Function at 0x4b4100
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xbc
mov eax, dword [0x596f48]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
push edi
push 0x598d40
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 2
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x34]
sete cl
mov byte [0x59811c], cl
lea ecx, [esp + 8]
push ecx
mov dword [0x598120], edx
mov dword [0x598124], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x598128], edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4b419d
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x58de84], eax
call edi
push esi
push 0
mov dword [0x58de88], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.kernel32.dll
call fcn.004b1a00
test eax, eax
mov esi, dword [0x597cd0]
mov dword [0x59816c], eax
je 0x4b4393
push str.FindFirstVolumeW
push eax
call esi
test eax, eax
je 0x4b41cb
mov dword [0x58deb4], eax
mov eax, dword [0x59816c]
push str.FindNextVolumeW
push eax
call esi
test eax, eax
je 0x4b41e1
mov dword [0x58deb8], eax
mov ecx, dword [0x59816c]
push str.FindVolumeClose
push ecx
call esi
test eax, eax
je 0x4b41f8
mov dword [0x58debc], eax
mov edx, dword [0x59816c]
push str.GetVolumeNameForVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4b420f
mov dword [0x58dec0], eax
mov eax, dword [0x59816c]
push str.FindFirstVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4b4225
mov dword [0x58dec4], eax
mov ecx, dword [0x59816c]
push str.FindNextVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4b423c
mov dword [0x58dec8], eax
mov edx, dword [0x59816c]
push str.FindVolumeMountPointClose
push edx
call esi
test eax, eax
je 0x4b4253
mov dword [0x58decc], eax
mov eax, dword [0x59816c]
push str.GetDiskFreeSpaceExW
push eax
call esi
test eax, eax
je 0x4b4269
mov dword [0x58de8c], eax
mov ecx, dword [0x59816c]
push str.GetLongPathNameW
push ecx
call esi
test eax, eax
je 0x4b4280
mov dword [0x58de90], eax
mov edx, dword [0x59816c]
push str.GetVolumePathNamesForVolumeNameW
push edx
call esi
test eax, eax
je 0x4b4297
mov dword [0x58deb0], eax
mov eax, dword [0x59816c]
push str.CancelIo
push eax
call esi
test eax, eax
je 0x4b42ad
mov dword [0x59819c], eax
mov ecx, dword [0x59816c]
push str.GetUserDefaultUILanguage
push ecx
call esi
test eax, eax
je 0x4b42c4
mov dword [0x5981bc], eax
mov edx, dword [0x59816c]
push str.OpenThread
push edx
call esi
test eax, eax
je 0x4b42db
mov dword [0x5981d4], eax
mov eax, dword [0x59816c]
push str.OpenFileById
push eax
call esi
test eax, eax
je 0x4b42f1
mov dword [0x5981d8], eax
mov ecx, dword [0x59816c]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4308
mov dword [0x5981dc], eax
mov edx, dword [0x59816c]
push str.TzSpecificLocalTimeToSystemTime
push edx
call esi
test eax, eax
je 0x4b431f
mov dword [0x598194], eax
mov eax, dword [0x59816c]
push str.ReadDirectoryChangesW
push eax
call esi
test eax, eax
je 0x4b4335
mov dword [0x598110], eax
mov ecx, dword [0x59816c]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b434c
mov dword [0x5981dc], eax
mov edx, dword [0x59816c]
push str.GetNativeSystemInfo
push edx
call esi
test eax, eax
je 0x4b4363
mov dword [0x598118], eax
mov eax, dword [0x59816c]
push str.IsDebuggerPresent
push eax
call esi
test eax, eax
je 0x4b4379
mov dword [0x5981e8], eax
mov eax, dword [0x598118]
test eax, eax
je 0x4b4393
lea ecx, [esp + 8]
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov dword [0x598128], edx
push str.user32.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598170], eax
je 0x4b4470
push str.AllowSetForegroundWindow
push eax
call esi
test eax, eax
je 0x4b43bb
mov dword [0x58ded0], eax
mov eax, dword [0x598170]
push str.MonitorFromWindow
push eax
call esi
test eax, eax
je 0x4b43d1
mov dword [0x58de94], eax
mov ecx, dword [0x598170]
push str.EnumDisplayMonitors
push ecx
call esi
test eax, eax
je 0x4b43e8
mov dword [0x58de98], eax
mov edx, dword [0x598170]
push str.MonitorFromRect
push edx
call esi
test eax, eax
je 0x4b43ff
mov dword [0x58de9c], eax
mov eax, dword [0x598170]
push str.RegisterDeviceNotificationW
push eax
call esi
test eax, eax
je 0x4b4415
mov dword [0x58dea0], eax
mov ecx, dword [0x598170]
push str.UnregisterDeviceNotification
push ecx
call esi
test eax, eax
je 0x4b442c
mov dword [0x58dea4], eax
mov edx, dword [0x598170]
push str.NotifyWinEvent
push edx
call esi
test eax, eax
je 0x4b4443
mov dword [0x58df0c], eax
mov eax, dword [0x598170]
push str.ChangeWindowMessageFilterEx
push eax
call esi
test eax, eax
je 0x4b4459
mov dword [0x5981c0], eax
mov ecx, dword [0x598170]
push str.SetLayeredWindowAttributes
push ecx
call esi
test eax, eax
je 0x4b4470
mov dword [0x5981e4], eax
push str.shell32.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598174], eax
je 0x4b4564
push str.SHMultiFileProperties
push eax
call esi
test eax, eax
je 0x4b4498
mov dword [0x58deac], eax
mov edx, dword [0x598174]
push 0x2bd
push edx
call esi
test eax, eax
je 0x4b44af
mov dword [0x5981a4], eax
mov eax, dword [0x598174]
push str.SHBindToParent
push eax
call esi
test eax, eax
je 0x4b44c5
mov dword [0x58dea8], eax
mov ecx, dword [0x598174]
push str.IsUserAnAdmin
push ecx
call esi
test eax, eax
je 0x4b44dc
mov dword [0x5981ac], eax
mov edx, dword [0x598174]
push 0x2d7
push edx
call esi
test eax, eax
je 0x4b44f3
mov dword [0x5981c4], eax
mov eax, dword [0x598174]
push str.SHGetSettings
push eax
call esi
test eax, eax
je 0x4b4509
mov dword [0x5981c8], eax
mov ecx, dword [0x598174]
push str.SHCreateItemFromIDList
push ecx
call esi
test eax, eax
je 0x4b4520
mov dword [0x598198], eax
mov edx, dword [0x598174]
push str.SHGetPropertyStoreFromIDList
push edx
call esi
test eax, eax
je 0x4b4537
mov dword [0x5981cc], eax
mov eax, dword [0x598174]
push str.SHAddToRecentDocs
push eax
call esi
test eax, eax
je 0x4b454d
mov dword [0x5981d0], eax
mov ecx, dword [0x598174]
push str.SHOpenFolderAndSelectItems
push ecx
call esi
test eax, eax
je 0x4b4564
mov dword [0x5981e0], eax
push str.shlwapi.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598178], eax
je 0x4b4596
push str.AssocCreate
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4b4591
push 0x1f4
push edi
call esi
test eax, eax
je 0x4b4596
mov dword [0x5981a8], eax
push str.uxtheme.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598168], eax
je 0x4b46a1
push str.EnableThemeDialogTexture
push eax
call esi
test eax, eax
je 0x4b45be
mov dword [0x58ded8], eax
mov edx, dword [0x598168]
push str.OpenThemeData
push edx
call esi
test eax, eax
je 0x4b45d5
mov dword [0x58dedc], eax
mov eax, dword [0x598168]
push str.CloseThemeData
push eax
call esi
test eax, eax
je 0x4b45eb
mov dword [0x58ded4], eax
mov ecx, dword [0x598168]
push str.IsThemePartDefined
push ecx
call esi
test eax, eax
je 0x4b4602
mov dword [0x58dee0], eax
mov edx, dword [0x598168]
push str.DrawThemeBackgroundEx
push edx
call esi
test eax, eax
je 0x4b4619
mov dword [0x58dee4], eax
mov eax, dword [0x598168]
push str.DrawThemeEdge
push eax
call esi
test eax, eax
je 0x4b462f
mov dword [0x58dee8], eax
mov ecx, dword [0x598168]
push str.IsThemeBackgroundPartiallyTransparent
push ecx
call esi
test eax, eax
je 0x4b4646
mov dword [0x58deec], eax
mov edx, dword [0x598168]
push str.IsAppThemed
push edx
call esi
test eax, eax
je 0x4b465d
mov dword [0x58def0], eax
mov eax, dword [0x598168]
push str.IsThemeActive
push eax
call esi
test eax, eax
je 0x4b4673
mov dword [0x58def4], eax
mov ecx, dword [0x598168]
push str.GetThemeBackgroundContentRect
push ecx
call esi
test eax, eax
je 0x4b468a
mov dword [0x58def8], eax
mov edx, dword [0x598168]
push str.SetWindowTheme
push edx
call esi
test eax, eax
je 0x4b46a1
mov dword [0x5981b4], eax
push str.ws2_32.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598164], eax
je 0x4b46db
push str.getaddrinfo
push eax
call esi
test eax, eax
je 0x4b46c5
mov dword [0x58defc], eax
mov eax, dword [0x598164]
push str.freeaddrinfo
push eax
call esi
test eax, eax
je 0x4b46db
mov dword [0x58df00], eax
push str.gdi32.dll
call fcn.004b1a00
test eax, eax
mov dword [0x59817c], eax
je 0x4b4716
push str.SetLayout
push eax
call esi
test eax, eax
je 0x4b46ff
mov dword [0x58df04], eax
mov ecx, dword [0x59817c]
push str.GetLayout
push ecx
call esi
test eax, eax
je 0x4b4716
mov dword [0x58df14], eax
push str.advapi32.dll
call fcn.004b1a00
test eax, eax
mov dword [0x598180], eax
je 0x4b4767
push str.QueryServiceStatusEx
push eax
call esi
test eax, eax
je 0x4b473a
mov dword [0x58df08], eax
mov edx, dword [0x598180]
push str.RegDeleteKeyExW
push edx
call esi
test eax, eax
je 0x4b4751
mov dword [0x5981b0], eax
mov eax, dword [0x598180]
push str.RegisterServiceCtrlHandlerExW
push eax
call esi
test eax, eax
je 0x4b4767
mov dword [0x58df10], eax
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
xor ecx, esp
call fcn.0054899c
add esp, 0xbc
ret