Function at 0x496720
Capabilities:
Check if file exists
Check os version
Get common file path
Get file attributes
Get keyboard layout
Get system information on windows
Identify system language via api
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x2738
call fcn.004e39b0
sub rsp, rax
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [rsp + 0x2750], rbx
mov qword [rsp + 0x2758], rbp
mov qword [rsp + 0x2730], rsi
mov qword [rsp + 0x2728], rdi
mov qword [rsp + 0x2720], r12
mov qword [rsp + 0x2718], r13
mov qword [rsp + 0x2710], r14
mov qword [rsp + 0x2708], r15
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x26f0], rax
mov rbx, rdx
mov rsi, rcx
lea rdx, str.System_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
call fcn.0049e070
lea rdi, str.64_bit
lea rcx, str.32_bit
test eax, eax
cmove rdi, rcx
call fcn.0049de50
mov edx, eax
mov rcx, rsi
call fcn.004908d0
mov r9, rax
mov r8, rdi
lea rdx, str.OS_Platform_______________s__s_n
mov rcx, qword [rbx]
call fcn.004ac020
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x160]
call fcn.004a8900
mov dword [rsp + 0x160], 0x11c
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49687a
cmp word [rsp + 0x174], 0
je 0x496848
movzx r9d, word [rsp + 0x276]
movzx r8d, word [rsp + 0x274]
lea rax, [rsp + 0x174]
mov qword [rsp + 0x20], rax
lea rdx, str.OS_Service_Pack___________d._d___s_n
mov rcx, qword [rbx]
call fcn.004ac020
test byte [rsp + 0x278], 0x40
lea rax, str.XP_Embedded_Installed
lea r9, [0x004e7dfc]
cmovne r9, rax
movzx r8d, word [rsp + 0x278]
lea rdx, str.OS_Suite_Mask____________0x_x__s_n
mov rcx, qword [rbx]
call fcn.004ac020
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r8d, word [rsp + 0x108]
test r8d, r8d
je 0x4968cf
cmp r8d, 6
je 0x4968c6
cmp r8d, 9
je 0x4968bd
lea r9, [0x004f41d0]
lea rax, str.Unknown
cmp r8d, 0xffff
cmove r9, rax
jmp 0x4968d6
lea r9, str.x64__AMD_or_Intel_
jmp 0x4968d6
lea r9, str.Intel_Itanium
jmp 0x4968d6
lea r9, [0x004f4180]
lea rdx, str.Processor_Architecture___0x_x___s_n
mov rcx, qword [rbx]
call fcn.004ac020
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x496920
mov r9d, dword [rsp + 0x74]
sub r9d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x70]
sub r8d, dword [rsp + 0x68]
lea rdx, str.Screen_Resolution_________d_by__d_n
mov rcx, qword [rbx]
call fcn.004ac020
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbp, rax
test rax, rax
je 0x49696e
mov edx, 0x5a
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov edx, 0x58
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, eax
mov r9d, edi
lea rdx, str.System_DPI_Settings_______d_by__d_n
mov rcx, qword [rbx]
call fcn.004ac020
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.0049e100
mov r9, rax
mov r8d, edi
lea rdx, str.OS_Install_______________0x_x___s_n
mov rcx, qword [rbx]
call fcn.004ac020
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.0049e100
mov r9, rax
mov r8d, edi
lea rdx, str.Current_Display_Language_0x_x___s_n
mov rcx, qword [rbx]
call fcn.004ac020
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
movzx ecx, di
call fcn.0049e100
mov r9, rax
mov r8d, edi
lea rdx, str.System_Default_Locale____0x_x___s_n
mov rcx, qword [rbx]
call fcn.004ac020
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdi, rax
movzx ecx, ax
call fcn.0049e100
mov r9, rax
movzx r8d, di
lea rdx, str.Keyboard_Layout_Language_0x_x___s_n
mov rcx, qword [rbx]
call fcn.004ac020
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.004920f0
mov dword [rsp + 0x60], 0xffffffff
mov rcx, qword [rsi]
test rcx, rcx
je 0x496a8c
nop
nop
nop
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x496a8c
mov r8d, dword [rsp + 0x60]
lea rdx, str._nDevice__li_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
xor r8d, r8d
mov edx, dword [rsp + 0x60]
mov rcx, rsi
call fcn.00493ff0
mov rdi, rax
mov r8, rax
lea rdx, [0x004ebe78]
mov rcx, qword [rbx]
call fcn.004ac020
mov rcx, rdi
call fcn.004a8850
mov rcx, qword [rsi]
test rcx, rcx
jne 0x496a30
lea rdx, str._nProgram_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
lea rcx, str.ProgramFiles
call fcn.004b0080
test rax, rax
jne 0x496ac2
lea r8, [rsi + 0x490]
lea rdx, str.Cannot_get_environment_variable_for_PROGRAMFILES__assume__s_n
mov rcx, qword [rbx]
call fcn.004ac020
lea r8, [rsi + 0x490]
mov r15d, 1
mov dword [rsp + 0x28], r15d
lea rax, [0x004ed1a0]
mov qword [rsp + 0x20], rax
lea r9, str.Synaptics
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
lea rdx, str._nSystem_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
lea rcx, str.SystemRoot
call fcn.004afdc0
mov rdi, rax
test rax, rax
jne 0x496b42
lea rcx, str.WinDir
call fcn.004afdc0
mov rdi, rax
test rax, rax
jne 0x496b42
lea rdi, str.C:WINDOWS
mov r8, rdi
lea rdx, str.Cannot_get_environment_variable_for_SYSTEMROOT__assume__s_n
mov rcx, qword [rbx]
call fcn.004ac020
call fcn.0049de50
cmp eax, 5
jl 0x496bc0
mov dword [rsp + 0x28], r15d
lea rbp, str.SynTP.
mov qword [rsp + 0x20], rbp
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea rax, str.SynCom.
mov qword [rsp + 0x20], rax
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea r12, str.SynCtrl.
mov qword [rsp + 0x20], r12
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
jmp 0x496c32
mov dword [rsp + 0x28], r15d
lea rbp, str.SynTP.
mov qword [rsp + 0x20], rbp
lea r9, str.System
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea rax, str.SynCom.
mov qword [rsp + 0x20], rax
lea r9, str.System
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea r12, str.SynCtrl.
mov qword [rsp + 0x20], r12
lea r9, str.System
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea rax, [0x004f6ee0]
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
lea rax, str.i8042prt.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
xor r14d, r14d
mov edi, r14d
mov word [rsp + 0x6a0], di
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x496d56
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x496ccf
mov edx, 0x2000
lea rcx, [rsp + 0x6a0]
call rax
test eax, eax
cmovne edi, r15d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x496d56
lea rdx, str._nx64_System_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
mov dword [rsp + 0x28], r15d
lea rdi, str..
mov qword [rsp + 0x20], rdi
mov r9, rbp
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
lea r9, str.SynCOM.
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
mov r9, r12
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
lea rdx, str._nSynaptics_Files_found_in_PATH_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
lea r12, str.SynTP.sys
mov qword [rsp + 0x80], r12
lea rax, str.SynTPAPI.dll
mov qword [rsp + 0x88], rax
lea rax, str.SynTPCOM.dll
mov qword [rsp + 0x90], rax
lea rax, str.SynTPCpl.dll
mov qword [rsp + 0x98], rax
lea rax, str.SynTPEnh.exe
mov qword [rsp + 0xa0], rax
lea rax, str.SynTPRes.dll
mov qword [rsp + 0xa8], rax
lea rax, str.SynTPFcs.dll
mov qword [rsp + 0xb0], rax
lea rax, str.SynTPLpr.exe
mov qword [rsp + 0xb8], rax
lea rax, str.SynCOM.dll
mov qword [rsp + 0xc0], rax
lea rax, str.SynCtrl.dll
mov qword [rsp + 0xc8], rax
lea rax, str.SynISDLL.dll
mov qword [rsp + 0xd0], rax
lea rax, str.SynTPCoI.dll
mov qword [rsp + 0xd8], rax
lea rax, str.SynTPCo2.dll
mov qword [rsp + 0xe0], rax
lea rax, str.SynTPCo3.dll
mov qword [rsp + 0xe8], rax
lea rax, str.SynTPCo4.dll
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r14
lea rcx, str.PATH
call fcn.004afdc0
lea rdx, [rsp + 0x6a0]
movzx ecx, word [rax]
mov word [rdx], cx
add rax, 2
add rdx, 2
test cx, cx
jne 0x496e62
lea rdx, [0x004ec90c]
lea rcx, [rsp + 0x6a0]
call fcn.004afec0
mov rbp, rax
test rax, rax
je 0x496ee9
nop
nop
nop
nop
mov rdi, r14
mov rcx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
lea r9, [0x004e7dfc]
mov r8, rbp
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00493080
add rdi, r15
mov rcx, qword [rsp + rdi*8 + 0x80]
test rcx, rcx
jne 0x496ea6
lea rdx, [0x004ec90c]
call fcn.004afec0
mov rbp, rax
test rax, rax
jne 0x496ea0
lea rdx, str._nEnviroment_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, rax
test rax, rax
je 0x496f63
mov rdi, rax
movzx ecx, word [rax]
test cx, cx
je 0x496f5a
test cx, cx
je 0x496f3f
nop
nop
movzx r8d, cx
lea rdx, [0x004f544c]
mov rcx, rbp
call fcn.004ac020
add rdi, 2
mov cx, word [rdi]
test cx, cx
jne 0x496f20
lea rdx, [0x004ef1bc]
mov rcx, rbp
call fcn.004ac020
add rdi, 2
mov cx, word [rdi]
test cx, cx
jne 0x496f14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea rdx, str._nRegistry_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
lea r12, [0x004e7e98]
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.0049d230
lea rbp, [0x004f3a08]
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetServicesSynTP
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x140]
call fcn.0049da30
test eax, eax
jne 0x497112
cmp qword [rsi + 8], 0
je 0x4970cd
cmp qword [rsi + 0x28], 0
je 0x4970cd
mov rcx, qword [rbx]
call fcn.004ac1b0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x27]
lea rcx, [rsp + 0x38]
call fcn.00401f80
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
add rdx, rdx
mov r9d, 0x4e
lea r8, str.SYSTEMCurrentControlSetServicesSynTP
call fcn.004a7900
mov qword [rsp + 0x50], 0x27
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + 0x4e], 0
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsi + 0x10]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x58], 8
jb 0x497098
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
cmp qword [rsi + 0x30], 8
jb 0x4970ba
mov rcx, qword [rsi + 0x18]
jmp 0x4970be
lea rcx, [rsi + 0x18]
lea rdx, [0x004f65b0]
call fcn.004ac4c0
mov qword [rbx], rax
mov edi, r14d
cmp qword [rbx], rdi
setne dil
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
test edi, edi
je 0x497d58
jmp 0x49715d
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetServicesSynTP
mov rdx, 0xffffffff80000002
mov rcx, qword [rbx]
call fcn.0049fa70
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.0049d230
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumACPI
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x140]
call fcn.0049da30
test eax, eax
jne 0x4972ef
cmp qword [rsi + 8], 0
je 0x4972aa
cmp qword [rsi + 0x28], 0
je 0x4972aa
mov rcx, qword [rbx]
call fcn.004ac1b0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x22]
lea rcx, [rsp + 0x38]
call fcn.00401f80
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
add rdx, rdx
mov r9d, 0x44
lea r8, str.SYSTEMCurrentControlSetEnumACPI
call fcn.004a7900
mov qword [rsp + 0x50], SafeArrayAllocDescriptor
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + 0x44], 0
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsi + 0x10]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x58], 8
jb 0x497275
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
cmp qword [rsi + 0x30], 8
jb 0x497297
mov rcx, qword [rsi + 0x18]
jmp 0x49729b
lea rcx, [rsi + 0x18]
lea rdx, [0x004f65b0]
call fcn.004ac4c0
mov qword [rbx], rax
mov edi, r14d
cmp qword [rbx], rdi
setne dil
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
test edi, edi
je 0x497d58
jmp 0x49733a
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumACPI
mov rdx, 0xffffffff80000002
mov rcx, qword [rbx]
call fcn.0049fa70
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.0049d230
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumHID
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x140]
call fcn.0049da30
test eax, eax
jne 0x4974cc
cmp qword [rsi + 8], 0
je 0x497487
cmp qword [rsi + 0x28], 0
je 0x497487
mov rcx, qword [rbx]
call fcn.004ac1b0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x21]
lea rcx, [rsp + 0x38]
call fcn.00401f80
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
add rdx, rdx
mov r9d, 0x42
lea r8, str.SYSTEMCurrentControlSetEnumHID
call fcn.004a7900
mov qword [rsp + 0x50], SafeArrayAllocDescriptor
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + 0x42], 0
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsi + 0x10]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x58], 8
jb 0x497452
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
cmp qword [rsi + 0x30], 8
jb 0x497474
mov rcx, qword [rsi + 0x18]
jmp 0x497478
lea rcx, [rsi + 0x18]
lea rdx, [0x004f65b0]
call fcn.004ac4c0
mov qword [rbx], rax
mov edi, r14d
cmp qword [rbx], rdi
setne dil
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
test edi, edi
je 0x497d58
jmp 0x497517
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumHID
mov rdx, 0xffffffff80000002
mov rcx, qword [rbx]
call fcn.0049fa70
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.0049d230
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumSERENUM
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x140]
call fcn.0049da30
test eax, eax
jne 0x4976a9
cmp qword [rsi + 8], 0
je 0x497664
cmp qword [rsi + 0x28], 0
je 0x497664
mov rcx, qword [rbx]
call fcn.004ac1b0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x25]
lea rcx, [rsp + 0x38]
call fcn.00401f80
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
add rdx, rdx
mov r9d, 0x4a
lea r8, str.SYSTEMCurrentControlSetEnumSERENUM
call fcn.004a7900
mov qword [rsp + 0x50], 0x25
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + 0x4a], 0
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsi + 0x10]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x58], 8
jb 0x49762f
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
cmp qword [rsi + 0x30], 8
jb 0x497651
mov rcx, qword [rsi + 0x18]
jmp 0x497655
lea rcx, [rsi + 0x18]
lea rdx, [0x004f65b0]
call fcn.004ac4c0
mov qword [rbx], rax
mov edi, r14d
cmp qword [rbx], rdi
setne dil
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
test edi, edi
je 0x497d58
jmp 0x4976f4
xor r9d, r9d
lea r8, str.SYSTEMCurrentControlSetEnumSERENUM
mov rdx, 0xffffffff80000002
mov rcx, qword [rbx]
call fcn.0049fa70
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.0049d230
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SOFTWARESynaptics
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x140]
call fcn.0049da30
test eax, eax
jne 0x497844
cmp qword [rsi + 8], 0
je 0x4977ff
cmp qword [rsi + 0x28], 0
je 0x4977ff
mov rcx, qword [rbx]
call fcn.004ac1b0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
mov r8d, 0x12
lea rdx, str.SOFTWARESynaptics
lea rcx, [rsp + 0x38]
call fcn.00402780
nop
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsi + 0x10]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x58], 8
jb 0x4977ca
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
cmp qword [rsi + 0x30], 8
jb 0x4977ec
mov rcx, qword [rsi + 0x18]
jmp 0x4977f0
lea rcx, [rsi + 0x18]
lea rdx, [0x004f65b0]
call fcn.004ac4c0
mov qword [rbx], rax
mov edi, r14d
cmp qword [rbx], rdi
setne dil
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
test edi, edi
je 0x497d58
jmp 0x49788f
xor r9d, r9d
lea r8, str.SOFTWARESynaptics
mov rdx, 0xffffffff80000002
mov rcx, qword [rbx]
call fcn.0049fa70
nop
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x138], rbp
lea rcx, [rsp + 0x140]
call fcn.0049d250
nop
lea rcx, [rsp + 0x140]
call fcn.0049d9e0
nop
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x20], r14d
lea r9, str.SOFTWARESynaptics
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.00495ff0
test eax, eax
je 0x497d58
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x20], r14d
lea r9, str.Control_PanelMouse
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.00495ff0
test eax, eax
je 0x497d58
mov qword [rsp + 0x30], 0xffffffff80000003
mov dword [rsp + 0x20], r14d
lea r9, str..DEFAULTControl_PanelMouse
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.00495ff0
test eax, eax
je 0x497d58
mov qword [rsp + 0x30], 0xffffffff80000000
mov dword [rsp + 0x20], r14d
lea r9, str.CLSID2F603045_309F_11CF_9774_0020AFD0CFF6InProcServer32
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.00495ff0
test eax, eax
je 0x497d58
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x20], r14d
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.00495ff0
test eax, eax
je 0x497d58
lea rdx, str._nSetupAPI_Log_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
cmp dword [rsi + 0x464], 0
je 0x497a17
mov word [rsp + 0x490], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x492]
call fcn.004a8900
mov edx, 0x104
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.0049de50
cmp eax, 7
jne 0x4979e6
lea r8, [rsp + 0x490]
lea rdx, str._sSetupAPI.log
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
jmp 0x497a02
lea r8, [rsp + 0x490]
lea rdx, str._sinf_setupapi.dev.log
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491f10
jmp 0x497a26
lea rdx, str._not_included__n
mov rcx, qword [rbx]
call fcn.004ac020
cmp dword [rsi + 0x468], 0
je 0x497b59
mov word [rsp + 0x490], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x492]
call fcn.004a8900
lea rdx, [rsp + 0x490]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x497b59
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x490]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x38]
call fcn.00402780
nop
lea r8, str.SynapticsSynReflashSynReflash.log
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x138]
call fcn.00456f10
nop
cmp qword [rsp + 0x58], 8
jb 0x497ae8
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
lea rcx, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x497b41
lea rdx, str._nSynReflash_Log_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.004ac020
lea r8, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae r8, qword [rsp + 0x140]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491f10
cmp qword [rsp + 0x158], 8
jb 0x497b59
mov rcx, qword [rsp + 0x140]
call fcn.004a6f90
lea rdx, [0x004ef1bc]
mov rcx, qword [rbx]
call fcn.004ac020
mov edx, 0x104
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdi, [rsp + 0x280]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x004e8098]
mov dword [rdi - 2], eax
lea r8, [rsp + 0x280]
lea rdx, str._sControl.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea rcx, [rsp + 0x6a0]
call fcn.004afe90
lea r8, [rsp + 0x280]
lea rdx, str._sPacket.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea rcx, [rsp + 0x6a0]
call fcn.004afe90
lea r8, [rsp + 0x280]
lea rdx, str._sI8042.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea rcx, [rsp + 0x6a0]
call fcn.004afe90
lea r8, [rsp + 0x280]
lea rdx, str._sProcessedPackets.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea rcx, [rsp + 0x6a0]
call fcn.004afe90
mov rcx, rsi
call fcn.00492040
lea r8, [rsp + 0x280]
lea rdx, str._sControl.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491dd0
lea r8, [rsp + 0x280]
lea rdx, str._sPacket.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491dd0
lea r8, [rsp + 0x280]
lea rdx, str._sI8042.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491dd0
lea r8, [rsp + 0x280]
lea rdx, str._sProcessedPackets.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491dd0
lea r8, [rsp + 0x280]
lea rdx, str._sEnhancement.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea r8, [rsp + 0x6a0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00491dd0
lea r8, [rsp + 0x280]
lea rdx, str._sEnhancement.KTL
lea rcx, [rsp + 0x6a0]
call fcn.004aa720
lea rcx, [rsp + 0x6a0]
call fcn.004afe90
mov rcx, qword [rsp + 0x26f0]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x2750]
mov rbp, qword [rsp + 0x2758]
mov rsi, qword [rsp + 0x2730]
mov rdi, qword [rsp + 0x2728]
mov r12, qword [rsp + 0x2720]
mov r13, qword [rsp + 0x2718]
mov r14, qword [rsp + 0x2710]
mov r15, qword [rsp + 0x2708]
add rsp, 0x2738
ret