Function at 0x1400e3820
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rcx, [0x14020f3a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsx eax, byte [rsp + 0x54]
cmp dword [rsp + 0x60], 2
mov dword [0x14020e204], eax
movsx eax, byte [rsp + 0x58]
lea rcx, [rsp + 0x20]
mov dword [0x14020e208], eax
sete byte [0x14020e200]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [0x14020e20c], r11d
call qword [sym.imp.USER32.dll_GetDC]
test rax, rax
mov rbx, rax
je 0x1400e38d7
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x140203a50], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x140203a54], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.kernel32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e288], rax
je 0x1400e3c42
lea rdx, str.FindFirstVolumeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203aa8]
lea rdx, str.FindNextVolumeW
test rax, rax
cmovne rcx, rax
mov qword [0x140203aa8], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.FindVolumeClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.GetVolumeNameForVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.FindFirstVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ac8]
lea rdx, str.FindNextVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [0x140203ac8], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.FindVolumeMountPointClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.GetDiskFreeSpaceExW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str._p_r_]
lea rdx, str.GetLongPathNameW
test rax, rax
cmovne rcx, rax
mov qword [str._p_r_], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a60]
lea rdx, str.GetVolumePathNamesForVolumeNameW
test rax, rax
cmovne rcx, rax
mov qword [0x140203a60], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203aa0]
lea rdx, str.CancelIo
test rax, rax
cmovne rcx, rax
mov qword [0x140203aa0], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2f0]
lea rdx, str.GetUserDefaultUILanguage
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2f0], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e330]
test rax, rax
lea rdx, str.OpenThread
cmovne rcx, rax
mov qword [0x14020e330], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e368]
lea rdx, str.OpenFileById
test rax, rax
cmovne rcx, rax
mov qword [0x14020e368], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e370]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020e370], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e378]
lea rdx, str.TzSpecificLocalTimeToSystemTime
test rax, rax
cmovne rcx, rax
mov qword [0x14020e378], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2e0]
lea rdx, str.ReadDirectoryChangesW
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2e0], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e1e8]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020e1e8], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e378]
lea rdx, str.GetNativeSystemInfo
test rax, rax
cmovne rcx, rax
mov qword [0x14020e378], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e1f8]
lea rdx, [0x1401d0f90]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e1f8], rcx
mov rcx, qword [0x14020e288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e390]
test rax, rax
cmovne rcx, rax
mov rax, qword [0x14020e1f8]
test rax, rax
mov qword [0x14020e390], rcx
je 0x1400e3c42
lea rcx, [rsp + 0x20]
call rax
mov r11d, dword [rsp + 0x40]
mov dword [0x14020e20c], r11d
lea rcx, str.user32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e290], rax
je 0x1400e3dcb
lea rdx, str.AllowSetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.MonitorFromWindow
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.EnumDisplayMonitors
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.MonitorFromRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.RegisterDeviceNotificationW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.UnregisterDeviceNotification
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.NotifyWinEvent
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.140054030]
lea rdx, str.ChangeWindowMessageFilterEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.140054030], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e338]
lea rdx, str.SetLayeredWindowAttributes
test rax, rax
cmovne rcx, rax
mov qword [0x14020e338], rcx
mov rcx, qword [0x14020e290]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e388]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e388], rcx
lea rcx, str.shell32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e298], rax
je 0x1400e3fa2
lea rdx, str.SHMultiFileProperties
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a98]
mov edx, 0x2bd
test rax, rax
cmovne rcx, rax
mov qword [0x140203a98], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e300]
lea rdx, str.SHBindToParent
test rax, rax
cmovne rcx, rax
mov qword [0x14020e300], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a90]
lea rdx, str.IsUserAnAdmin
test rax, rax
cmovne rcx, rax
mov qword [0x140203a90], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e310]
mov edx, 0x2d7
test rax, rax
cmovne rcx, rax
mov qword [0x14020e310], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e340]
lea rdx, str.SHGetSettings
test rax, rax
cmovne rcx, rax
mov qword [0x14020e340], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e348]
lea rdx, str.SHCreateItemFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020e348], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2e8]
lea rdx, str.SHGetPropertyStoreFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2e8], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e350]
lea rdx, str.SHAddToRecentDocs
test rax, rax
cmovne rcx, rax
mov qword [0x14020e350], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e360]
lea rdx, str.SHOpenFolderAndSelectItems
test rax, rax
cmovne rcx, rax
mov qword [0x14020e360], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e380]
lea rdx, str.SHQueryUserNotificationState
test rax, rax
cmovne rcx, rax
mov qword [0x14020e380], rcx
mov rcx, qword [0x14020e298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e398]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e398], rcx
lea rcx, str.shlwapi.dll
call fcn.1400dff40
test rax, rax
mov rbx, rax
mov qword [0x14020e2a0], rax
je 0x1400e3ffe
lea rdx, str.AssocCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e3fdb
mov qword [0x14020e308], rax
jmp 0x1400e3ffe
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e308]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e308], rcx
lea rcx, str.uxtheme.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e280], rax
je 0x1400e41d9
lea rdx, str.EnableThemeDialogTexture
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203af0]
lea rdx, str.OpenThemeData
test rax, rax
cmovne rcx, rax
mov qword [0x140203af0], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.CloseThemeData
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ae8]
lea rdx, str.IsThemePartDefined
test rax, rax
cmovne rcx, rax
mov qword [0x140203ae8], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.DrawThemeBackgroundEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b08]
lea rdx, str.DrawThemeEdge
test rax, rax
cmovne rcx, rax
mov qword [0x140203b08], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b10]
lea rdx, str.IsThemeBackgroundPartiallyTransparent
test rax, rax
cmovne rcx, rax
mov qword [0x140203b10], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.IsAppThemed
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.IsThemeActive
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.GetThemeBackgroundContentRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b30]
lea rdx, str.SetWindowTheme
test rax, rax
cmovne rcx, rax
mov qword [0x140203b30], rcx
mov rcx, qword [0x14020e280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e320]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e320], rcx
lea rcx, str.ws2_32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e278], rax
je 0x1400e423f
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b38]
lea rdx, str.freeaddrinfo
test rax, rax
cmovne rcx, rax
mov qword [0x140203b38], rcx
mov rcx, qword [0x14020e278]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b40]
test rax, rax
cmovne rcx, rax
mov qword [0x140203b40], rcx
lea rcx, str.gdi32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e2a8], rax
je 0x1400e42a5
lea rdx, str.SetLayout
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400b5030]
lea rdx, str.GetLayout
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400b5030], rcx
mov rcx, qword [0x14020e2a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str.0P_v_]
test rax, rax
cmovne rcx, rax
mov qword [str.0P_v_], rcx
lea rcx, str.advapi32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e2b0], rax
je 0x1400e4361
lea rdx, [0x1401d0bf8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b50]
lea rdx, str.RegDeleteKeyExW
test rax, rax
cmovne rcx, rax
mov qword [0x140203b50], rcx
mov rcx, qword [0x14020e2b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e318]
lea rdx, str.RegisterServiceCtrlHandlerExW
test rax, rax
cmovne rcx, rax
mov qword [0x14020e318], rcx
mov rcx, qword [0x14020e2b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b60]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
test rax, rax
cmovne rcx, rax
mov qword [0x140203b60], rcx
mov rcx, qword [0x14020e2b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e358]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e358], rcx
lea rcx, str.urlmon.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e2d0], rax
je 0x1400e439e
lea rdx, str.CopyStgMedium
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e3a0]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e3a0], rcx
lea rcx, str.imm32.dll
call fcn.1400dff40
test rax, rax
mov qword [0x14020e2d8], rax
je 0x1400e43db
lea rdx, str.ImmGetVirtualKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e3a8]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e3a8], rcx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x100
pop rbx
ret