Function at 0x14003e910
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa18
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0xa00], rax
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0xa38]
mov rdi, rax
lea rsi, [rcx + 0x60]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
call fcn.14000aa60
lea r8, [rsp + 0x60]
lea rdx, [0x1402ae568]
mov rcx, rax
call fcn.140009ef0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa38]
mov rdi, rax
lea rsi, [rcx + 0x60]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
call fcn.14000a9d0
lea r8, [rsp + 0x80]
lea rdx, [0x1402ae6a8]
mov rcx, rax
call fcn.140009ef0
mov rax, qword [rsp + 0xa38]
add rax, 0x60
mov rcx, rax
call fcn.140013df0
movzx eax, al
test eax, eax
je 0x14003e9ce
xor eax, eax
jmp 0x14003eda6
mov rdx, qword [rsp + 0xa38]
mov rcx, qword [rsp + 0xa30]
call fcn.14003dc00
xor edx, edx
mov cx, 0xa
call fcn.14000d790
movzx eax, al
test eax, eax
je 0x14003eb0c
mov edx, 0x88
lea rcx, [rsp + 0x340]
call fcn.140004bc0
lea rcx, [rsp + 0x340]
call fcn.1400ce610
nop
mov edx, 0x88
lea rcx, [rsp + 0x2b0]
call fcn.140004bc0
lea rcx, [rsp + 0x2b0]
call fcn.1400ce610
nop
mov edx, 0x88
lea rcx, [rsp + 0x220]
call fcn.140004bc0
lea rcx, [rsp + 0x220]
call fcn.1400ce610
nop
mov rax, qword [rsp + 0xa38]
add rax, 0x60
mov rcx, rax
call fcn.14000ab60
mov r8, rax
lea rdx, str.powershell_Add_Printer__Name_Test_WSD_Printer__DeviceURL__s
lea rcx, [rsp + 0x220]
call fcn.1400ceddc
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x220]
mov rcx, qword [rsp + 0x40]
call fcn.1400ce5b8
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov r9d, 0xffffffff
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x340]
mov rcx, qword [rsp + 0x48]
call fcn.140023540
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x220]
call fcn.1400ce724
nop
lea rcx, [rsp + 0x2b0]
call fcn.1400ce724
nop
lea rcx, [rsp + 0x340]
call fcn.1400ce724
mov eax, dword [rsp + 0x30]
jmp 0x14003eda6
mov rax, qword [rsp + 0xa38]
add rax, 0x2a8
mov rcx, rax
call fcn.1400406f0
movzx eax, al
test eax, eax
je 0x14003eb30
xor eax, eax
jmp 0x14003eda6
lea rax, [rsp + 0x3d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x5e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x3d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [rsp + 0x3d0]
lea rdx, [0x1402ae5e0]
lea rcx, [rsp + 0x5e0]
call fcn.1400417e0
lea r8, [rsp + 0x3d0]
lea rdx, str._sOPPrintUI.exe
lea rcx, [rsp + 0x7f0]
call fcn.1400417e0
lea rax, [rsp + 0x1a0]
mov rdi, rax
xor eax, eax
mov ecx, WSAStartup
rep stosb byte [rdi], al
lea rax, [rsp + 0x1a0]
mov rdi, rax
xor eax, eax
mov ecx, WSAStartup
rep stosb byte [rdi], al
mov dword [rsp + 0x1a0], WSAStartup
lea rax, [0x1402ae728]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x1b8], rax
lea rax, [0x1402ae708]
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x1d0], 0
mov dword [rsp + 0x1a4], Ordinal_74
mov rax, qword [rsp + 0xa38]
add rax, 0x60
mov rcx, rax
call fcn.14000ab60
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, WSAStartup
rep stosb byte [rdi], al
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, WSAStartup
rep stosb byte [rdi], al
mov dword [rsp + 0x130], WSAStartup
lea rax, [0x1402ae6f8]
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x7f0]
mov qword [rsp + 0x148], rax
lea rax, [0x1402ae6d8]
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x160], 0
mov dword [rsp + 0x134], Ordinal_74
mov rax, qword [rsp + 0xa38]
add rax, 0x60
mov rcx, rax
call fcn.14000ab60
mov qword [rsp + 0x150], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14003ed43
mov edx, 0xea60
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x34], eax
mov edx, reloc.libcurl_x64.dll_Ordinal_14
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, [rsp + 0x210]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x210], 0xe
jne 0x14003ed6e
mov eax, reloc.libcurl_x64.dll_Ordinal_14
jmp 0x14003eda6
mov edx, 0xea60
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x3c], eax
xor edx, edx
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rsp + 0x208], 0
mov eax, 1
mov rcx, qword [rsp + 0xa00]
xor rcx, rsp
call fcn.14013a450
add rsp, 0xa18
pop rdi
pop rsi
ret