Function at 0x4873f0
Capabilities:
Check os version
Get common file path
Get keyboard layout
Get system information on windows
Identify system language via api
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x2698
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2650], rax
mov qword [rsp + 0x26b0], rbx
mov rbx, rdx
mov qword [rsp + 0x2690], rsi
mov rsi, rcx
lea rdx, str.System_Info_n_________________________________________n
mov rcx, rbx
mov qword [rsp + 0x2688], rdi
call fcn.004954f0
call fcn.004891a0
lea rcx, str.32_bit
test eax, eax
lea rdi, str.64_bit
cmove rdi, rcx
call fcn.00488f80
mov rcx, rsi
mov edx, eax
call fcn.00481c90
lea rdx, str.OS_Platform_______________s__s_n
mov r8, rdi
mov r9, rax
mov rcx, rbx
call fcn.004954f0
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8d, 0x11c
call fcn.00491ae0
lea rcx, [rsp + 0x110]
mov dword [rsp + 0x110], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x487516
cmp word [rsp + 0x124], 0
je 0x4874e4
movzx r9d, word [rsp + 0x226]
movzx r8d, word [rsp + 0x224]
lea rax, [rsp + 0x124]
lea rdx, str.OS_Service_Pack___________d._d___s_n
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.004954f0
test byte [rsp + 0x228], 0x40
movzx r8d, word [rsp + 0x228]
lea rax, str.XP_Embedded_Installed
lea r9, [0x004d0d8c]
lea rdx, str.OS_Suite_Mask____________0x_x__s_n
mov rcx, rbx
cmovne r9, rax
call fcn.004954f0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r8d, word [rsp + 0xe0]
test r8d, r8d
je 0x48756b
cmp r8d, 6
je 0x487562
cmp r8d, 9
je 0x487559
lea r9, [0x004dc6d0]
lea rax, str.Unknown
cmp r8d, 0xffff
cmove r9, rax
jmp 0x487572
lea r9, str.x64__AMD_or_Intel_
jmp 0x487572
lea r9, str.Intel_Itanium
jmp 0x487572
lea r9, [0x004dc680]
lea rdx, str.Processor_Architecture___0x_x___s_n
mov rcx, rbx
call fcn.004954f0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4875bc
mov r9d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x58]
lea rdx, str.Screen_Resolution_________d_by__d_n
sub r9d, dword [rsp + 0x54]
sub r8d, dword [rsp + 0x50]
mov rcx, rbx
call fcn.004954f0
xor ecx, ecx
mov qword [rsp + 0x26b8], rbp
call qword [sym.imp.USER32.dll_GetDC]
test rax, rax
mov rbp, rax
je 0x487612
mov edx, 0x5a
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x58
mov rcx, rbp
mov edi, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea rdx, str.System_DPI_Settings_______d_by__d_n
mov r9d, edi
mov rcx, rbx
mov r8d, eax
call fcn.004954f0
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.00489230
lea rdx, str.OS_Install_______________0x_x___s_n
mov r8d, edi
mov r9, rax
mov rcx, rbx
call fcn.004954f0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.00489230
lea rdx, str.Current_Display_Language_0x_x___s_n
mov r8d, edi
mov r9, rax
mov rcx, rbx
call fcn.004954f0
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
movzx ecx, di
call fcn.00489230
lea rdx, str.System_Default_Locale____0x_x___s_n
mov r8d, edi
mov r9, rax
mov rcx, rbx
call fcn.004954f0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov rdi, rax
call fcn.00489230
lea rdx, str.Keyboard_Layout_Language_0x_x___s_n
movzx r8d, di
mov r9, rax
mov rcx, rbx
call fcn.004954f0
mov rdx, rbx
mov rcx, rsi
call fcn.004839b0
mov rcx, qword [rsi]
mov dword [rsp + 0x48], 0xffffffff
test rcx, rcx
je 0x48772c
nop
nop
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x48772c
mov r8d, dword [rsp + 0x48]
lea rdx, str._nDevice__li_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
mov edx, dword [rsp + 0x48]
xor r8d, r8d
mov rcx, rsi
call fcn.004853f0
lea rdx, [0x004d4930]
mov rcx, rbx
mov r8, rax
mov rdi, rax
call fcn.004954f0
mov rcx, rdi
call fcn.00491a30
mov rcx, qword [rsi]
test rcx, rcx
jne 0x4876d0
lea rdx, str._nProgram_Files_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
lea rcx, str.ProgramFiles
call fcn.00498f00
test rax, rax
jne 0x487762
lea r8, [rsi + 0x458]
lea rdx, str.Cannot_get_environment_variable_for_PROGRAMFILES__assume__s_n
mov rcx, rbx
call fcn.004954f0
lea rax, [0x004d5c38]
mov qword [rsp + 0x2668], r15
lea r8, [rsi + 0x458]
mov r15d, 1
lea r9, str.Synaptics
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.00484840
lea rdx, str._nSystem_Files_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
lea rcx, str.SystemRoot
call fcn.00498c40
test rax, rax
mov rdi, rax
jne 0x4877ea
lea rcx, str.WinDir
call fcn.00498c40
test rax, rax
mov rdi, rax
jne 0x4877ea
lea rdi, str.C:WINDOWS
lea rdx, str.Cannot_get_environment_variable_for_SYSTEMROOT__assume__s_n
mov rcx, rbx
mov r8, rdi
call fcn.004954f0
mov qword [rsp + 0x2680], r12
mov qword [rsp + 0x2678], r13
call fcn.00488f80
cmp eax, 5
jl 0x487878
lea r12, str.SynTP.
lea r9, str.System32
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
call fcn.00484840
lea rax, str.SynCom.
lea r9, str.System32
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.00484840
lea r13, str.SynCtrl.
lea r9, str.System32
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
call fcn.00484840
jmp 0x4878ea
lea r12, str.SynTP.
lea r9, str.System
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
call fcn.00484840
lea rax, str.SynCom.
lea r9, str.System
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.00484840
lea r13, str.SynCtrl.
lea r9, str.System
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
call fcn.00484840
lea rax, [0x004df360]
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x2670], r14
call fcn.00484840
lea rax, str.i8042prt.sys
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.00484840
xor r14d, r14d
lea rcx, str.kernel32.dll
mov edi, r14d
mov word [rsp + 0x650], di
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rbp, rax
je 0x487a16
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x48798f
lea rcx, [rsp + 0x650]
mov edx, 0x2000
call rax
test eax, eax
cmovne edi, r15d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x487a16
lea rdx, str._nx64_System_Files_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
lea rdi, str..
lea r8, [rsp + 0x650]
mov r9, r12
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call fcn.00484840
lea r9, str.SynCOM.
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call fcn.00484840
lea r8, [rsp + 0x650]
mov r9, r13
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call fcn.00484840
lea rdx, str._nSynaptics_Files_found_in_PATH_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
lea rax, str.SynTPAPI.dll
lea r12, str.SynTP.sys
mov qword [rsp + 0x68], rax
lea rax, str.SynTPCOM.dll
lea rcx, str.PATH
mov qword [rsp + 0x70], rax
lea rax, str.SynTPCpl.dll
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x78], rax
lea rax, str.SynTPEnh.exe
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0x80], rax
lea rax, str.SynTPRes.dll
mov qword [rsp + 0x88], rax
lea rax, str.SynTPFcs.dll
mov qword [rsp + 0x90], rax
lea rax, str.SynTPLpr.exe
mov qword [rsp + 0x98], rax
lea rax, str.SynCOM.dll
mov qword [rsp + 0xa0], rax
lea rax, str.SynCtrl.dll
mov qword [rsp + 0xa8], rax
lea rax, str.SynISDLL.dll
mov qword [rsp + 0xb0], rax
lea rax, str.SynTPCoI.dll
mov qword [rsp + 0xb8], rax
lea rax, str.SynTPCo2.dll
mov qword [rsp + 0xc0], rax
lea rax, str.SynTPCo3.dll
mov qword [rsp + 0xc8], rax
lea rax, str.SynTPCo4.dll
mov qword [rsp + 0xd0], rax
call fcn.00498c40
mov r15, qword [rsp + 0x2668]
mov r13, qword [rsp + 0x2678]
lea rdx, [rsp + 0x650]
nop
nop
nop
movzx ecx, word [rax]
add rdx, 2
add rax, 2
test cx, cx
mov word [rdx - 2], cx
jne 0x487b30
lea rdx, [0x004d5394]
lea rcx, [rsp + 0x650]
call fcn.00498d40
test rax, rax
mov rbp, rax
je 0x487ba7
mov rdi, r14
mov rcx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
lea r9, [0x004d0d8c]
mov rcx, rsi
mov r8, rbp
mov rdx, rbx
call fcn.00484840
mov rcx, qword [rsp + rdi*8 + 0x68]
add rdi, 1
test rcx, rcx
jne 0x487b66
lea rdx, [0x004d5394]
call fcn.00498d40
test rax, rax
mov rbp, rax
jne 0x487b60
lea rdx, str._nEnviroment_Info_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, qword [rsp + 0x2680]
test rax, rax
mov rbp, rax
je 0x487c25
movzx ecx, word [rax]
mov rdi, rax
test cx, cx
je 0x487c1c
test cx, cx
je 0x487c00
nop
movzx r8d, cx
lea rdx, [0x004dda34]
mov rcx, rbx
call fcn.004954f0
mov cx, word [rdi + 2]
add rdi, 2
test cx, cx
jne 0x487be0
lea rdx, [0x004d804c]
mov rcx, rbx
call fcn.004954f0
mov cx, word [rdi + 2]
add rdi, 2
test cx, cx
jne 0x487bd7
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea rdx, str._nRegistry_Info_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
lea r9, str.SYSTEMCurrentControlSetServicesSynTP
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SYSTEMCurrentControlSetEnumACPI
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SYSTEMCurrentControlSetEnumHID
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SYSTEMCurrentControlSetEnumSERENUM
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SOFTWARESynaptics
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SOFTWARESynaptics
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000001
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.Control_PanelMouse
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000001
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str..DEFAULTControl_PanelMouse
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000003
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.CLSID2F603045_309F_11CF_9774_0020AFD0CFF6InProcServer32
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000000
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x40], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.004832d0
lea rdx, str._nSetupAPI_Log_Info_n_________________________________________n
mov rcx, rbx
call fcn.004954f0
cmp dword [rsi + 0x434], r14d
mov rbp, qword [rsp + 0x26b8]
je 0x487e67
lea rcx, [rsp + 0x442]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x440], r14w
call fcn.00491ae0
lea rcx, [rsp + 0x440]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.00488f80
cmp eax, 7
jne 0x487e36
lea r8, [rsp + 0x440]
lea rdx, str._sSetupAPI.log
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483880
jmp 0x487e76
lea r8, [rsp + 0x440]
lea rdx, str._sinf_setupapi.dev.log
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483880
jmp 0x487e76
lea rdx, str._not_included__n
mov rcx, rbx
call fcn.004954f0
lea rdx, [0x004d804c]
mov rcx, rbx
call fcn.004954f0
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea rdi, [rsp + 0x230]
mov rcx, 0xffffffffffffffff
lea r8, [rsp + 0x230]
lea rdx, str._sControl.KTL
repne scasw ax, word [rdi]
mov eax, dword [0x004d1028]
lea rcx, [rsp + 0x650]
mov dword [rdi - 2], eax
call fcn.00493300
lea rcx, [rsp + 0x650]
call fcn.00498d10
lea r8, [rsp + 0x230]
lea rdx, str._sPacket.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea rcx, [rsp + 0x650]
call fcn.00498d10
lea r8, [rsp + 0x230]
lea rdx, str._sI8042.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea rcx, [rsp + 0x650]
call fcn.00498d10
lea r8, [rsp + 0x230]
lea rdx, str._sProcessedPackets.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea rcx, [rsp + 0x650]
call fcn.00498d10
mov rcx, qword [rsi]
mov rdi, qword [rsp + 0x2688]
test rcx, rcx
je 0x487f74
mov rax, qword [rcx]
mov edx, 0x8000203c
call qword [rax + 0x68]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, str..i8042prt_logger
lea r8d, [r9 + 3]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x487fcf
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov edx, 0x272014
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, [rsp + 0x230]
lea rdx, str._sControl.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483190
lea r8, [rsp + 0x230]
lea rdx, str._sPacket.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483190
lea r8, [rsp + 0x230]
lea rdx, str._sI8042.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483190
lea r8, [rsp + 0x230]
lea rdx, str._sProcessedPackets.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483190
lea r8, [rsp + 0x230]
lea rdx, str._sEnhancement.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea r8, [rsp + 0x650]
mov rdx, rbx
mov rcx, rsi
call fcn.00483190
lea r8, [rsp + 0x230]
lea rdx, str._sEnhancement.KTL
lea rcx, [rsp + 0x650]
call fcn.00493300
lea rcx, [rsp + 0x650]
call fcn.00498d10
mov r14, qword [rsp + 0x2670]
mov rsi, qword [rsp + 0x2690]
mov rbx, qword [rsp + 0x26b0]
mov rcx, qword [rsp + 0x2650]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x2698
ret