Function at 0x14000ccd0
Capabilities:
Copy file
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r12, rcx
xor sil, sil
mov qword [rbp + 0x18], 7
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
lea rbx, [0x140043da0]
mov rdx, rbx
add rcx, 0x28
call fcn.140010c30
mov qword [rsp + 0x50], rax
mov rcx, qword [r12 + 0x30]
lea r14d, [r13 + 1]
or r15, 0xffffffffffffffff
cmp rax, rcx
je 0x14000cde0
lea rdx, [rax + 0x18]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000cd63
mov rdx, qword [rdx]
cmp qword [0x140043db8], 8
cmovae rbx, qword [0x140043da0]
mov rdi, r8
mov r9, qword [0x140043db0]
cmp r9, r8
cmovb rdi, r9
test rdi, rdi
je 0x14000cdb3
nop dword [rax]
movzx eax, word [rdx]
cmp word [rbx], ax
jne 0x14000cda7
add rbx, 2
add rdx, 2
dec rdi
jne 0x14000cd90
jmp 0x14000cdb3
mov edi, r14d
cmp word [rbx], ax
cmovb edi, r15d
jmp 0x14000cdb6
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x14000cdd0
cmp r9, r8
jae 0x14000cdc7
mov eax, r15d
jmp 0x14000cdd0
mov eax, r13d
cmp r9, r8
setne al
test eax, eax
sets al
test al, al
jne 0x14000cde0
lea rax, [rsp + 0x50]
jmp 0x14000cdea
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov rax, qword [rax]
cmp rax, rcx
je 0x14000d11a
lea rdx, [rax + 0x40]
mov r9, r15
xor r8d, r8d
lea rcx, [rbp]
call fcn.14000bb50
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r13
mov word [rbp - 0x28], r13w
mov dword [rsp + 0x58], r13d
mov eax, 2
mov r12d, 0x400
mul r12
mov rdi, rax
cmovo rdi, r15
mov rbx, r13
mov dword [rsp + 0x60], r13d
mov rax, qword [0x140045d08]
test rax, rax
jne 0x14000ce59
call fcn.1400195b0
mov qword [0x140045d08], rax
test rax, rax
je 0x14000ce6d
mov r8, qword [rbp + 0x58]
lea r9, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call rax
mov rbx, rax
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x78], r13w
mov r9, r15
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x78]
call fcn.14000bb50
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.14000d190
nop
mov qword [rsp + 0x50], r13
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000cf00
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareHewlett_PackardDMCUserDefinedCFM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000cf36
mov eax, dword [rbp - 0x40]
lea eax, [rax + rax + 2]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
mov dword [rsp + 0x28], eax
cmovae rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, r14d
xor r8d, r8d
lea rdx, str.CFMFileName
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000d073
cmp qword [rbp - 0x40], 0
je 0x14000d03f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
mov edi, dword [rsp + 0x58]
cmp edi, 0x800
jbe 0x14000cfc9
shr edi, 1
sub edi, 0xffffff80
mov rcx, rbx
call fcn.140017db0
mov edx, edi
mov eax, 2
mul rdx
cmovo rax, r15
mov rcx, rax
call fcn.140017e40
mov rbx, rax
test rax, rax
je 0x14000cfc9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
mov r8d, r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000c2e0
mov r8d, 3
lea rdx, [0x140038ae0]
lea rcx, [rbp - 0x28]
call fcn.14000c180
mov r9, r15
xor r8d, r8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.14000ba20
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rcx, qword [rbp]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movzx esi, sil
test eax, eax
cmovne esi, r14d
test rbx, rbx
je 0x14000d073
mov qword [rsp + 0x60], rbx
mov rdi, qword [0x140045d10]
test rdi, rdi
jne 0x14000d069
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d07a
mov edx, r14d
lea rcx, [rsp + 0x60]
call rdi
mov rdi, qword [0x140045d10]
cmp qword [rbp - 0x38], 8
jb 0x14000d0b8
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000d0b8
test rdi, rdi
jne 0x14000d0a8
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d0b8
xor edx, edx
lea rcx, [rsp + 0x70]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x50], r13w
cmp qword [rbp - 0x10], 8
jb 0x14000d107
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000d107
test rdi, rdi
jne 0x14000d0f7
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d107
xor edx, edx
lea rcx, [rsp + 0x78]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r13
mov word [rbp - 0x28], r13w
jmp 0x14000d121
mov rdi, qword [0x140045d10]
cmp qword [rbp + 0x18], 8
jb 0x14000d158
mov rcx, qword [rbp]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x14000d158
test rdi, rdi
jne 0x14000d14f
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14000d158
xor edx, edx
lea rcx, [rsp + 0x68]
call rdi
movzx eax, sil
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret