Function at 0x140004410
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4b8
mov qword [rsp + 0x4a0], 0xfffffffffffffffe
mov rax, qword [0x1400666f0]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
lea rdx, str.SYSTEMCurrentControlSetControlPrint
lea rcx, [rsp + 0x50]
call fcn.140007430
nop
lea rcx, [rsp + 0x488]
call fcn.1400073d0
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140004494
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
lea r8, [rsp + 0x480]
lea rdx, str.SeBackupPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400044cc
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
mov dword [rsp + 0x490], 1
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x494], rax
mov dword [rsp + 0x49c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rsp + 0x490]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [rsp + 0x47c], eax
cmp dword [rsp + 0x47c], 0
jne 0x14000454d
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
lea rcx, [rsp + 0x50]
call fcn.140007570
mov rdx, rax
lea rax, [rsp + 0x478]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x47c], eax
cmp dword [rsp + 0x47c], 0
je 0x1400045ce
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
lea rdx, [rsp + 0x70]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r9, qword [rsp + 0x4c0]
mov r9, qword [r9]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_lmprint.hiv
lea rcx, [rsp + 0x488]
call fcn.140009820
lea rcx, [rsp + 0x488]
call fcn.1400043e0
lea rcx, [rsp + 0x488]
call fcn.140007570
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov dword [rsp + 0x47c], eax
cmp dword [rsp + 0x47c], 0
je 0x140004692
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrint
lea rcx, [rsp + 0x50]
call fcn.140007540
lea rcx, [rsp + 0x50]
call fcn.140007570
mov rdx, rax
lea rax, [rsp + 0x478]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x47c], eax
cmp dword [rsp + 0x47c], 0
je 0x140004766
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140029a10
lea rdx, [rsp + 0x70]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r9, qword [rsp + 0x4c0]
mov r9, qword [r9]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_lmpnp.hiv
lea rcx, [rsp + 0x488]
call fcn.140009820
lea rcx, [rsp + 0x488]
call fcn.1400043e0
lea rcx, [rsp + 0x488]
call fcn.140007570
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov dword [rsp + 0x47c], eax
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Printers
lea rcx, [rsp + 0x50]
call fcn.140007540
lea rcx, [rsp + 0x50]
call fcn.140007570
mov rdx, rax
lea rax, [rsp + 0x478]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x47c], eax
cmp dword [rsp + 0x47c], 0
je 0x1400048b5
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
jmp 0x14000498a
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140029a10
lea rdx, [rsp + 0x70]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r9, qword [rsp + 0x4c0]
mov r9, qword [r9]
lea r8, [rsp + 0x70]
lea rdx, str._s_s_cuprinter.hiv
lea rcx, [rsp + 0x488]
call fcn.140009820
lea rcx, [rsp + 0x488]
call fcn.1400043e0
lea rcx, [rsp + 0x488]
call fcn.140007570
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov dword [rsp + 0x47c], eax
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x488]
call fcn.1400074f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400074f0
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140029b10
add rsp, 0x4b8
ret