Function at 0x4b4950
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xbc
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
push edi
push 0x598de0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 2
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x34]
sete cl
mov byte [0x5981a0], cl
lea ecx, [esp + 8]
push ecx
mov dword [0x5981a4], edx
mov dword [0x5981a8], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x5981ac], edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4b49ed
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x58def4], eax
call edi
push esi
push 0
mov dword [0x58def8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.kernel32.dll
call fcn.004b2060
test eax, eax
mov esi, dword [0x597d40]
mov dword [0x5981f0], eax
je 0x4b4be3
push str.FindFirstVolumeW
push eax
call esi
test eax, eax
je 0x4b4a1b
mov dword [0x58df24], eax
mov eax, dword [0x5981f0]
push str.FindNextVolumeW
push eax
call esi
test eax, eax
je 0x4b4a31
mov dword [0x58df28], eax
mov ecx, dword [0x5981f0]
push str.FindVolumeClose
push ecx
call esi
test eax, eax
je 0x4b4a48
mov dword [0x58df2c], eax
mov edx, dword [0x5981f0]
push str.GetVolumeNameForVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4b4a5f
mov dword [0x58df30], eax
mov eax, dword [0x5981f0]
push str.FindFirstVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4b4a75
mov dword [0x58df34], eax
mov ecx, dword [0x5981f0]
push str.FindNextVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4b4a8c
mov dword [0x58df38], eax
mov edx, dword [0x5981f0]
push str.FindVolumeMountPointClose
push edx
call esi
test eax, eax
je 0x4b4aa3
mov dword [0x58df3c], eax
mov eax, dword [0x5981f0]
push str.GetDiskFreeSpaceExW
push eax
call esi
test eax, eax
je 0x4b4ab9
mov dword [0x58defc], eax
mov ecx, dword [0x5981f0]
push str.GetLongPathNameW
push ecx
call esi
test eax, eax
je 0x4b4ad0
mov dword [0x58df00], eax
mov edx, dword [0x5981f0]
push str.GetVolumePathNamesForVolumeNameW
push edx
call esi
test eax, eax
je 0x4b4ae7
mov dword [0x58df20], eax
mov eax, dword [0x5981f0]
push str.CancelIo
push eax
call esi
test eax, eax
je 0x4b4afd
mov dword [0x598228], eax
mov ecx, dword [0x5981f0]
push str.GetUserDefaultUILanguage
push ecx
call esi
test eax, eax
je 0x4b4b14
mov dword [0x598248], eax
mov edx, dword [0x5981f0]
push str.OpenThread
push edx
call esi
test eax, eax
je 0x4b4b2b
mov dword [0x598264], eax
mov eax, dword [0x5981f0]
push str.OpenFileById
push eax
call esi
test eax, eax
je 0x4b4b41
mov dword [0x598268], eax
mov ecx, dword [0x5981f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4b58
mov dword [0x59826c], eax
mov edx, dword [0x5981f0]
push str.TzSpecificLocalTimeToSystemTime
push edx
call esi
test eax, eax
je 0x4b4b6f
mov dword [0x598220], eax
mov eax, dword [0x5981f0]
push str.ReadDirectoryChangesW
push eax
call esi
test eax, eax
je 0x4b4b85
mov dword [0x598194], eax
mov ecx, dword [0x5981f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4b9c
mov dword [0x59826c], eax
mov edx, dword [0x5981f0]
push str.GetNativeSystemInfo
push edx
call esi
test eax, eax
je 0x4b4bb3
mov dword [0x59819c], eax
mov eax, dword [0x5981f0]
push str.IsDebuggerPresent
push eax
call esi
test eax, eax
je 0x4b4bc9
mov dword [0x598278], eax
mov eax, dword [0x59819c]
test eax, eax
je 0x4b4be3
lea ecx, [esp + 8]
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov dword [0x5981ac], edx
push str.user32.dll
call fcn.004b2060
test eax, eax
mov dword [0x5981f4], eax
je 0x4b4cc0
push str.AllowSetForegroundWindow
push eax
call esi
test eax, eax
je 0x4b4c0b
mov dword [0x58df40], eax
mov eax, dword [0x5981f4]
push str.MonitorFromWindow
push eax
call esi
test eax, eax
je 0x4b4c21
mov dword [0x58df04], eax
mov ecx, dword [0x5981f4]
push str.EnumDisplayMonitors
push ecx
call esi
test eax, eax
je 0x4b4c38
mov dword [0x58df08], eax
mov edx, dword [0x5981f4]
push str.MonitorFromRect
push edx
call esi
test eax, eax
je 0x4b4c4f
mov dword [0x58df0c], eax
mov eax, dword [0x5981f4]
push str.RegisterDeviceNotificationW
push eax
call esi
test eax, eax
je 0x4b4c65
mov dword [0x58df10], eax
mov ecx, dword [0x5981f4]
push str.UnregisterDeviceNotification
push ecx
call esi
test eax, eax
je 0x4b4c7c
mov dword [0x58df14], eax
mov edx, dword [0x5981f4]
push str.NotifyWinEvent
push edx
call esi
test eax, eax
je 0x4b4c93
mov dword [0x58df7c], eax
mov eax, dword [0x5981f4]
push str.ChangeWindowMessageFilterEx
push eax
call esi
test eax, eax
je 0x4b4ca9
mov dword [0x59824c], eax
mov ecx, dword [0x5981f4]
push str.SetLayeredWindowAttributes
push ecx
call esi
test eax, eax
je 0x4b4cc0
mov dword [0x598274], eax
push str.shell32.dll
call fcn.004b2060
test eax, eax
mov dword [0x5981f8], eax
je 0x4b4dcb
push str.SHMultiFileProperties
push eax
call esi
test eax, eax
je 0x4b4ce8
mov dword [0x58df1c], eax
mov edx, dword [0x5981f8]
push 0x2bd
push edx
call esi
test eax, eax
je 0x4b4cff
mov dword [0x598230], eax
mov eax, dword [0x5981f8]
push str.SHBindToParent
push eax
call esi
test eax, eax
je 0x4b4d15
mov dword [0x58df18], eax
mov ecx, dword [0x5981f8]
push str.IsUserAnAdmin
push ecx
call esi
test eax, eax
je 0x4b4d2c
mov dword [0x598238], eax
mov edx, dword [0x5981f8]
push 0x2d7
push edx
call esi
test eax, eax
je 0x4b4d43
mov dword [0x598250], eax
mov eax, dword [0x5981f8]
push str.SHGetSettings
push eax
call esi
test eax, eax
je 0x4b4d59
mov dword [0x598254], eax
mov ecx, dword [0x5981f8]
push str.SHCreateItemFromIDList
push ecx
call esi
test eax, eax
je 0x4b4d70
mov dword [0x598224], eax
mov edx, dword [0x5981f8]
push str.SHGetPropertyStoreFromIDList
push edx
call esi
test eax, eax
je 0x4b4d87
mov dword [0x598258], eax
mov eax, dword [0x5981f8]
push str.SHAddToRecentDocs
push eax
call esi
test eax, eax
je 0x4b4d9d
mov dword [0x598260], eax
mov ecx, dword [0x5981f8]
push str.SHOpenFolderAndSelectItems
push ecx
call esi
test eax, eax
je 0x4b4db4
mov dword [0x598270], eax
mov edx, dword [0x5981f8]
push str.SHQueryUserNotificationState
push edx
call esi
test eax, eax
je 0x4b4dcb
mov dword [0x59827c], eax
push str.shlwapi.dll
call fcn.004b2060
test eax, eax
mov dword [0x5981fc], eax
je 0x4b4dfd
push str.AssocCreate
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4b4df8
push 0x1f4
push edi
call esi
test eax, eax
je 0x4b4dfd
mov dword [0x598234], eax
push str.uxtheme.dll
call fcn.004b2060
test eax, eax
mov dword [0x5981ec], eax
je 0x4b4f07
push str.EnableThemeDialogTexture
push eax
call esi
test eax, eax
je 0x4b4e25
mov dword [0x58df48], eax
mov eax, dword [0x5981ec]
push str.OpenThemeData
push eax
call esi
test eax, eax
je 0x4b4e3b
mov dword [0x58df4c], eax
mov ecx, dword [0x5981ec]
push str.CloseThemeData
push ecx
call esi
test eax, eax
je 0x4b4e52
mov dword [0x58df44], eax
mov edx, dword [0x5981ec]
push str.IsThemePartDefined
push edx
call esi
test eax, eax
je 0x4b4e69
mov dword [0x58df50], eax
mov eax, dword [0x5981ec]
push str.DrawThemeBackgroundEx
push eax
call esi
test eax, eax
je 0x4b4e7f
mov dword [0x58df54], eax
mov ecx, dword [0x5981ec]
push str.DrawThemeEdge
push ecx
call esi
test eax, eax
je 0x4b4e96
mov dword [0x58df58], eax
mov edx, dword [0x5981ec]
push str.IsThemeBackgroundPartiallyTransparent
push edx
call esi
test eax, eax
je 0x4b4ead
mov dword [0x58df5c], eax
mov eax, dword [0x5981ec]
push str.IsAppThemed
push eax
call esi
test eax, eax
je 0x4b4ec3
mov dword [0x58df60], eax
mov ecx, dword [0x5981ec]
push str.IsThemeActive
push ecx
call esi
test eax, eax
je 0x4b4eda
mov dword [0x58df64], eax
mov edx, dword [0x5981ec]
push str.GetThemeBackgroundContentRect
push edx
call esi
test eax, eax
je 0x4b4ef1
mov dword [0x58df68], eax
mov eax, dword [0x5981ec]
push str.SetWindowTheme
push eax
call esi
test eax, eax
je 0x4b4f07
mov dword [0x598240], eax
push str.ws2_32.dll
call fcn.004b2060
test eax, eax
mov dword [0x5981e8], eax
je 0x4b4f42
push str.getaddrinfo
push eax
call esi
test eax, eax
je 0x4b4f2b
mov dword [0x58df6c], eax
mov ecx, dword [0x5981e8]
push str.freeaddrinfo
push ecx
call esi
test eax, eax
je 0x4b4f42
mov dword [0x58df70], eax
push str.gdi32.dll
call fcn.004b2060
test eax, eax
mov dword [0x598200], eax
je 0x4b4f7d
push str.SetLayout
push eax
call esi
test eax, eax
je 0x4b4f66
mov dword [0x58df74], eax
mov edx, dword [0x598200]
push str.GetLayout
push edx
call esi
test eax, eax
je 0x4b4f7d
mov dword [0x58df84], eax
push str.advapi32.dll
call fcn.004b2060
test eax, eax
mov dword [0x598204], eax
je 0x4b4fe5
push 0x56e668
push eax
call esi
test eax, eax
je 0x4b4fa1
mov dword [0x58df78], eax
mov eax, dword [0x598204]
push str.RegDeleteKeyExW
push eax
call esi
test eax, eax
je 0x4b4fb7
mov dword [0x59823c], eax
mov ecx, dword [0x598204]
push str.RegisterServiceCtrlHandlerExW
push ecx
call esi
test eax, eax
je 0x4b4fce
mov dword [0x58df80], eax
mov edx, dword [0x598204]
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push edx
call esi
test eax, eax
je 0x4b4fe5
mov dword [0x59825c], eax
push str.urlmon.dll
call fcn.004b2060
test eax, eax
mov dword [0x598218], eax
je 0x4b5009
push str.CopyStgMedium
push eax
call esi
test eax, eax
je 0x4b5009
mov dword [0x598280], eax
push str.imm32.dll
call fcn.004b2060
test eax, eax
mov dword [0x59821c], eax
je 0x4b502d
push str.ImmGetVirtualKey
push eax
call esi
test eax, eax
je 0x4b502d
mov dword [0x598284], eax
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
xor ecx, esp
call fcn.0054962d
add esp, 0xbc
ret