Function at 0x140003d40
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400b67a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov esi, 0x80070057
test rcx, rcx
je 0x1400041bb
cmp word [rcx], 0x5c
jne 0x1400041bb
cmp word [rcx + 2], 0x5c
jne 0x1400041bb
mov r8d, 9
lea rdx, str.http:__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041bb
mov r8d, 0xa
lea rdx, str.https:__
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041bb
cmp word [rbx], 0
je 0x140003e01
mov r8d, 6
lea rdx, str.CSR
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400041bb
lea rdi, [rbx + 4]
xor r12d, r12d
mov ebx, r12d
test rdi, rdi
je 0x140003e9f
mov ecx, 0x40e
call fcn.140013008
mov qword [rbp - 0x51], rax
mov rbx, rax
test rax, rax
je 0x140003e9f
mov r9, rdi
mov edx, 0x207
mov rcx, rax
call fcn.1400165cc
test eax, eax
js 0x140003e5d
lea edx, [r12 + 0x5c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140003e9f
mov word [rax], r12w
jmp 0x140003e9f
mov rcx, qword [0x1400b62f8]
lea rdx, [0x1400b62f8]
cmp rcx, rdx
je 0x140003e92
test byte [rcx + 0x44], 0x20
je 0x140003e92
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009bcc8]
mov edx, 0xb
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.14004c328
lea rcx, [rbp - 0x51]
call fcn.14000e2e4
mov rbx, qword [rbp - 0x51]
mov rdi, r12
test rbx, rbx
je 0x140003eba
mov rdi, rbx
mov rbx, r12
test rbx, rbx
je 0x140003eba
mov rcx, rbx
call fcn.140012ffc
test rdi, rdi
je 0x1400041bb
test byte [0x1400b84c0], 2
mov qword [rsp + 0xf8], r15
je 0x140003ee3
mov r8, rdi
lea rdx, [0x1400a8c28]
call fcn.14006b020
mov r13, qword [0x1400b8480]
mov qword [rbp - 0x59], r12
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r13 + 0x64]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
lea r14, [r13 + 0x78]
mov dword [r13 + 0x60], eax
mov rbx, r12
mov esi, 1
test r14, r14
je 0x140003fb9
mov rbx, qword [r13 + 0x88]
nop
test r14, r14
je 0x140003fb9
cmp rbx, r14
je 0x140003fb9
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140003fb6
lea r8, [rbp - 0x59]
mov rdx, rdi
mov rcx, rbx
call fcn.140070b44
mov esi, eax
test eax, eax
je 0x140003f70
mov rbx, qword [rbx + 0x10]
jmp 0x140003f30
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x59]
sub eax, dword [rdx + 0x38]
cmp eax, dword [r13 + 4]
jbe 0x140003fb0
mov rcx, qword [rdx + 0x10]
mov esi, 1
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov qword [rdx + 0x10], rdx
mov qword [rdx + 0x18], rdx
jmp 0x140003fb9
mov qword [rbp - 0x59], r12
jmp 0x140003fb9
mov esi, r12d
add dword [r13 + 0x64], 0xffffffff
mov eax, dword [r13 + 0x64]
jne 0x140003fc8
mov dword [r13 + 0x60], r12d
lea rcx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov r15, qword [rsp + 0xf8]
test rcx, rcx
je 0x140003ffa
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140097d68]
cmp esi, 1
jne 0x140004196
call sym.spoolsv.exe_PrvRevertToPrinterSelf
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r12
mov rcx, rdi
mov r14, rax
call fcn.140071c64
test eax, eax
jne 0x14000409e
mov rsi, qword [rbp - 0x49]
test rsi, rsi
je 0x140004094
lea r8, [rbp - 0x41]
mov qword [rbp - 0x41], r12
mov rdx, rsi
call fcn.1400712fc
mov rcx, rsi
mov ebx, eax
call fcn.140012ffc
test ebx, ebx
jne 0x140004094
lea ecx, [rbx + 0x40]
call fcn.140013008
test rax, rax
je 0x140004094
mov rdx, rdi
mov rcx, rax
call fcn.14006f4a0
mov r9, rax
test rax, rax
je 0x140004094
cmp dword [rax + 0x3c], r12d
jl 0x140004080
mov rcx, qword [rbp - 0x41]
mov rdx, rax
mov rcx, qword [rcx + 0x48]
call fcn.1400620e4
test eax, eax
jns 0x140004094
mov rax, qword [r9]
mov edx, 1
mov rcx, r9
mov rax, qword [rax]
call qword [0x140097d68]
mov esi, 0x80004005
jmp 0x14000416f
lea rcx, [0x14007c1c0]
mov dword [rbp - 0x29], 0x74736c74
lea rax, [rbp - 0x21]
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x11], rax
lea r9, [rbp - 1]
lea rax, [rbp - 0x21]
mov qword [rbp + 7], rcx
mov qword [rbp - 9], rax
lea r8, [rbp - 0x29]
lea rax, [rbp + 7]
mov dword [rbp - 0x19], 0x6b6e6c74
mov qword [rbp + 0x17], rax
mov rdx, rdi
lea rax, [rbp + 7]
mov dword [rbp - 1], 0x74736c74
mov rcx, r13
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x6b6e6c74
mov byte [rsp + 0x20], r12b
call fcn.1400719f4
mov esi, eax
test eax, eax
jne 0x14000411a
lea r8, [rbp - 0x29]
mov rdx, rdi
mov rcx, r13
call fcn.14006f7b0
mov esi, eax
jmp 0x14000415d
cmp ax, 0x2af9
jne 0x14000415d
lea rax, [rbp - 0x31]
mov rcx, rdi
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x39]
xor eax, eax
mov dword [rbp - 0x31], eax
call fcn.1400709b0
mov esi, eax
test eax, eax
jne 0x140004150
mov rdx, qword [rbp - 0x39]
mov r8, rdi
mov rcx, r13
call fcn.14006f938
mov esi, eax
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp - 0x39]
call fcn.140010c60
lea rcx, [rbp - 1]
call fcn.14004c518
lea rcx, [rbp - 0x29]
call fcn.14004c518
mov rcx, r14
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x140004196
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
test byte [0x1400b84c0], 2
je 0x1400041ae
mov r8, rdi
lea rdx, [0x1400a8ba8]
call fcn.14006b020
test rdi, rdi
je 0x1400041bb
mov rcx, rdi
call fcn.140012ffc
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140013380
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret