Function at 0x1400edea0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get keyboard layout
Get system information on windows
Identify system language via api
Persist via run registry key

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27c0]
mov eax, 0x28c0
call fcn.14010cf70
sub rsp, rax
mov qword [rbp + 0x150], 0xfffffffffffffffe
mov qword [rsp + 0x2908], rbx
mov rbx, rdx
mov rsi, rcx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x30], r13d
lea rdx, str.System_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
call fcn.140104020
lea rdi, str.64_bit
lea rcx, str.32_bit
test eax, eax
cmove rdi, rcx
xor ecx, ecx
call fcn.1401023d0
mov ecx, eax
call fcn.1400f1de0
mov r9, rax
mov r8, rdi
lea rdx, str.OS_Platform_______________s__s_n
mov rcx, qword [rbx]
call fcn.140112ee4
mov word [rbp + 0x80], r13w
xor edx, edx
mov r8d, 0xc6
lea rcx, [rbp + 0x82]
call fcn.14010a9a0
mov dword [rbp + 0x2800], 0xc8
lea rax, vtable.CListObjectBase.0
mov qword [rbp - 0x68], rax
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.1401062b0
nop
lea r15, vtable.CRegistryKey.0
mov qword [rbp - 0x68], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x68]
call fcn.1400ecac0
nop
cmp qword [rbp - 0x50], r13
je 0x1400ee0f3
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x2800]
lea r8, [rbp + 0x80]
lea rdx, str.ProductName
lea rcx, [rbp - 0x60]
call fcn.140106ac0
test eax, eax
je 0x1400edffd
lea r8, [rbp + 0x80]
lea rdx, str.OS_Product_Name___________s_n
mov rcx, qword [rbx]
call fcn.140112ee4
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x2800]
lea r8, [rbp + 0x80]
lea rdx, str.CSDVersion
lea rcx, [rbp - 0x60]
call fcn.140106ac0
test eax, eax
je 0x1400ee03f
lea r8, [rbp + 0x80]
lea rdx, str.OS_Service_Pack___________s_n
mov rcx, qword [rbx]
call fcn.140112ee4
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, str.CurrentMajorVersionNumber
lea rcx, [rbp - 0x60]
call fcn.1401069b0
lea rcx, [rbp - 0x60]
cmp dword [rsp + 0x68], 0
je 0x1400ee0cf
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
lea rdx, str.CurrentMinorVersionNumber
call fcn.1401069b0
mov edi, dword [rsp + 0x60]
mov dword [rbp - 0x10], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x38]
lea rdx, str.CurrentMajorVersionNumber
lea rcx, [rbp - 0x60]
call fcn.1401069b0
mov r9d, edi
mov r8d, dword [rbp - 0x38]
lea rdx, [0x140153338]
lea rcx, [rbp + 0x80]
call fcn.14010d300
jmp 0x1400ee0f3
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x2800]
lea r8, [rbp + 0x80]
lea rdx, str.CurrentVersion
call fcn.140106ac0
mov dword [rsp + 0x58], r13d
lea rcx, [rsp + 0x58]
call fcn.1401023d0
mov r14d, 1
cmp word [rbp + 0x80], 0
je 0x1400ee11b
lea rdi, [rbp + 0x80]
jmp 0x1400ee143
xor ecx, ecx
call fcn.1401028f0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400fd610
mov rdi, rax
mov r12d, r14d
mov dword [rsp + 0x30], r14d
cmp qword [rax + 0x18], 8
jb 0x1400ee143
mov rdi, qword [rax]
lea rcx, [rsp + 0x70]
call fcn.140103ae0
cmp qword [rax + 0x18], 8
jb 0x1400ee157
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x58]
mov r8, rdi
lea rdx, str.OS_Build_Version__________s._d__s_n
mov rcx, qword [rbx]
call fcn.140112ee4
cmp qword [rbp - 0x78], 8
jb 0x1400ee184
mov rcx, qword [rsp + 0x70]
call fcn.14010a7dc
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
test r12b, 1
je 0x1400ee1b0
and r12d, 0xfffffffe
cmp qword [rbp + 0x10], 8
jb 0x1400ee1b0
mov rcx, qword [rbp - 8]
call fcn.14010a7dc
xor ecx, ecx
call fcn.1401028f0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400fd610
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x1400ee1d0
mov rdi, qword [rax]
xor ecx, ecx
call fcn.1401023d0
mov r8d, eax
mov r9, rdi
lea rdx, str.OS_GetOS_Reg_Settings_____d__s_n
mov rcx, qword [rbx]
call fcn.140112ee4
nop
cmp qword [rbp + 0x10], 8
jb 0x1400ee1fe
mov rcx, qword [rbp - 8]
call fcn.14010a7dc
nop
mov qword [rbp - 0x68], r15
lea rcx, [rbp - 0x60]
call fcn.140106310
nop
lea rcx, [rbp - 0x60]
call fcn.140106310
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r8d, word [rbp + 0x158]
test r8d, r8d
je 0x1400ee269
cmp r8d, 6
je 0x1400ee260
cmp r8d, 9
je 0x1400ee257
lea r9, [0x140170890]
lea rax, [0x140153348]
cmp r8d, 0xffff
cmove r9, rax
jmp 0x1400ee270
lea r9, str.x64__AMD_or_Intel_
jmp 0x1400ee270
lea r9, str.Intel_Itanium
jmp 0x1400ee270
lea r9, [0x140170840]
lea rdx, str.Processor_Architecture___0x_x___s_n
mov rcx, qword [rbx]
call fcn.140112ee4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1400ee2b5
mov r9d, dword [rbp + 0x24]
sub r9d, dword [rbp + 0x1c]
mov r8d, dword [rbp + 0x20]
sub r8d, dword [rbp + 0x18]
lea rdx, str.Screen_Resolution_________d_by__d_n
mov rcx, qword [rbx]
call fcn.140112ee4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
test rax, rax
je 0x1400ee303
mov edx, 0x5a
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov edx, 0x58
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, eax
mov r9d, edi
lea rdx, str.System_DPI_Settings_______d_by__d_n
mov rcx, qword [rbx]
call fcn.140112ee4
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.140104b10
mov r9, rax
mov r8d, edi
lea rdx, str.OS_Install_______________0x_x___s_n
mov rcx, qword [rbx]
call fcn.140112ee4
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
movzx ecx, di
call fcn.140104b10
mov r9, rax
mov r8d, edi
lea rdx, str.Current_Display_Language_0x_x___s_n
mov rcx, qword [rbx]
call fcn.140112ee4
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
movzx ecx, di
call fcn.140104b10
mov r9, rax
mov r8d, edi
lea rdx, str.System_Default_Locale____0x_x___s_n
mov rcx, qword [rbx]
call fcn.140112ee4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdi, rax
movzx ecx, ax
call fcn.140104b10
mov r9, rax
movzx r8d, di
lea rdx, str.Keyboard_Layout_Language_0x_x___s_n
mov rcx, qword [rbx]
call fcn.140112ee4
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f1950
lea rdx, str._nCurrent_App_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f3170
or r15, 0xffffffffffffffff
mov dword [rbp + 0x2818], r15d
cmp qword [rsi], 0
je 0x1400ee443
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rax, qword [rcx]
lea r9, [rbp + 0x2818]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x1400ee443
mov r8d, dword [rbp + 0x2818]
lea rdx, str._nDevice__i_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
xor r8d, r8d
mov edx, dword [rbp + 0x2818]
mov rcx, rsi
call fcn.1400ef870
mov rdi, rax
mov r8, rax
lea rdx, [0x140159ff4]
mov rcx, qword [rbx]
call fcn.140112ee4
mov rcx, rdi
call fcn.14010e850
cmp qword [rsi], 0
jne 0x1400ee3e0
lea rdx, str._nProgram_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
lea rax, vtable.CListObjectBase.0
mov qword [rbp + 0x28], rax
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1401062b0
lea rax, vtable.CRegistryKey.0
mov qword [rbp + 0x28], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x48], r13d
mov dword [rbp - 0x70], 0x2000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x28]
call fcn.1400ecac0
test eax, eax
je 0x1400ee50d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x7c0]
lea rdx, str.ProgDir
lea rcx, [rbp + 0x30]
call fcn.140106ac0
mov r14d, 1
test eax, eax
je 0x1400ee513
mov dword [rsp + 0x28], r14d
lea rax, [0x14015d1e8]
mov qword [rsp + 0x20], rax
lea r9, [0x140150af4]
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
jmp 0x1400ee513
mov r14d, 1
lea rdx, str._nSystem_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
lea rcx, str.SystemRoot
call fcn.140114580
mov rdi, rax
test rax, rax
jne 0x1400ee563
lea rcx, str.WinDir
call fcn.140114580
mov rdi, rax
test rax, rax
jne 0x1400ee563
lea rdi, str.C:WINDOWS
mov r8, rdi
lea rdx, str.Cannot_get_environment_variable_for_SYSTEMROOT__assume__s_n
mov rcx, qword [rbx]
call fcn.140112ee4
xor ecx, ecx
call fcn.1401023d0
mov dword [rsp + 0x28], r14d
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
cmp eax, 5
lea rax, str.SynTPCo.
mov qword [rsp + 0x20], rax
jl 0x1400ee614
lea r9, str.System32
call fcn.1400f2b00
mov dword [rsp + 0x28], r14d
lea rax, str.SxSSynTPCo.
mov qword [rsp + 0x20], rax
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], r14d
lea rax, str.SynTPAPI.
mov qword [rsp + 0x20], rax
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], r14d
lea r14, str.SynTPCOM.
mov qword [rsp + 0x20], r14
lea r9, str.System32
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
lea r9, str.System32
jmp 0x1400ee673
lea r9, str.System
call fcn.1400f2b00
mov dword [rsp + 0x28], r14d
lea rax, str.SynTPAPI.
mov qword [rsp + 0x20], rax
lea r9, str.System
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], r14d
lea r14, str.SynTPCOM.
mov qword [rsp + 0x20], r14
lea r9, str.System
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
lea r9, str.System
mov dword [rsp + 0x28], 1
lea rax, str.SynCom.
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], 1
lea rax, str.SynTP.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], 1
lea rax, str.SynPTPHID.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], 1
lea rax, str.SynRMIHID.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], 1
lea rax, str.smb_driver_.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], 1
lea rax, str.i8042prt.sys
mov qword [rsp + 0x20], rax
lea r9, str.System32Drivers
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov edi, r13d
mov word [rbp + 0x7c0], r13w
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x1400ee81e
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ee7b3
mov edx, 0x2000
lea rcx, [rbp + 0x7c0]
call rax
test eax, eax
mov eax, 1
cmovne edi, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x1400ee81e
lea rdx, str._nx64_System_Files_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
mov r13d, 1
mov dword [rsp + 0x28], r13d
lea rdi, str..
mov qword [rsp + 0x20], rdi
mov r9, r14
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rdi
lea r9, str.SynCOM.
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
lea rdx, str._nSynaptics_Files_found_in_PATH_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
lea rax, str.SynTP.sys
mov qword [rbp + 0x80], rax
lea rax, str.SynTPAPI.dll
mov qword [rbp + 0x88], rax
lea rax, str.SynTPCOM.dll
mov qword [rbp + 0x90], rax
lea rax, str.SynTPCpl.dll
mov qword [rbp + 0x98], rax
lea rax, str.SynTPEnh.exe
mov qword [rbp + 0xa0], rax
lea rax, str.SynTPRes.dll
mov qword [rbp + 0xa8], rax
lea rax, str.SynTPFcs.dll
mov qword [rbp + 0xb0], rax
lea rax, str.SynTPLpr.exe
mov qword [rbp + 0xb8], rax
lea rax, str.SynCOM.dll
mov qword [rbp + 0xc0], rax
lea rax, str.SynCtrl.dll
mov qword [rbp + 0xc8], rax
lea rax, str.SynISDLL.dll
mov qword [rbp + 0xd0], rax
lea rax, str.SynTPCo.dll
mov qword [rbp + 0xd8], rax
lea rax, str.SxSSynTPCo.dll
mov qword [rbp + 0xe0], rax
xor r13d, r13d
mov qword [rbp + 0xe8], r13
lea rcx, str.PATH
call fcn.140114580
lea rdx, [rbp + 0x7c0]
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400ee910
lea rdx, [0x140173d54]
lea rcx, [rbp + 0x7c0]
call fcn.1401143bc
mov r14, rax
test rax, rax
je 0x1400ee99d
lea r15, str.SynTP.sys
nop dword [rax]
nop word [rax + rax]
mov rdi, r13
mov rcx, r15
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rcx
lea r9, [0x140150af4]
mov r8, r14
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2b00
inc rdi
mov rcx, qword [rbp + rdi*8 + 0x80]
test rcx, rcx
jne 0x1400ee956
lea rdx, [0x140173d54]
call fcn.1401143bc
mov r14, rax
test rax, rax
jne 0x1400ee950
or r15, 0xffffffffffffffff
lea rdx, str._nEnviroment_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f3080
lea rdx, str._nRegistry_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
lea rax, [rsp + 0x70]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x2800], 0xffffffff80000002
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rsp + 0x70]
call fcn.140009080
nop
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rsp + 0x38]
call fcn.140009080
nop
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], r13
mov word [rbp + 0x58], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp + 0x58]
call fcn.140009080
nop
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r13
mov word [rbp - 0x30], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp - 0x30]
call fcn.140009080
nop
mov qword [rbp + 0x10], 7
mov qword [rbp + 8], r13
mov word [rbp - 8], r13w
mov r8d, 0x27
lea rdx, str.SYSTEMCurrentControlSetServicesSynTP
lea rcx, [rbp - 8]
call fcn.140009080
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x58]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x68]
call fcn.140102e00
nop
or r12d, 2
mov dword [rsp + 0x30], r12d
cmp qword [rax + 0x18], 8
jb 0x1400eeaf4
mov rax, qword [rax]
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SYSTEMCurrentControlSetEnumACPI
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SYSTEMCurrentControlSetEnumHID
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SYSTEMCurrentControlSetEnumSERENUM
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionPrecisionTouchPad
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000002
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWARESynaptics
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000001
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000001
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionPrecisionTouchPad
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000001
mov dword [rsp + 0x20], r13d
lea r9, str.SOFTWARESynaptics
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000001
mov dword [rsp + 0x20], r13d
lea r9, str.Control_PanelDesktop
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000001
mov dword [rsp + 0x20], r13d
lea r9, str.Control_PanelMouse
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000003
mov dword [rsp + 0x20], r13d
lea r9, str..DEFAULTControl_PanelMouse
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
mov qword [rbp + 0x2800], 0xffffffff80000000
mov dword [rsp + 0x20], r13d
lea r9, str.CLSID2F603045_309F_11CF_9774_0020AFD0CFF6InProcServer32
lea r8, [rbp + 0x2800]
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2ee0
test eax, eax
je 0x1400eed8c
xor dil, dil
jmp 0x1400eed8f
mov dil, 1
test r12b, 2
je 0x1400eeda5
cmp qword [rbp - 0x50], 8
jb 0x1400eeda5
mov rcx, qword [rbp - 0x68]
call fcn.14010a7dc
test dil, dil
jne 0x1400ef239
lea rdx, str._nSetupAPI_Log_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
cmp dword [rsi + 0x47c], 0
je 0x1400eee35
mov word [rbp + 0x5b0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x5b2]
call fcn.14010a9a0
mov edx, 0x104
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
call fcn.1401023d0
lea r8, [rbp + 0x5b0]
lea rcx, [rbp + 0x7c0]
cmp eax, 7
lea rdx, str._sSetupAPI.log
je 0x1400eee1c
lea rdx, str._sinf_setupapi.dev.log
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f3460
jmp 0x1400eee44
lea rdx, str._not_included__n
mov rcx, qword [rbx]
call fcn.140112ee4
mov word [rbp + 0x3a0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call fcn.14010a9a0
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400eef51
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
cmp word [rbp + 0x3a0], 0
jne 0x1400eeea7
mov r15, r13
jmp 0x1400eeebb
lea rax, [rbp + 0x3a0]
nop
inc r15
cmp word [rax + r15*2], 0
jne 0x1400eeeb0
mov r8, r15
lea rdx, [rbp + 0x3a0]
lea rcx, [rsp + 0x70]
call fcn.140009080
nop
lea r8, str.SynapticsSynReflashSynReflash.log
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140090f90
nop
cmp qword [rbp - 0x78], 8
jb 0x1400eeef8
mov rcx, qword [rsp + 0x70]
call fcn.14010a7dc
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eef3f
lea rdx, str._nSynReflash_Log_Info_n_________________________________________n
mov rcx, qword [rbx]
call fcn.140112ee4
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f3460
cmp qword [rsp + 0x50], 8
jb 0x1400eef51
mov rcx, qword [rsp + 0x38]
call fcn.14010a7dc
lea rdx, [0x140161f34]
mov rcx, qword [rbx]
call fcn.140112ee4
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rbp + 0x190]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400eef80
mov eax, dword [0x140150658]
mov dword [rcx], eax
mov edi, dword [rbp + 0x2810]
test edi, edi
jne 0x1400eefa4
mov rcx, rsi
call fcn.1400ef7d0
lea r8, [rbp + 0x190]
lea rdx, str._sControl.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sPacket.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sI8042.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sNGIControl.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sNGIPacket.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sUsbControl.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sUsbPacket.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sPTPControl.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sPTPPacket.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sSentOSPackets.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea r8, [rbp + 0x190]
lea rdx, str._sProcessedPackets.KTL
lea rcx, [rbp + 0x7c0]
call fcn.14010d300
lea r8, [rbp + 0x7c0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
test edi, edi
jne 0x1400ef239
lea rcx, [rbp - 0x68]
call fcn.140101700
nop
lea r8, str.SynapticsSynTP_
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140090f90
nop
lea r8, str.Enhancement.KTL
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140090f90
nop
cmp qword [rbp - 0x18], 8
jb 0x1400ef1d3
mov rcx, qword [rbp - 0x30]
call fcn.14010a7dc
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r13
mov word [rbp - 0x30], r13w
cmp qword [rbp - 0x50], 8
jb 0x1400ef1f4
mov rcx, qword [rbp - 0x68]
call fcn.14010a7dc
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1400f2de0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.1401147d4
cmp qword [rsp + 0x50], 8
jb 0x1400ef239
mov rcx, qword [rsp + 0x38]
call fcn.14010a7dc
nop
lea rax, vtable.CRegistryKey.0
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x30]
call fcn.140106310
nop
lea rcx, [rbp + 0x30]
call fcn.140106310
nop
mov rbx, qword [rsp + 0x2908]
add rsp, 0x28c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret