jne 0x1400040ae
mov rsi, qword [rbp - 0x49]
test rsi, rsi
je 0x1400040a4
lea r8, [rbp - 0x41]
mov qword [rbp - 0x41], r12
mov rdx, rsi
call fcn.140072a5c
mov rcx, rsi
mov ebx, eax
call fcn.1400130c4
test ebx, ebx
jne 0x1400040a4
lea ecx, [rbx + 0x40]
call fcn.1400130d0
test rax, rax
je 0x1400040a4
mov rdx, rdi
mov rcx, rax
call fcn.140070c00
mov r9, rax
test rax, rax
je 0x1400040a4
cmp dword [rax + 0x3c], r12d
jl 0x140004090
mov rcx, qword [rbp - 0x41]
mov rdx, rax
mov rcx, qword [rcx + 0x48]
call fcn.140063884
test eax, eax
jns 0x1400040a4
mov rax, qword [r9]
mov edx, 1
mov rcx, r9
mov rax, qword [rax]
call qword [0x140098d68]
mov esi, 0x80004005
jmp 0x14000417f
lea rcx, [0x14007d1c0]
mov dword [rbp - 0x29], 0x74736c74
lea rax, [rbp - 0x21]
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x11], rax
lea r9, [rbp - 1]
lea rax, [rbp - 0x21]
mov qword [rbp + 7], rcx
mov qword [rbp - 9], rax
lea r8, [rbp - 0x29]
lea rax, [rbp + 7]
mov dword [rbp - 0x19], 0x6b6e6c74
mov qword [rbp + 0x17], rax
mov rdx, rdi
lea rax, [rbp + 7]
mov dword [rbp - 1], 0x74736c74
mov rcx, r13
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x6b6e6c74
mov byte [rsp + 0x20], r12b
call fcn.140073154
mov esi, eax
test eax, eax
jne 0x14000412a
lea r8, [rbp - 0x29]
mov rdx, rdi
mov rcx, r13
call fcn.140070f10
mov esi, eax
jmp 0x14000416d
cmp ax, 0x2af9
jne 0x14000416d
lea rax, [rbp - 0x31]
mov rcx, rdi
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x39]
xor eax, eax
mov dword [rbp - 0x31], eax
call fcn.140072110
mov esi, eax
test eax, eax
jne 0x140004160
mov rdx, qword [rbp - 0x39]
mov r8, rdi
mov rcx, r13
call fcn.140071098
mov esi, eax
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp - 0x39]
call fcn.140010cb0
lea rcx, [rbp - 1]
call fcn.14004dcb8
lea rcx, [rbp - 0x29]
call fcn.14004dcb8
mov rcx, r14
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x1400041a6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
test byte [0x1400b9540], 2
je 0x1400041be
mov r8, rdi
lea rdx, [0x1400a9be8]
call fcn.14006c780
test rdi, rdi
je 0x1400041cb
mov rcx, rdi
call fcn.1400130c4
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140013440
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret