Function at 0x10000d648
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1220
call fcn.1000151b0
sub rsp, rax
mov rax, qword [0x100019110]
xor rax, rsp
mov qword [rsp + 0x1210], rax
mov rax, qword [rsp + 0x1280]
xor edi, edi
mov ebx, r9d
mov r12, r8
mov r13, rdx
mov r14, rcx
mov qword [rsp + 0x78], rax
mov esi, edi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x70], edi
mov r15d, edi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x6c], edi
call qword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
bt ebx, 8
mov rbp, rax
mov eax, edi
setae al
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
and bl, 1
cmp bl, 1
mov dword [rax], edi
mov eax, edi
sete al
mov dword [rsp + 0x54], eax
cmp eax, edi
je 0x10000d772
mov edx, 0x220
mov rcx, r14
call fcn.10000d068
cmp eax, edi
je 0x10000d6f5
lea ebx, [rdi + 1]
mov dword [rsp + 0x48], ebx
jmp 0x10000d712
mov edx, 0x221
mov rcx, r14
call fcn.10000d068
cmp eax, edi
jne 0x10000d710
mov esi, 5
jmp 0x10000de3f
mov ebx, esi
cmp dword [0x100019804], edi
jne 0x10000d755
lea r9, [0x100003e18]
lea r8, [0x100003d70]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.100010a8c
mov dword [0x100019804], 1
mov dword [0x100019808], eax
jmp 0x10000d75b
mov eax, dword [0x100019808]
cmp eax, edi
mov ecx, edi
setne cl
mov dword [rsp + 0x70], ecx
cmp ebx, edi
je 0x10000d772
cmp ecx, edi
jne 0x10000de3f
lea r8, [rsp + 0xd60]
mov r9d, 0xc8
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
mov ebx, 5
cmp eax, edi
jne 0x10000d7a7
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x10000de24
cmp dword [rsp + 0x54], edi
jne 0x10000d7c0
mov rdx, r12
mov rcx, r13
call fcn.10000d144
cmp eax, edi
jne 0x10000de3f
cmp dword [rsp + 0x40], edi
je 0x10000d86f
mov r15d, 0x620
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, r15
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xc0]
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0xc0], r15d
call qword [sym.imp.SETUPAPI.dll_SetupDiGetSelectedDriverW]
cmp eax, edi
je 0x10000d80a
mov r15d, 1
jmp 0x10000d81a
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0xe0000203
jne 0x10000d7a0
mov r15d, edi
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x50], r15d
call fcn.10000c38c
cmp eax, edi
je 0x10000d86a
cmp r15d, edi
je 0x10000d84a
lea r8, [rsp + 0xc0]
mov rdx, r12
mov rcx, r13
call fcn.10000d4e4
cmp eax, edi
je 0x10000d86a
lea r9, [0x100004138]
mov edx, 0x800000
mov r8d, 2
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x10000de3f
cmp r15d, edi
je 0x10000d899
lea rcx, [r12 + 4]
lea rdx, [rsp + 0xd10]
mov r8d, 0x27
call sub.SETUPAPI.dll_pSetupStringFromGuid
mov esi, eax
cmp eax, edi
jne 0x10000de24
mov dword [rsp + 0x6c], 1
cmp dword [rsp + 0x54], edi
je 0x10000d99a
cmp dword [rsp + 0x48], edi
jne 0x10000d99a
cmp r15d, edi
jne 0x10000d8bd
mov esi, ebx
lea r9, [0x100004180]
jmp 0x10000d851
mov r15d, 0x630
lea rcx, [rsp + 0x6e0]
xor edx, edx
mov r8, r15
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x6e0]
lea r8, [rsp + 0xc0]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x6e0], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailW]
cmp eax, edi
jne 0x10000d916
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x10000d7a0
xor edx, edx
lea rcx, [rsp + 0x88]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x88]
call qword [sym.imp.API_MS_Win_Core_SysInfo_L1_1_0.dll_GetSystemInfo]
movzx r8d, word [rsp + 0x88]
lea rdx, [rsp + 0x900]
mov rcx, r14
call fcn.10000d2ac
cmp eax, edi
jne 0x10000d97c
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea r9, [0x1000041d0]
mov edx, 0x800000
mov r8d, 2
mov rcx, rbp
mov esi, eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x10000de24
mov rdx, r12
mov rcx, r13
call fcn.10000bc78
cmp eax, edi
jne 0x10000d99a
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea r9, [0x100004220]
jmp 0x10000d961
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x44]
lea r8, [0x100002140]
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x28], 4
mov r14d, edi
mov r15d, edi
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x5c], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
cmp eax, edi
je 0x10000da5a
cmp dword [rsp + 0x44], 7
jne 0x10000da5a
test byte [rsp + 0x80], 4
je 0x10000da5a
cmp dword [0x1000197f4], edi
jne 0x10000da42
lea r9, [0x100003d40]
lea r8, [0x100003d70]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edi
call fcn.100010a8c
mov dword [0x1000197f4], 1
mov dword [0x1000197f8], eax
jmp 0x10000da48
mov eax, dword [0x1000197f8]
cmp eax, edi
je 0x10000da5a
mov dword [rsp + 0x64], 1
mov r14d, 1
lea rax, [rsp + 0x1080]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x28], 0xc8
mov qword [rsp + 0x20], rax
call fcn.10000c6cc
cmp eax, edi
je 0x10000da90
mov eax, 1
mov dword [rsp + 0x58], eax
mov r15d, eax
lea rax, [rsp + 0xef0]
lea r9, [rsp + 0x44]
mov r8d, 1
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x28], 0xc8
mov qword [rsp + 0x20], rax
call fcn.10000c6cc
cmp eax, edi
je 0x10000dadf
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x40], edi
jne 0x10000dacd
cmp eax, edi
je 0x10000dadf
mov rcx, qword [rsp + 0x78]
mov r12d, 1
mov dword [rcx], eax
mov r14d, r12d
jmp 0x10000dae2
mov r12d, edi
cmp dword [rsp + 0x6c], edi
je 0x10000db3f
lea rcx, [rsp + 0xd10]
call fcn.10000cb54
cmp eax, edi
je 0x10000db07
mov dword [rsp + 0x68], 1
mov r15d, 1
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0xd10]
call fcn.10000c998
mov ecx, dword [rsp + 0x40]
cmp eax, edi
je 0x10000db43
mov eax, dword [rsp + 0x44]
cmp ecx, edi
jne 0x10000db2d
cmp eax, edi
je 0x10000db43
mov rdx, qword [rsp + 0x78]
mov r13d, 1
mov dword [rdx], eax
mov r14d, r13d
jmp 0x10000db46
mov ecx, dword [rsp + 0x40]
mov r13d, edi
cmp r14d, edi
jne 0x10000dc28
cmp r15d, edi
jne 0x10000dc4e
cmp ecx, edi
je 0x10000de3f
cmp dword [0x1000197fc], edi
jne 0x10000dba7
lea r9, [0x100003df8]
lea r8, [0x100003d70]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edi
call fcn.100010a8c
mov dword [0x1000197fc], 1
mov dword [0x100019800], eax
jmp 0x10000dbad
mov eax, dword [0x100019800]
cmp eax, edi
je 0x10000de3f
cmp dword [rsp + 0x50], edi
jne 0x10000dc1a
cmp dword [0x1000198e8], edi
jne 0x10000dc09
lea r9, [0x100003f20]
lea r8, [0x100003d70]
lea rdx, [0x100003d90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edi
call fcn.100010a8c
mov ecx, edi
mov dword [0x1000198e8], 1
cmp eax, edi
sete cl
mov dword [0x1000198ec], ecx
jmp 0x10000dc0f
mov ecx, dword [0x1000198ec]
cmp ecx, edi
jne 0x10000dc1a
mov esi, 0xe0000203
jmp 0x10000dc4e
mov dword [rsp + 0x5c], 1
mov r14d, 1
mov esi, 0xe0000248
cmp r15d, edi
jne 0x10000dc4e
cmp r14d, edi
je 0x10000de2c
cmp dword [rsp + 0x40], edi
jne 0x10000dc4e
mov rax, qword [rsp + 0x78]
cmp dword [rax], edi
je 0x10000de2c
lea rax, [rsp + 0xd60]
mov ebx, 0x800000
lea r9, [0x100004280]
mov r8d, 0x20005
mov rcx, rbp
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov edx, ebx
mov rcx, rbp
cmp r14d, edi
je 0x10000dd46
mov r14d, 1
lea r9, [0x1000042b0]
mov r8d, r14d
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp dword [rsp + 0x64], edi
je 0x10000dcb7
lea r9, [0x1000042f8]
mov r8d, r14d
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp r12d, edi
je 0x10000dcde
lea rax, [rsp + 0xef0]
lea r9, [0x100004320]
mov r8d, r14d
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp r13d, edi
je 0x10000dd05
lea rax, [rsp + 0xd10]
lea r9, [0x100004350]
mov r8d, r14d
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp dword [rsp + 0x5c], edi
je 0x10000dd20
lea r9, [0x100004388]
mov r8d, r14d
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp r15d, edi
je 0x10000dde5
lea r9, [0x1000043d0]
mov r8d, 2
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x10000dde5
lea rax, [rsp + 0xd60]
mov qword [rsp + 0x20], rax
cmp r15d, edi
je 0x10000ddd2
lea r9, [0x100004430]
mov r8d, 5
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov r12d, 0x80005
lea r9, [0x100004470]
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp dword [rsp + 0x58], edi
je 0x10000ddae
lea rax, [rsp + 0xef0]
lea r9, [0x1000044b8]
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
cmp dword [rsp + 0x68], edi
je 0x10000dde5
lea rax, [rsp + 0xd10]
lea r9, [0x1000044e0]
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x20], rax
jmp 0x10000dddf
lea r9, [0x100004510]
mov r8d, 2
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
lea rax, [rsp + 0xd60]
lea r9, [0x100004560]
mov edx, ebx
mov rcx, rbp
cmp esi, edi
je 0x10000de09
mov dword [rsp + 0x28], esi
mov r8d, 0x40001
jmp 0x10000de14
mov qword [rsp + 0x28], rdi
mov r8d, 0x40005
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov ebx, 5
cmp esi, 0xe0000248
jne 0x10000de3f
cmp dword [rsp + 0x54], edi
je 0x10000de3f
cmp dword [rsp + 0x48], edi
jne 0x10000de3f
cmp dword [rsp + 0x70], edi
cmovne esi, ebx
mov ecx, esi
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
cmp esi, edi
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x1210]
xor rcx, rsp
call fcn.100014800
mov rbx, qword [rsp + 0x1278]
add rsp, 0x1220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret