Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
.text:0000060000102F08 ; =============== S U B R O U T I N E =======================================
.text:0000060000102F08 ; __int64 IsCPUSupported(void)
.text:0000060000102F08 ?IsCPUSupported@@YAHXZ proc near ; CODE XREF: IsDeviceServiceable(void):loc_600000AF3D8p
.text:0000060000102F08 var_C8 = dword ptr -0C8h
.text:0000060000102F08 var_C0 = qword ptr -0C0h
.text:0000060000102F08 var_B8 = dword ptr -0B8h
.text:0000060000102F08 var_B4 = dword ptr -0B4h
.text:0000060000102F08 var_B0 = dword ptr -0B0h
.text:0000060000102F08 var_AC = dword ptr -0ACh
.text:0000060000102F08 Dst = dword ptr -0A8h
.text:0000060000102F08 var_A4 = qword ptr -0A4h
.text:0000060000102F08 var_9C = dword ptr -9Ch
.text:0000060000102F08 var_98 = _EVENT_DATA_DESCRIPTOR ptr -98h
.text:0000060000102F08 var_78 = qword ptr -78h
.text:0000060000102F08 var_70 = dword ptr -70h
.text:0000060000102F08 var_6C = dword ptr -6Ch
.text:0000060000102F08 var_68 = qword ptr -68h
.text:0000060000102F08 var_60 = dword ptr -60h
.text:0000060000102F08 var_5C = dword ptr -5Ch
.text:0000060000102F08 var_58 = qword ptr -58h
.text:0000060000102F08 var_50 = dword ptr -50h
.text:0000060000102F08 var_4C = dword ptr -4Ch
.text:0000060000102F08 var_48 = byte ptr -48h
.text:0000060000102F08 var_30 = qword ptr -30h
.text:0000060000102F08 var_28 = byte ptr -28h
.text:0000060000102F08 mov r11, rsp
.text:0000060000102F0B mov [r11+8], rbx
.text:0000060000102F0F mov [r11+10h], rbp
.text:0000060000102F13 mov [r11+18h], rsi
.text:0000060000102F17 push rdi
.text:0000060000102F18 push r12
.text:0000060000102F1A push r13
.text:0000060000102F1C push r14
.text:0000060000102F1E push r15
.text:0000060000102F20 sub rsp, 0C0h
.text:0000060000102F27 mov rax, cs:__security_cookie
.text:0000060000102F2E xor rax, rsp
.text:0000060000102F31 mov [rsp+0E8h+var_30], rax
.text:0000060000102F39 xor eax, eax
.text:0000060000102F3B xor r15d, r15d
.text:0000060000102F3E mov edi, 1
.text:0000060000102F43 mov dword ptr [rsp+0E8h+var_A4], eax
.text:0000060000102F47 mov [rsp+0E8h+var_9C], eax
.text:0000060000102F4B mov [r11-47h], rax
.text:0000060000102F4F mov [r11-3Fh], rax
.text:0000060000102F53 mov [r11-37h], ax
.text:0000060000102F58 mov [r11-35h], al
.text:0000060000102F5C mov dword ptr [rsp+0E8h+var_A4+4], eax
.text:0000060000102F60 xor ecx, ecx
.text:0000060000102F62 mov eax, edi
.text:0000060000102F64 cpuid
.text:0000060000102F66 mov [rsp+0E8h+var_B8], edi
.text:0000060000102F6A mov [rsp+0E8h+var_B0], r15d
.text:0000060000102F6F mov [rsp+0E8h+var_AC], r15d
.text:0000060000102F74 mov [rsp+0E8h+var_B4], r15d
.text:0000060000102F79 mov [r11-48h], r15b
.text:0000060000102F7D mov r12, r15
.text:0000060000102F80 mov ebp, r15d
.text:0000060000102F83 mov r14, r15
.text:0000060000102F86 mov r13d, r15d
.text:0000060000102F89 mov [rsp+0E8h+Dst], eax
.text:0000060000102F8D mov dword ptr [rsp+0E8h+var_A4], ebx
.text:0000060000102F91 mov [rsp+0E8h+var_9C], edx
.text:0000060000102F95 test ecx, ecx
.text:0000060000102F97 jns short loc_60000102FCB
.text:0000060000102F99 lea r8d, [rdi+0Fh] ; Size
.text:0000060000102F9D lea rcx, [rsp+0E8h+Dst] ; Dst
.text:0000060000102FA2 xor edx, edx ; Val
.text:0000060000102FA4 call memset_0
.text:0000060000102FA9 xor ecx, ecx
.text:0000060000102FAB mov eax, 40000003h
.text:0000060000102FB0 cpuid
.text:0000060000102FB2 bt ebx, 0Ch
.text:0000060000102FB6 mov [rsp+0E8h+Dst], eax
.text:0000060000102FBA mov dword ptr [rsp+0E8h+var_A4+4], ecx
.text:0000060000102FBE mov [rsp+0E8h+var_9C], edx
.text:0000060000102FC2 jb short loc_60000102FCB
.text:0000060000102FC4 loc_60000102FC4: ; CODE XREF: IsCPUSupported(void)+EAj
.text:0000060000102FC4 mov eax, edi
.text:0000060000102FC6 jmp loc_60000103167
.text:0000060000102FCB ; ---------------------------------------------------------------------------
.text:0000060000102FCB loc_60000102FCB: ; CODE XREF: IsCPUSupported(void)+8Fj
.text:0000060000102FCB ; IsCPUSupported(void)+BAj
.text:0000060000102FCB lea r9, [rsp+0E8h+var_48]
.text:0000060000102FD3 lea r8, [rsp+0E8h+var_B4]
.text:0000060000102FD8 lea rdx, [rsp+0E8h+var_AC]
.text:0000060000102FDD lea rcx, [rsp+0E8h+var_B0]
.text:0000060000102FE2 mov [rsp+0E8h+var_C8], 14h
.text:0000060000102FEA call sub_60000102E04
.text:0000060000102FEF cmp eax, r15d
.text:0000060000102FF2 jl short loc_60000102FC4
.text:0000060000102FF4 mov ebx, [rsp+0E8h+var_AC]
.text:0000060000102FF8 mov eax, 0Dh
.text:0000060000102FFD lea rsi, [rsp+0E8h+var_48]
.text:0000060000103005 shl ebx, 8
.text:0000060000103008 lea rdi, aAuthenticamd ; "AuthenticAMD"
.text:000006000010300F mov rcx, rax
.text:0000060000103012 or ebx, [rsp+0E8h+var_B0]
.text:0000060000103016 repe cmpsb
.text:0000060000103018 lea r8d, [rax-8]
.text:000006000010301C jnz short loc_60000103034
.text:000006000010301E lea ebp, [rax-0Ch]
.text:0000060000103021 lea r12, unk_6000023563C
.text:0000060000103028 lea r14, unk_6000023564C
.text:000006000010302F mov r13d, ebp
.text:0000060000103032 jmp short loc_60000103061
.text:0000060000103034 ; ---------------------------------------------------------------------------
.text:0000060000103034 loc_60000103034: ; CODE XREF: IsCPUSupported(void)+114j
.text:0000060000103034 lea rsi, [rsp+0E8h+var_48]
.text:000006000010303C lea rdi, aGenuineintel ; "GenuineIntel"
.text:0000060000103043 mov rcx, rax
.text:0000060000103046 repe cmpsb
.text:0000060000103048 jnz short loc_60000103061
.text:000006000010304A lea r12, unk_6000023CBC0
.text:0000060000103051 mov ebp, r8d
.text:0000060000103054 lea r14, unk_6000023561C
.text:000006000010305B mov r13d, 1
.text:0000060000103061 loc_60000103061: ; CODE XREF: IsCPUSupported(void)+12Aj
.text:0000060000103061 ; IsCPUSupported(void)+140j
.text:0000060000103061 mov edi, [rsp+0E8h+var_B4]
.text:0000060000103065 mov edx, [rsp+0E8h+var_B8]
.text:0000060000103069 movsxd rcx, ebp
.text:000006000010306C cmp rcx, r15
.text:000006000010306F mov rax, r15
.text:0000060000103072 jle short loc_60000103088
.text:0000060000103074 loc_60000103074: ; CODE XREF: IsCPUSupported(void)+17Aj
.text:0000060000103074 cmp [r12+rax*4], edi
.text:0000060000103078 cmovz edx, r15d
.text:000006000010307C inc rax
.text:000006000010307F cmp rax, rcx
.text:0000060000103082 jl short loc_60000103074
.text:0000060000103084 mov [rsp+0E8h+var_B8], edx
.text:0000060000103088 loc_60000103088: ; CODE XREF: IsCPUSupported(void)+16Aj
.text:0000060000103088 movsxd rcx, r13d
.text:000006000010308B mov rax, r15
.text:000006000010308E cmp rcx, r15
.text:0000060000103091 jle short loc_600001030A7
.text:0000060000103093 loc_60000103093: ; CODE XREF: IsCPUSupported(void)+199j
.text:0000060000103093 cmp [r14+rax*4], ebx
.text:0000060000103097 cmovz edx, r15d
.text:000006000010309B inc rax
.text:000006000010309E cmp rax, rcx
.text:00000600001030A1 jl short loc_60000103093
.text:00000600001030A3 mov [rsp+0E8h+var_B8], edx
.text:00000600001030A7 loc_600001030A7: ; CODE XREF: IsCPUSupported(void)+189j
.text:00000600001030A7 cmp cs:dword_600002EE980, r8d
.text:00000600001030AE jbe loc_60000103165
.text:00000600001030B4 mov rsi, 400000000000h
.text:00000600001030BE test cs:qword_600002EE990, rsi
.text:00000600001030C5 jz loc_60000103165
.text:00000600001030CB mov rcx, cs:qword_600002EE998
.text:00000600001030D2 mov rax, rcx
.text:00000600001030D5 and rax, rsi
.text:00000600001030D8 cmp rax, rcx
.text:00000600001030DB jnz loc_60000103165
.text:00000600001030E1 mov ecx, 4
.text:00000600001030E6 lea rax, [rsp+0E8h+var_B8]
.text:00000600001030EB lea rdx, unk_600002CEC11 ; void *
.text:00000600001030F2 mov [rsp+0E8h+var_78], rax
.text:00000600001030F7 lea rax, [rsp+0E8h+var_B4]
.text:00000600001030FC mov [rsp+0E8h+var_70], ecx
.text:0000060000103100 mov [rsp+0E8h+var_68], rax
.text:0000060000103108 lea rax, [rsp+0E8h+var_B0]
.text:000006000010310D mov [rsp+0E8h+var_60], ecx
.text:0000060000103114 mov [rsp+0E8h+var_58], rax
.text:000006000010311C lea rax, [rsp+0E8h+var_98]
.text:0000060000103121 mov [rsp+0E8h+var_50], ecx
.text:0000060000103128 mov [rsp+0E8h+var_C0], rax ; struct _EVENT_DATA_DESCRIPTOR *
.text:000006000010312D mov [rsp+0E8h+var_C8], r8d ; unsigned int
.text:0000060000103132 lea rcx, dword_600002EE980 ; struct _TlgProvider_t *
.text:0000060000103139 xor r8d, r8d ; struct _GUID *
.text:000006000010313C xor r9d, r9d ; struct _GUID *
.text:000006000010313F mov [rsp+0E8h+var_B4], edi
.text:0000060000103143 mov [rsp+0E8h+var_B0], ebx
.text:0000060000103147 mov [rsp+0E8h+var_6C], r15d
.text:000006000010314C mov [rsp+0E8h+var_5C], r15d
.text:0000060000103154 mov [rsp+0E8h+var_4C], r15d
.text:000006000010315C call ?_TlgWrite@@YAJPEBU_TlgProvider_t@@PEFBXPEBU_GUID@@2IPEAU_EVENT_DATA_DESCRIPTOR@@@Z ; _TlgWrite(_TlgProvider_t const *,void const *,_GUID const *,_GUID const *,uint,_EVENT_DATA_DESCRIPTOR *)
.text:0000060000103161 mov edx, [rsp+0E8h+var_B8]
.text:0000060000103165 loc_60000103165: ; CODE XREF: IsCPUSupported(void)+1A6j
.text:0000060000103165 ; IsCPUSupported(void)+1BDj ...
.text:0000060000103165 mov eax, edx
.text:0000060000103167 loc_60000103167: ; CODE XREF: IsCPUSupported(void)+BEj
.text:0000060000103167 mov rcx, [rsp+0E8h+var_30]
.text:000006000010316F xor rcx, rsp ; StackCookie
.text:0000060000103172 call __security_check_cookie
.text:0000060000103177 lea r11, [rsp+0E8h+var_28]
.text:000006000010317F mov rbx, [r11+30h]
.text:0000060000103183 mov rbp, [r11+38h]
.text:0000060000103187 mov rsi, [r11+40h]
.text:000006000010318B mov rsp, r11
.text:000006000010318E pop r15
.text:0000060000103190 pop r14
.text:0000060000103192 pop r13
.text:0000060000103194 pop r12
.text:0000060000103196 pop rdi
.text:0000060000103197 retn
.text:0000060000103197 ; ---------------------------------------------------------------------------
.text:0000060000103198 align 20h
.text:0000060000103198 ?IsCPUSupported@@YAHXZ endp
__int64 IsCPUSupported(void)
_DWORD *v5; // r12@1
signed int v6; // ebp@1
_DWORD *v7; // r14@1
signed int v8; // er13@1
unsigned __int8 v14; // cf@2
__int64 result; // rax@3
int v16; // edx@9
signed __int64 v17; // rax@9
signed __int64 v18; // rax@14
int v19; // [sp+30h] [bp-B8h]@1
int v20; // [sp+34h] [bp-B4h]@1
int v21; // [sp+38h] [bp-B0h]@1
int v22; // [sp+3Ch] [bp-ACh]@1
int Dst; // [sp+40h] [bp-A8h]@1
__int64 v24; // [sp+44h] [bp-A4h]@1
int v25; // [sp+4Ch] [bp-9Ch]@1
struct _EVENT_DATA_DESCRIPTOR v26; // [sp+50h] [bp-98h]@22
int *v27; // [sp+70h] [bp-78h]@22
int v28; // [sp+78h] [bp-70h]@22
int v29; // [sp+7Ch] [bp-6Ch]@22
int *v30; // [sp+80h] [bp-68h]@22
int v31; // [sp+88h] [bp-60h]@22
int v32; // [sp+8Ch] [bp-5Ch]@22
int *v33; // [sp+90h] [bp-58h]@22
int v34; // [sp+98h] [bp-50h]@22
int v35; // [sp+9Ch] [bp-4Ch]@22
char v36; // [sp+A0h] [bp-48h]@1
__int64 v37; // [sp+A1h] [bp-47h]@1
__int64 v38; // [sp+A9h] [bp-3Fh]@1
__int16 v39; // [sp+B1h] [bp-37h]@1
char v40; // [sp+B3h] [bp-35h]@1
v37 = 0i64;
v38 = 0i64;
v39 = 0;
v40 = 0;
_RAX = 1i64;
__asm { cpuid }
v19 = 1;
v21 = 0;
v22 = 0;
v20 = 0;
v36 = 0;
v5 = 0i64;
v6 = 0;
v7 = 0i64;
v8 = 0;
Dst = _RAX;
v24 = (unsigned int)_RBX;
v25 = _RDX;
if ( (signed int)_RCX < 0 )
memset_0(&Dst, 0, 0x10ui64);
_RAX = 1073741827i64;
__asm { cpuid }
v14 = _bittest((const signed int *)&_RBX, 0xCu);
Dst = _RAX;
HIDWORD(v24) = _RCX;
v25 = _RDX;
if ( !v14 )
goto LABEL_26;
if ( (signed int)sub_60000102E04(&v21, &v22, &v20, (__int64)&v36) >= 0 )
if ( !memcmp(&v36, "AuthenticAMD", 0xDui64) )
v6 = 1;
v5 = &unk_6000023563C;
v7 = &unk_6000023564C;
v8 = 1;
else if ( !memcmp(&v36, "GenuineIntel", 0xDui64) )
v5 = &unk_6000023CBC0;
v6 = 5;
v7 = &unk_6000023561C;
v8 = 1;
v16 = v19;
v17 = 0i64;
if ( v6 > 0i64 )
if ( v5[v17] == v20 )
v16 = 0;
while ( v17 < v6 );
v19 = v16;
v18 = 0i64;
if ( v8 > 0i64 )
if ( v7[v18] == (v21 | (v22 << 8)) )
v16 = 0;
while ( v18 < v8 );
v19 = v16;
if ( (unsigned int)dword_600002EE980 > 5
&& qword_600002EE990 & 0x400000000000i64
&& (qword_600002EE998 & 0x400000000000i64) == qword_600002EE998 )
v27 = &v19;
v28 = 4;
v30 = &v20;
v31 = 4;
v33 = &v21;
v34 = 4;
v21 |= v22 << 8;
v29 = 0;
v32 = 0;
v35 = 0;
_TlgWrite((const struct _TlgProvider_t *)&dword_600002EE980, &unk_600002CEC11, 0i64, 0i64, 5u, &v26);
v16 = v19;
result = (unsigned int)v16;
result = 1i64;
return result;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment