Function at 0x140006060
Capabilities:
Check if file exists
Delete file
Delete registry value
Get thread local storage value
Get token membership
Move file
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor edi, edi
mov qword [rbp - 0x70], r9
mov qword [rbp + 0x28], rdx
mov eax, 0x7b
mov qword [rbp - 0x38], rcx
mov rbx, r8
mov qword [rsp + 0x68], rbx
mov r12, rcx
mov dword [rsp + 0x60], eax
mov esi, 1
mov dword [rsp + 0x70], eax
lea r13, [rax - 0x7c]
mov qword [rbp - 0x68], rdi
mov r15, rcx
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x48], edi
mov qword [rbp - 0x60], rdi
test rcx, rcx
jne 0x1400068e9
cmp dword [0x1400c9074], edi
mov qword [rsp + 0x378], r14
mov r14d, 2
je 0x140011d68
test r12, r12
jne 0x140006988
mov rcx, qword [0x1400c9078]
mov edx, 8
lea r8d, [rdx + 0x60]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x140011e7a
mov dword [rax], 0x6060
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], rdi
mov qword [rax + 0x50], 0
mov dword [rax + 0x58], edi
mov qword [rax + 0x60], rdi
test r15, r15
jne 0x14000690d
lea r12, [0x1400c72a8]
test rbx, rbx
je 0x14000615d
cmp qword [rbx + 8], 0
jne 0x1400062e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [0x1400c8474]
mov edi, eax
cmp ecx, 0xffffffff
je 0x140011f58
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400061be
cmp eax, 0x6bd
jne 0x140011f5f
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x1400062b0
cmp dword [rsp + 0x78], 4
jne 0x140011f75
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
lea r9, [rbp + 0x10]
mov r8d, esi
mov rcx, rax
mov edx, 8
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140011f9b
xor ebx, ebx
mov dword [rbp + 0x48], 0
lea rax, [rbp - 0x30]
mov word [rbp + 0x4c], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x48]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 2]
mov dword [rsp + 0x38], ebx
mov dl, 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rbp - 0x30], rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x140011f8f
mov rdx, qword [rbp - 0x30]
lea r8, [rsp + 0x7c]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x140011f83
cmp dword [rsp + 0x7c], ebx
jne 0x140011f7c
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test ebx, ebx
js 0x140011fb2
jne 0x1400062dd
mov rcx, r15
call fcn.140006c00
xor edi, edi
mov qword [rbp - 0x78], rdi
mov r12d, edi
mov qword [rbp - 0x60], rdi
test r15, r15
jne 0x1400069b4
lea ecx, [rdi + 6]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x68]
mov r13d, dword [rbp + 0x2e0]
xorps xmm0, xmm0
mov rcx, qword [rbp - 0x70]
xor eax, eax
mov qword [rbp + 8], rax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
cmp r13d, 4
je 0x140006b3c
cmp r13d, 3
je 0x14001225f
cmp dword [rbp + 0x2e8], 0
mov esi, 3
je 0x140006403
mov r12, qword [0x1400c9068]
lea eax, [r13 - 3]
cmp eax, 1
jbe 0x14000696e
mov eax, r13d
mov r9, rcx
movabs r10, 0xf5c10edf10538170
mov dword [rsp + 0x20], eax
lea rdx, [rbp - 0x80]
mov rax, qword [r12 + 0x1e8]
mov r8, rbx
mov rcx, r15
call qword [0x1400a8400]
mov ebx, eax
cmp eax, 1
jne 0x1400063d6
mov qword [r14 + 8], r12
mov ebx, 1
mov rax, qword [rbp - 0x80]
mov qword [r14 + 0x10], rax
mov rax, qword [rbp + 0x28]
mov qword [rax], r14
mov r8, qword [rbp - 0x60]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
cmp r15, qword [rbp - 0x38]
jne 0x1400128af
mov eax, ebx
mov r14, qword [rsp + 0x378]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14000d4b0
add rsp, 0x380
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movabs rdi, 0x200002000b
add eax, 0xffffff85
cmp eax, 1
ja 0x140012298
cmp ebx, 2
je 0x1400067d8
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
test r15, r15
je 0x1400122cd
mov rcx, qword [0x1400c72a8]
lea r12, [0x1400c72a8]
cmp rcx, r12
je 0x14000643c
test byte [rcx + 0x44], 0x80
jne 0x1400122ed
mov edx, dword [0x1400c90c0]
test edx, edx
je 0x140012311
xor edi, edi
mov ebx, edi
test edx, edx
je 0x140006481
mov eax, ebx
lea rcx, [rax + rax*4]
mov rax, qword [0x1400c90b8]
lea rdi, [rcx*8]
cmp dword [rdi + rax + 8], 0
jne 0x140012352
inc ebx
cmp ebx, edx
jb 0x140006452
mov rcx, qword [0x1400c72a8]
xor edi, edi
cmp rcx, r12
je 0x140006490
test byte [rcx + 0x44], 0x80
jne 0x1400124bb
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov r12, rdi
mov qword [rbp + 0x48], rdi
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x1400064b1
inc rax
mov ebx, 0x207
cmp rax, rbx
jae 0x1400066a9
mov rcx, qword [0x1400c9078]
mov edx, 8
mov r8d, 0x438
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400124d6
xor eax, eax
mov qword [rbp + 0x10], 0xffffffffffffffff
lea rdx, [rsp + 0x7c]
mov dword [rsp + 0x7c], eax
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x18], 0
call fcn.1400077a0
lea r8, str.PrintersConnections
mov edx, 0x21c
sub r8, rdi
mov rcx, rdi
nop dword [rax]
lea rax, [rdx + 0x7ffffde2]
test rax, rax
je 0x140006561
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006558
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140006530
jmp 0x140012529
test rdx, rdx
je 0x140012529
xor r9d, r9d
lea rdx, [rdi + 0x28]
mov eax, 0x5c
mov word [rcx], r9w
mov word [rdx], ax
add rdx, 2
cmp rdx, r15
je 0x1400065c5
mov r8, r15
mov rax, rdx
sub r8, rdx
nop word [rax + rax]
lea rcx, [rbx + 0x7ffffdf7]
test rcx, rcx
je 0x1400065c1
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400065b8
mov word [rax], cx
add rax, 2
sub rbx, 1
jne 0x140006590
jmp 0x140012532
test rbx, rbx
je 0x140012532
mov word [rax], r9w
movzx eax, word [rdx]
test ax, ax
je 0x1400065e9
mov ecx, 0x2c
cmp ax, 0x5c
je 0x140006b94
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x1400065d2
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x58], r9
mov ecx, 0x20019
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14001253b
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x140006650
lea rax, [rbp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400125a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x1400c9078]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xffffffffffffffff
je 0x140012621
mov rbx, rdx
test rdx, rdx
je 0x140006694
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14001262d
cmp rbx, 0xffffffffffffffff
je 0x1400066a9
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
cmp dword [rbp - 0x48], 0
mov rcx, qword [rbp - 0x68]
jne 0x14001263f
test r12, r12
jne 0x14001267f
mov rax, qword [0x1400c9068]
mov r12, qword [rax]
test r12, r12
je 0x1400067d8
cmp r12, rcx
je 0x1400067cb
lea eax, [r13 - 3]
cmp eax, 1
ja 0x1400126e5
mov ebx, esi
cmp r13d, 4
jne 0x1400126ea
lea rdi, [rbp - 0x28]
mov rcx, qword [r12 + 8]
lea rdx, str.win32spl.dll
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
mov rsi, qword [rbp - 0x38]
test eax, eax
cmovne rsi, r15
movabs r10, 0xf5c10edf10538170
mov rax, qword [r12 + 0x1e8]
lea rdx, [rbp - 0x80]
mov r9, rdi
mov dword [rsp + 0x20], ebx
mov rdi, qword [rsp + 0x68]
mov rcx, rsi
mov r8, rdi
call qword [0x1400a8400]
mov ebx, eax
test eax, eax
jne 0x1400126fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x32
jne 0x140006791
movabs r10, 0x8ef42e383654d170
mov rax, qword [r12 + 0x20]
lea rdx, [rbp - 0x80]
mov r8, rdi
mov rcx, rsi
call qword [0x1400a8400]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 1
jbe 0x14001270b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, dword [rsp + 0x60]
mov ecx, eax
cmp edi, 0x7b
jne 0x1400067b4
add eax, 0xffffff85
cmp eax, 1
ja 0x140012740
sub ebx, 1
je 0x14000636f
cmp ebx, 1
je 0x1400067dc
mov rcx, qword [rbp - 0x68]
mov esi, 3
mov r12, qword [r12]
test r12, r12
jne 0x1400066d3
mov edi, dword [rsp + 0x60]
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [r14 + 0x20]
xor esi, esi
test rax, rax
jne 0x140012776
mov rax, qword [0x1400c84f0]
mov dword [r14 + 0x30], esi
mov dword [r14 + 0x50], esi
cmp rax, r14
je 0x140012788
test rax, rax
jne 0x140012798
cmp qword [r14 + 0x18], 0
lea rcx, [r14 + 0x18]
jne 0x1400127bb
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [r14 + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x1400127c6
mov rcx, qword [r14 + 0x40]
test rcx, rcx
jne 0x1400127d8
mov r8, qword [r14 + 0x48]
test r8, r8
je 0x14000687a
mov rcx, qword [0x1400c9078]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [0x1400c9078]
mov r8, r14
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
cmp edi, 0x7b
jne 0x14000689c
mov edi, 0x709
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x709
jne 0x140012820
mov rax, qword [0x1400c72a8]
lea rcx, [0x1400c72a8]
mov ebx, esi
cmp rax, rcx
je 0x140006387
test byte [rax + 0x44], 0x80
je 0x140006387
jmp 0x140012879
mov rax, r13
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x1400068f0
inc rax
cmp rax, 0x21b
jbe 0x1400060d5
jmp 0x140011d50
mov rax, r13
cmp word [r15 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140006910
mov rcx, qword [0x1400c9078]
lea esi, [rax*2 + 2]
mov r8d, esi
mov edx, 8
mov edi, esi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140011ee6
mov r8d, edi
mov rdx, r15
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov qword [r14 + 0x48], rbx
mov esi, 1
mov rbx, qword [rsp + 0x68]
jmp 0x140006146
mov eax, esi
cmp r13d, 4
je 0x14000697f
cmp r13d, esi
jne 0x14000633f
lea r9, [rbp - 0x28]
jmp 0x140006342
lea rdx, str._NoCache
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140011e5b
mov rbx, qword [rsp + 0x68]
jmp 0x1400060f8
lea rdx, [rsp + 0x74]
mov qword [rbp - 0x58], r13
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x50], dil
mov dword [rsp + 0x74], edi
call fcn.1400077a0
test eax, eax
je 0x1400069dc
cmp dword [rsp + 0x74], edi
jne 0x140011fea
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], rdi
mov ecx, 0x2001f
mov rsi, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140011ff3
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140012058
cmp word [r15], 0x5c
je 0x140012092
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [0x1400a9f60]
lea rax, [rbp - 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140006a62
mov rsi, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x1400120c6
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x74]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x58], rdi
xor r8d, r8d
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140006ad3
mov ecx, dword [rsp + 0x74]
cmp ecx, 0x48
jae 0x1400120e7
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x1400121bd
mov rbx, qword [rbp - 0x58]
cmp rbx, r13
je 0x140012210
test rbx, rbx
je 0x140006b16
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140012218
cmp rbx, r13
je 0x140006b2a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rbp - 0x60], r12
test r12, r12
je 0x1400062dd
jmp 0x14001222a
mov eax, dword [rcx + 0x30]
mov dword [r14 + 0x54], eax
mov eax, dword [rcx + 0x34]
mov dword [r14 + 0x58], eax
mov eax, dword [rcx]
mov dword [rbp - 0x24], eax
mov rax, qword [rcx + 8]
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x10], rax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 8], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 4], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp], eax
movzx eax, word [rcx + 0x24]
mov word [rbp + 4], ax
mov rax, qword [rcx + 0x28]
mov qword [rbp + 8], rax
mov dword [rbp - 0x20], 0x28
mov dword [rbp - 0x28], 0x38
jmp 0x140006316
mov word [rdx], cx
jmp 0x1400065dc
mov rax, qword [0x1400c90b8]
lea rcx, [0x1400c8e38]
mov r12, qword [rdi + rax + 0x10]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
test r12, r12
jne 0x1400123c6
xor edi, edi
jmp 0x1400064a3
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp ebx, 1
jne 0x140006791
mov edi, dword [rsp + 0x60]
jmp 0x1400067b4
mov ecx, 0x709
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x1400063b4
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea r8, str.RouterPreInitEvent
xor edx, edx
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140011dfe
mov rax, qword [0x1400c72a8]
lea rcx, [0x1400c72a8]
cmp rax, rcx
je 0x140011dd2
test byte [rax + 0x44], 0x20
je 0x140011dd2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea edx, [rbx + 0x15]
mov r9d, eax
lea r8, [0x1400aa8b0]
mov rcx, qword [rcx + 0x38]
call fcn.140016318
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [0x1400aa3f8]
mov edx, eax
call fcn.140049218
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x140011e45
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x140011e45
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
mov ecx, 0x69
call fcn.140048e18
mov edx, 0xffffffff
call fcn.14004f9e4
mov rbx, qword [rsp + 0x68]
xor edi, edi
jmp 0x1400060ef
mov rcx, r12
call sym.spoolsv.exe_PrvDllAllocSplStr
mov r15, rax
test rax, rax
je 0x140011edf
sub rbx, r12
sar rbx, 1
mov word [rax + rbx*2], di
jmp 0x1400069aa
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140011ebd
test byte [rcx + 0x44], 0x20
je 0x140011ebd
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa8c0]
mov edx, 0xa
lea r9d, [rdx + 0x5e]
call fcn.14001635c
cmp r15, r12
je 0x140011edf
test r15, r15
je 0x140011edf
mov rcx, qword [0x1400c9078]
mov r8, r15
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor eax, eax
jmp 0x1400063ac
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140011f28
test byte [rcx + 0x44], 0x20
je 0x140011f28
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa8c0]
mov edx, 0xa
mov r9d, esi
call fcn.14001635c
mov qword [r14 + 0x48], rbx
cmp r15, r12
je 0x140011f49
mov rcx, qword [0x1400c9078]
mov r8, r15
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, r14
call fcn.140050c14
xor eax, eax
jmp 0x1400063ac
xor eax, eax
jmp 0x140006186
test eax, eax
jle 0x140006298
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140006298
mov ecx, edi
jmp 0x1400062d1
mov ebx, esi
jmp 0x140006278
call fcn.1400094f0
mov ebx, eax
jmp 0x140006278
call fcn.1400094f0
mov ebx, eax
jmp 0x140006288
call fcn.1400094f0
mov ebx, eax
cmp eax, 0x800703f0
jne 0x140006298
jmp 0x1400061ab
mov rcx, qword [0x1400c72a8]
cmp rcx, r12
je 0x1400062dd
test byte [rcx + 0x44], 0x20
je 0x1400062dd
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa900]
mov edx, 0x12
mov r9d, ebx
call fcn.14001635c
nop
jmp 0x1400062dd
mov byte [rbp - 0x50], 1
jmp 0x1400069dc
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
cmp ebx, 5
je 0x140012037
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140012037
test byte [rcx + 0x44], 0x20
je 0x140012037
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa900]
mov edx, 0xf
mov r9d, ebx
call fcn.140016318
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001204c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, rdi
mov qword [rbp - 0x40], rbx
jmp 0x140006a06
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
jne 0x14001207f
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rbx, rax
test rax, rax
jne 0x140006a0f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x140006a71
cmp word [r15 + 2], 0x5c
jne 0x140006a1a
lea r8, [rbp - 0x78]
mov rdx, r15
mov rcx, rbx
call fcn.140079a14
mov edi, eax
test eax, eax
jne 0x1400120bf
lea rsi, str.DevMode
jmp 0x140006a62
xor edi, edi
jmp 0x140006a1a
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140006ae3
call sym.spoolsv.exe_PrvDllAllocSplMem
mov qword [rbp - 0x60], rax
mov r12, rax
test rax, rax
jne 0x14001210b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140006ad3
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140012193
mov edx, dword [rsp + 0x74]
mov r8d, 0x8007000d
cmp rdx, 0x4c
jb 0x140012168
movzx ecx, word [r12 + 0x46]
movzx eax, word [r12 + 0x44]
add rcx, rax
cmp rdx, rcx
jb 0x140012168
mov rcx, r12
call fcn.14004b938
mov r8d, eax
mov ecx, r8d
call fcn.140024f58
mov ebx, eax
test eax, eax
je 0x1400121b2
mov rcx, qword [rbp - 0x78]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
mov eax, 2
cmove ebx, eax
mov rcx, qword [0x1400c9078]
mov r8, r12
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r12, rdi
mov qword [rbp - 0x60], rdi
cmp ebx, 2
cmove ebx, edi
jmp 0x140006ad3
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
cmp ebx, 5
je 0x140012201
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140012201
test byte [rcx + 0x44], 0x20
je 0x140012201
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa10]
mov edx, 0xf
mov r9d, ebx
call fcn.140016318
lea rcx, [rbp - 0x58]
call fcn.1400816c4
nop
jmp 0x1400062dd
mov rbx, r13
jmp 0x140006b16
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140012240
mov rax, qword [rcx]
mov qword [rbp + 0x30], rax
mov eax, dword [rcx + 0x10]
jmp 0x140012246
xor eax, eax
mov qword [rbp + 0x30], rax
lea rbx, [rbp + 0x30]
mov dword [rbp + 0x40], eax
mov qword [rsp + 0x68], rbx
mov qword [rbp + 0x38], r12
mov qword [rbp - 0x60], r12
jmp 0x1400062e2
mov eax, dword [rcx + 4]
mov dword [rbp - 0x24], eax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x10], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 8], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 4], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp], eax
movzx eax, word [rcx + 0x2c]
mov word [rbp + 4], ax
mov rax, qword [rcx + 0x30]
jmp 0x140006b7d
lea eax, [rcx - 0x32]
cmp eax, 0x25
ja 0x1400122aa
bt rdi, rax
jb 0x1400063fa
test ecx, ecx
je 0x1400063fa
cmp ecx, 0x4b0
mov eax, 0x7b
cmovne eax, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x70], eax
jmp 0x1400063fa
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp + 0x48], rax
mov ecx, eax
jmp 0x1400066c0
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa30]
mov edx, 0xd
mov r9, r15
call fcn.140031e7c
mov rcx, qword [0x1400c72a8]
jmp 0x14000643c
cmp rcx, r12
je 0x140012331
test byte [rcx + 0x44], 0x80
je 0x140012331
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa30]
mov edx, 0xe
call fcn.1400162ec
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rbp + 0x48], rcx
mov r12d, ecx
jmp 0x1400064aa
mov rcx, qword [rdi + rax]
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140012374
mov edx, dword [0x1400c90c0]
jmp 0x140006472
mov rcx, qword [0x1400c90b8]
add rcx, 0x18
add rcx, rdi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTime]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
cmp rcx, r12
je 0x140006b9c
test byte [rcx + 0x44], 0x80
je 0x140006b9c
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa30]
mov edx, 0xf
mov r9d, ebx
call fcn.14001635c
nop
jmp 0x140006b9c
lea eax, [r13 - 3]
cmp eax, 1
jbe 0x1400123d4
mov eax, r13d
jmp 0x1400123e2
cmp r13d, 3
je 0x1400123e8
mov eax, esi
cmp r13d, 4
je 0x1400123e8
mov r9, qword [rbp - 0x70]
jmp 0x1400123ee
lea r9, [rbp - 0x28]
mov eax, esi
movabs r10, 0xf5c10edf10538170
mov rdi, qword [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x20], eax
mov r8, rdi
mov rax, qword [r12 + 0x1e8]
mov rcx, r15
call qword [0x1400a8400]
mov ebx, eax
test eax, eax
jne 0x14001244a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x32
je 0x14001244f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.14005651c
jmp 0x14001249a
cmp eax, 0x32
jne 0x140012470
movabs r10, 0x8ef42e383654d170
mov rax, qword [r12 + 0x20]
lea rdx, [rbp - 0x80]
mov r8, rdi
mov rcx, r15
call qword [0x1400a8400]
mov ebx, eax
cmp ebx, 1
je 0x14000636f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.14005651c
cmp ebx, 2
je 0x1400126dc
xor eax, eax
mov qword [rbp - 0x68], r12
mov qword [rbp + 0x48], rax
mov r12d, eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x60], eax
mov dword [rbp - 0x48], 1
jmp 0x1400064aa
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aaa30]
mov edx, 0x10
call fcn.1400162ec
nop
jmp 0x140006490
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400066a9
test byte [rcx + 0x44], 0x20
je 0x1400066a9
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa8c0]
mov edx, 0xa
mov r9d, 0x438
call fcn.14001635c
nop
jmp 0x1400066a9
sub rcx, 2
jmp 0x140006561
sub rax, 2
jmp 0x1400065c1
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
cmp ebx, 5
je 0x14001257f
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x14001257f
test byte [rcx + 0x44], 0x20
je 0x14001257f
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400aa900]
mov edx, 0xf
mov r9d, ebx
call fcn.140016318
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140012594
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x58], rax
jmp 0x140006610
mov rcx, qword [rbp + 0x48]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400aa920]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x78], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001260b
mov r12, qword [0x1400c9068]
test r12, r12
je 0x14001260b
mov rcx, qword [r12 + 8]
lea rdx, [rbp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001260b
mov r12, qword [r12]
test r12, r12
jne 0x1400125e9
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x140006641
mov rbx, 0xffffffffffffffff
jmp 0x140006694
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
cmp r12, rcx
je 0x1400066b7
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, r15
call fcn.14007b288
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x68]
jmp 0x1400066b7
cmp r12, rcx
je 0x1400067d8
lea eax, [r13 - 3]
cmp eax, 1
jbe 0x140012696
mov esi, r13d
jmp 0x1400126a2
cmp r13d, 3
je 0x1400126a8
cmp r13d, 4
je 0x1400126a8
mov rax, qword [rbp - 0x70]
jmp 0x1400126ac
lea rax, [rbp - 0x28]
mov r9, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], esi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140056404
cmp eax, 1
je 0x14000636f
mov edi, dword [rsp + 0x70]
jmp 0x1400067dc
mov ebx, r13d
jmp 0x1400126f4
cmp r13d, 3
je 0x1400066f5
mov rdi, qword [rbp - 0x70]
jmp 0x1400066f9
cmp eax, 0x32
jne 0x140006785
jmp 0x140006764
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, rsi
call fcn.14007b3d8
test rax, rax
jne 0x140006bcb
mov rdx, r12
mov rcx, rsi
call fcn.14007b0e8
nop
jmp 0x140006bcb
lea eax, [rcx - 0x32]
cmp eax, 0x25
ja 0x14001275c
movabs rdx, 0x200002000b
bt rdx, rax
jb 0x1400067b4
test ecx, ecx
je 0x1400067b4
cmp ecx, 0x4b0
cmovne edi, ecx
mov dword [rsp + 0x60], edi
jmp 0x1400067b4
mov qword [rax + 8], rsi
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140012776
jmp 0x1400067fe
mov rax, qword [r14 + 0x28]
mov qword [0x1400c84f0], rax
jmp 0x14000681f
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, r14
je 0x1400127af
test rax, rax
jne 0x140012798
jmp 0x14000681f
mov rax, qword [r14 + 0x28]
mov qword [rcx], rax
jmp 0x14000681f
call fcn.140050a04
nop
jmp 0x14000682e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000684f
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400127fe
mov rcx, qword [r14 + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [r14 + 0x40]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov qword [r14 + 0x40], rsi
jmp 0x14000685c
cmp eax, 5
je 0x1400068c1
mov rax, qword [0x1400c72a8]
lea rcx, [0x1400c72a8]
cmp rax, rcx
je 0x140012872
test byte [rax + 0x44], 0x20
je 0x140012872
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea r8, [0x1400aa8e0]
mov r9, qword [rbp - 0x38]
mov edx, 0xf
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x38]
call fcn.140041b24
mov ebx, esi
jmp 0x140006387
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea r8, [0x1400aa8e0]
mov r9, qword [rbp - 0x38]
mov edx, 0xe
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x38]
call fcn.140041b24
nop
jmp 0x140006387
test r15, r15
je 0x1400063aa
mov rcx, qword [0x1400c9078]
mov r8, r15
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x1400063aa