Function at 0x1400e2170
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rcx, [0x14020c240]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsx eax, byte [rsp + 0x54]
cmp dword [rsp + 0x60], 2
mov dword [0x14020b0f4], eax
movsx eax, byte [rsp + 0x58]
lea rcx, [rsp + 0x20]
mov dword [0x14020b0f8], eax
sete byte [0x14020b0f0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [0x14020b0fc], r11d
call qword [sym.imp.USER32.dll_GetDC]
test rax, rax
mov rbx, rax
je 0x1400e2227
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x140200940], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x140200944], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.kernel32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b178], rax
je 0x1400e2562
lea rdx, str.FindFirstVolumeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200998]
lea rdx, str.FindNextVolumeW
test rax, rax
cmovne rcx, rax
mov qword [0x140200998], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009a0]
lea rdx, str.FindVolumeClose
test rax, rax
cmovne rcx, rax
mov qword [0x1402009a0], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009a8]
lea rdx, str.GetVolumeNameForVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [0x1402009a8], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009b0]
lea rdx, str.FindFirstVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [0x1402009b0], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009b8]
lea rdx, str.FindNextVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [0x1402009b8], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009c0]
lea rdx, str.FindVolumeMountPointClose
test rax, rax
cmovne rcx, rax
mov qword [0x1402009c0], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009c8]
lea rdx, str.GetDiskFreeSpaceExW
test rax, rax
cmovne rcx, rax
mov qword [0x1402009c8], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200948]
lea rdx, str.GetLongPathNameW
test rax, rax
cmovne rcx, rax
mov qword [0x140200948], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str.P_r_]
lea rdx, str.GetVolumePathNamesForVolumeNameW
test rax, rax
cmovne rcx, rax
mov qword [str.P_r_], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200990]
lea rdx, str.CancelIo
test rax, rax
cmovne rcx, rax
mov qword [0x140200990], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1d0]
lea rdx, str.GetUserDefaultUILanguage
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1d0], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b210]
test rax, rax
lea rdx, str.OpenThread
cmovne rcx, rax
mov qword [0x14020b210], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b240]
lea rdx, str.OpenFileById
test rax, rax
cmovne rcx, rax
mov qword [0x14020b240], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b248]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020b248], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b250]
lea rdx, str.TzSpecificLocalTimeToSystemTime
test rax, rax
cmovne rcx, rax
mov qword [0x14020b250], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1c0]
lea rdx, str.ReadDirectoryChangesW
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1c0], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b0d8]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020b0d8], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b250]
lea rdx, str.GetNativeSystemInfo
test rax, rax
cmovne rcx, rax
mov qword [0x14020b250], rcx
mov rcx, qword [0x14020b178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x14020b0e8]
test rax, rax
cmovne rdx, rax
test rdx, rdx
mov qword [0x14020b0e8], rdx
je 0x1400e2562
lea rcx, [rsp + 0x20]
call rdx
mov r11d, dword [rsp + 0x40]
mov dword [0x14020b0fc], r11d
lea rcx, str.user32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b180], rax
je 0x1400e26eb
lea rdx, str.AllowSetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009d0]
lea rdx, str.MonitorFromWindow
test rax, rax
cmovne rcx, rax
mov qword [0x1402009d0], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200958]
lea rdx, str.EnumDisplayMonitors
test rax, rax
cmovne rcx, rax
mov qword [0x140200958], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200960]
lea rdx, str.MonitorFromRect
test rax, rax
cmovne rcx, rax
mov qword [0x140200960], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200968]
lea rdx, str.RegisterDeviceNotificationW
test rax, rax
cmovne rcx, rax
mov qword [0x140200968], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200970]
lea rdx, str.UnregisterDeviceNotification
test rax, rax
cmovne rcx, rax
mov qword [0x140200970], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200978]
lea rdx, str.NotifyWinEvent
test rax, rax
cmovne rcx, rax
mov qword [0x140200978], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400da1d0]
lea rdx, str.ChangeWindowMessageFilterEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400da1d0], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b218]
lea rdx, str.SetLayeredWindowAttributes
test rax, rax
cmovne rcx, rax
mov qword [0x14020b218], rcx
mov rcx, qword [0x14020b180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b260]
test rax, rax
cmovne rcx, rax
mov qword [0x14020b260], rcx
lea rcx, str.shell32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b188], rax
je 0x1400e2899
lea rdx, str.SHMultiFileProperties
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200988]
mov edx, 0x2bd
test rax, rax
cmovne rcx, rax
mov qword [0x140200988], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1e0]
lea rdx, str.SHBindToParent
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1e0], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200980]
lea rdx, str.IsUserAnAdmin
test rax, rax
cmovne rcx, rax
mov qword [0x140200980], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1f0]
mov edx, 0x2d7
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1f0], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b220]
lea rdx, str.SHGetSettings
test rax, rax
cmovne rcx, rax
mov qword [0x14020b220], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b228]
lea rdx, str.SHCreateItemFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020b228], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1c8]
lea rdx, str.SHGetPropertyStoreFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1c8], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b230]
lea rdx, str.SHAddToRecentDocs
test rax, rax
cmovne rcx, rax
mov qword [0x14020b230], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b238]
lea rdx, str.SHOpenFolderAndSelectItems
test rax, rax
cmovne rcx, rax
mov qword [0x14020b238], rcx
mov rcx, qword [0x14020b188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b258]
test rax, rax
cmovne rcx, rax
mov qword [0x14020b258], rcx
lea rcx, str.shlwapi.dll
call fcn.1400deb00
test rax, rax
mov rbx, rax
mov qword [0x14020b190], rax
je 0x1400e28f5
lea rdx, str.AssocCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e28d2
mov qword [0x14020b1e8], rax
jmp 0x1400e28f5
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1e8]
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1e8], rcx
lea rcx, str.uxtheme.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b170], rax
je 0x1400e2ad0
lea rdx, str.EnableThemeDialogTexture
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009e0]
lea rdx, str.OpenThemeData
test rax, rax
cmovne rcx, rax
mov qword [0x1402009e0], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009e8]
lea rdx, str.CloseThemeData
test rax, rax
cmovne rcx, rax
mov qword [0x1402009e8], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009d8]
lea rdx, str.IsThemePartDefined
test rax, rax
cmovne rcx, rax
mov qword [0x1402009d8], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009f0]
lea rdx, str.DrawThemeBackgroundEx
test rax, rax
cmovne rcx, rax
mov qword [0x1402009f0], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402009f8]
lea rdx, str.DrawThemeEdge
test rax, rax
cmovne rcx, rax
mov qword [0x1402009f8], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a00]
lea rdx, str.IsThemeBackgroundPartiallyTransparent
test rax, rax
cmovne rcx, rax
mov qword [0x140200a00], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a08]
lea rdx, str.IsAppThemed
test rax, rax
cmovne rcx, rax
mov qword [0x140200a08], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a10]
lea rdx, str.IsThemeActive
test rax, rax
cmovne rcx, rax
mov qword [0x140200a10], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a18]
lea rdx, str.GetThemeBackgroundContentRect
test rax, rax
cmovne rcx, rax
mov qword [0x140200a18], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a20]
lea rdx, str.SetWindowTheme
test rax, rax
cmovne rcx, rax
mov qword [0x140200a20], rcx
mov rcx, qword [0x14020b170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b200]
test rax, rax
cmovne rcx, rax
mov qword [0x14020b200], rcx
lea rcx, str.ws2_32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b168], rax
je 0x1400e2b36
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a28]
lea rdx, str.freeaddrinfo
test rax, rax
cmovne rcx, rax
mov qword [0x140200a28], rcx
mov rcx, qword [0x14020b168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a30]
test rax, rax
cmovne rcx, rax
mov qword [0x140200a30], rcx
lea rcx, str.gdi32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b198], rax
je 0x1400e2b9c
lea rdx, str.SetLayout
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a38]
lea rdx, str.GetLayout
test rax, rax
cmovne rcx, rax
mov qword [0x140200a38], rcx
mov rcx, qword [0x14020b198]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a58]
test rax, rax
cmovne rcx, rax
mov qword [0x140200a58], rcx
lea rcx, str.advapi32.dll
call fcn.1400deb00
test rax, rax
mov qword [0x14020b1a0], rax
je 0x1400e2c2b
lea rdx, str.QueryServiceStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a40]
lea rdx, str.RegDeleteKeyExW
test rax, rax
cmovne rcx, rax
mov qword [0x140200a40], rcx
mov rcx, qword [0x14020b1a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020b1f8]
lea rdx, str.RegisterServiceCtrlHandlerExW
test rax, rax
cmovne rcx, rax
mov qword [0x14020b1f8], rcx
mov rcx, qword [0x14020b1a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140200a50]
test rax, rax
cmovne rcx, rax
mov qword [0x140200a50], rcx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x100
pop rbx
ret