Function at 0x14000d200
Capabilities:
Enumerate files on windows
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x6c0
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rdi, r8
mov qword [rsp + 0x28], rcx
mov r12, rdx
mov r13, rcx
lea r8, [0x140019006]
lea rdx, str.CoreDriverSections
lea r9, [rsp + 0x40]
mov rcx, rdi
xor bpl, bpl
mov dword [rsp + 0x20], 0x38
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x14000d3e8
lea rax, [rsp + 0x40]
inc rax
cmp byte [rax], 0x2c
jne 0x14000d267
lea rdx, str.amd64
mov rcx, rdi
mov byte [rax], 0
call fcn.14000dda8
lea r9, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rsp + 0x4b0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPackageInstallationWindows_x64CorePrinterDrivers_
test rax, rax
jne 0x14000d2a8
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPackageInstallationWindows_NT_x86CorePrinterDrivers_
call fcn.14000de04
lea rax, [rsp + 0x38]
mov rsi, 0xffffffff80000002
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d3d6
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x190]
lea rdx, str.InfPath
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x30], 0x209
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d3d1
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x190]
inc rcx
mov byte [rsp + rcx + 0x7f], al
test al, al
jne 0x14000d330
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x80]
mov rdi, r13
not rcx
sub rdi, rax
lea rdx, [rsp + rcx + 0x7f]
lea rcx, [rsp + 0x80]
movzx eax, byte [rcx]
inc rcx
mov byte [rdi + rcx - 1], al
test al, al
jne 0x14000d371
lea rax, [rsp + 0x80]
cmp rdx, rax
jbe 0x14000d3d1
nop dword [rax]
dec rdx
lea rax, [rsp + 0x80]
cmp byte [rdx], 0x5c
je 0x14000d3a7
cmp rdx, rax
ja 0x14000d390
jmp 0x14000d3d1
mov byte [rdx], 0
mov rdx, r12
lea rcx, [rsp + 0x80]
sub rdx, rax
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x14000d3c0
mov bpl, 1
test rsi, rsi
je 0x14000d3df
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, bpl
jne 0x14000d57c
lea rcx, [rsp + 0x3a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.DriverStoreFileRepository
lea r8, [rsp + 0x3a0]
lea rdx, str._s_s.
lea rcx, [rsp + 0x80]
call fcn.14000de04
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d44a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x14000d57f
lea rdx, [rsp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000d573
cmp byte [rsp + 0x1bc], 0x7e
je 0x14000d4c5
lea rsi, [rsp + 0x1bc]
lea rdi, [0x140019144]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x14000d4c5
lea rsi, [rsp + 0x1bc]
lea rdi, [0x140019148]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x14000d4c5
test byte [rsp + 0x190], 0x10
je 0x14000d4c5
lea rdx, str.ntprint.inf
lea rcx, [rsp + 0x1bc]
mov r8d, 0xb
call fcn.14000deb0
test eax, eax
je 0x14000d4df
lea rdx, [rsp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000d463
jmp 0x14000d573
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x80]
lea rdi, [rsp + 0x80]
not rcx
lea rdx, [rsp + 0x1bc]
mov byte [rcx + rax - 4], 0
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d520
lea rax, [rsp + 0x80]
mov rcx, r12
lea rdx, [rsp + 0x80]
sub rcx, rax
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x14000d550
lea rdx, str._s_ntprint.inf
mov r8, r12
mov rcx, r13
call fcn.14000de04
mov bpl, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bpl
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.14000da50
mov rbx, qword [rsp + 0x708]
add rsp, 0x6c0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret