Function at 0x1400fa000
Capabilities:
Enumerate device drivers on windows
Get common file path
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3190]
mov eax, 0x3290
call fcn.140160160
sub rsp, rax
mov rax, qword [0x1403fad18]
xor rax, rsp
mov qword [rbp + 0x3180], rax
xor r12d, r12d
lea rsi, [rbp + 0x1f70]
lea rcx, [rbp + 0x1f70]
mov edx, 0x104
lea r14, [rsp + 0x70]
mov qword [rsp + 0x60], rsi
mov edi, r12d
mov r15d, r12d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1400fa11d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jg 0x1400fa084
mov ebx, eax
jmp 0x1400fa08d
movzx ebx, ax
or ebx, 0x80070000
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
mov rcx, rax
test rax, rax
je 0x1400fa0dd
mov qword [rsp + 0x38], r12
lea rax, str.void___cdecl_VirtualBox::i_reportDriverVersions_void_
lea r13, str.C:_virtualbox_srcVBoxMain_src_serverVirtualBoxImpl.cpp
mov qword [rsp + 0x30], rax
lea r9, str.AssertLogRel__s__d___s:__s_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov dword [rsp + 0x28], 0x14f5
mov qword [rsp + 0x20], r13
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa651
mov dword [rsp + 0x30], edi
lea r9, str.GetWindowsDirectory_failed__hr_Rhrc__0x_x__err_u_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
jmp 0x1400fa651
lea r13, str.C:_virtualbox_srcVBoxMain_src_serverVirtualBoxImpl.cpp
cmp ebx, 0x104
jbe 0x1400fa280
mov rcx, rbx
mov rdx, r13
add rcx, rcx
call qword [sym.imp.BstkRT.dll_RTMemTmpAllocTag]
mov rsi, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400fa1cb
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
mov rcx, rax
test rax, rax
je 0x1400fa193
mov qword [rsp + 0x38], r12
lea rax, str.void___cdecl_VirtualBox::i_reportDriverVersions_void_
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rax
lea edx, [rsi + 0x10]
mov r8d, 0xa8
mov dword [rsp + 0x28], 0x14fe
mov qword [rsp + 0x20], r13
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa63c
lea r9, str.RTMemTmpAlloc_failed_to_allocate__d_bytes_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
jmp 0x1400fa63c
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400fa280
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jg 0x1400fa1ee
mov ebx, eax
jmp 0x1400fa1f7
movzx ebx, ax
or ebx, 0x80070000
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
mov rcx, rax
test rax, rax
je 0x1400fa240
mov qword [rsp + 0x38], r12
lea rax, str.void___cdecl_VirtualBox::i_reportDriverVersions_void_
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov dword [rsp + 0x28], 0x1506
mov qword [rsp + 0x20], r13
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa63c
mov dword [rsp + 0x30], edi
lea r9, str.GetWindowsDirectory_failed__hr_Rhrc__0x_x__err_u_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
jmp 0x1400fa63c
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov edx, 0x2000
mov dword [rsp + 0x50], r12d
call sub.PSAPI.DLL_EnumDeviceDrivers
mov ecx, dword [rsp + 0x50]
test eax, eax
je 0x1400fa2ad
cmp ecx, 0x2000
jbe 0x1400fa374
mov rdx, r13
call qword [sym.imp.BstkRT.dll_RTMemTmpAllocTag]
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, rax
mov r14, rax
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
jne 0x1400fa374
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jg 0x1400fa2e2
mov ebx, eax
jmp 0x1400fa2eb
movzx ebx, ax
or ebx, 0x80070000
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
mov rcx, rax
test rax, rax
je 0x1400fa334
mov qword [rsp + 0x38], r12
lea rax, str.void___cdecl_VirtualBox::i_reportDriverVersions_void_
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov dword [rsp + 0x28], 0x1514
mov qword [rsp + 0x20], r13
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa624
mov dword [rsp + 0x30], edi
lea r9, str.EnumDeviceDrivers_failed__hr_Rhrc__0x_x__err_u_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
jmp 0x1400fa624
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa39f
lea r9, str.Installed_Drivers:_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov eax, dword [rsp + 0x50]
shr eax, 3
mov ebx, eax
mov qword [rsp + 0x58], rbx
test eax, eax
jle 0x1400fa624
mov rcx, qword [r14 + r12*8]
lea rdx, [rbp + 0x2180]
mov r8d, 0x400
call sub.PSAPI.DLL_GetDeviceDriverBaseNameW
test eax, eax
je 0x1400fa582
lea rdx, [rbp + 0x2180]
lea rcx, [0x140275760]
mov r8d, 4
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x1400fa582
mov rcx, qword [r14 + r12*8]
lea rdx, [rbp + 0x2180]
mov r8d, 0x400
call sub.PSAPI.DLL_GetDeviceDriverFileNameW
test eax, eax
je 0x1400fa582
lea rdx, [rbp + 0x2180]
lea rcx, str.SystemRoot
mov r8d, reloc.WS2_32.dll_inet_addr
lea rbx, [rbp + 0x2180]
call qword [sym.imp.MSVCR100.dll_wcsncmp]
test eax, eax
jne 0x1400fa474
lea rcx, [rbp + 0x2980]
mov r8, rsi
mov edx, 0x400
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
mov r9d, 0x3ff
lea r8, [rbp + 0x2196]
lea edx, [r9 + 1]
lea rcx, [rbp + 0x2980]
call qword [sym.imp.MSVCR100.dll_wcsncat_s]
lea rsi, [rbp + 0x2980]
jmp 0x1400fa49b
lea rdx, [rbp + 0x2180]
lea rcx, [0x140275738]
mov r8d, 4
call qword [sym.imp.MSVCR100.dll_wcsncmp]
lea rsi, [rbp + 0x2188]
test eax, eax
cmovne rsi, rbx
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp eax, r15d
jbe 0x1400fa4d5
test rdi, rdi
je 0x1400fa4ba
mov rcx, rdi
call qword [sym.imp.BstkRT.dll_RTMemTmpFree]
mov rcx, rbx
mov rdx, r13
mov r15d, ebx
call qword [sym.imp.BstkRT.dll_RTMemTmpAllocTag]
mov rdi, rax
test rax, rax
je 0x1400fa598
mov r9, rdi
mov r8d, r15d
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400fa57d
xor eax, eax
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x68]
lea rdx, [0x140275730]
mov rcx, rdi
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x68], rax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400fa57d
cmp dword [rsp + 0x54], 0
je 0x1400fa57d
mov rbx, qword [rsp + 0x68]
cmp dword [rbx], 0xfeef04bd
jne 0x1400fa57d
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa57d
movzx r8d, word [rbx + 0xc]
movzx r9d, word [rbx + 0xe]
movzx ecx, word [rbx + 8]
movzx edx, word [rbx + 0xa]
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea r9, str.___ls__Version:__d._d._d._d__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov rbx, qword [rsp + 0x58]
inc r12
cmp r12, rbx
jge 0x1400fa616
mov rsi, qword [rsp + 0x60]
jmp 0x1400fa3b5
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
mov rcx, rax
test rax, rax
je 0x1400fa5e5
mov qword [rsp + 0x38], 0
lea rax, str.void___cdecl_VirtualBox::i_reportDriverVersions_void_
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov dword [rsp + 0x28], 0x153d
mov qword [rsp + 0x20], r13
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
mov ecx, 0xa80010
call qword [sym.imp.BstkRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400fa624
lea r9, str.RTMemTmpAlloc_failed_to_allocate__d_bytes_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xa8
mov rcx, rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.BstkRT.dll_RTLogLoggerEx]
jmp 0x1400fa624
test rdi, rdi
je 0x1400fa624
mov rcx, rdi
call qword [sym.imp.BstkRT.dll_RTMemTmpFree]
lea rax, [rsp + 0x70]
cmp r14, rax
je 0x1400fa637
mov rcx, r14
call qword [sym.imp.BstkRT.dll_RTMemTmpFree]
mov rsi, qword [rsp + 0x60]
lea rax, [rbp + 0x1f70]
cmp rsi, rax
je 0x1400fa651
mov rcx, rsi
call qword [sym.imp.BstkRT.dll_RTMemTmpFree]
mov rcx, qword [rbp + 0x3180]
xor rcx, rsp
call fcn.14015fe00
lea r11, [rsp + 0x3290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret