Function at 0x4b4c30
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xbc
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
push edi
push 0x599de0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 2
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x34]
sete cl
mov byte [0x5991a0], cl
lea ecx, [esp + 8]
push ecx
mov dword [0x5991a4], edx
mov dword [0x5991a8], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x5991ac], edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4b4ccd
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x58eef4], eax
call edi
push esi
push 0
mov dword [0x58eef8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.kernel32.dll
call fcn.004b2330
test eax, eax
mov esi, dword [0x598d40]
mov dword [0x5991f0], eax
je 0x4b4ec3
push str.FindFirstVolumeW
push eax
call esi
test eax, eax
je 0x4b4cfb
mov dword [0x58ef24], eax
mov eax, dword [0x5991f0]
push str.FindNextVolumeW
push eax
call esi
test eax, eax
je 0x4b4d11
mov dword [0x58ef28], eax
mov ecx, dword [0x5991f0]
push str.FindVolumeClose
push ecx
call esi
test eax, eax
je 0x4b4d28
mov dword [0x58ef2c], eax
mov edx, dword [0x5991f0]
push str.GetVolumeNameForVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4b4d3f
mov dword [0x58ef30], eax
mov eax, dword [0x5991f0]
push str.FindFirstVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4b4d55
mov dword [0x58ef34], eax
mov ecx, dword [0x5991f0]
push str.FindNextVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4b4d6c
mov dword [0x58ef38], eax
mov edx, dword [0x5991f0]
push str.FindVolumeMountPointClose
push edx
call esi
test eax, eax
je 0x4b4d83
mov dword [0x58ef3c], eax
mov eax, dword [0x5991f0]
push str.GetDiskFreeSpaceExW
push eax
call esi
test eax, eax
je 0x4b4d99
mov dword [0x58eefc], eax
mov ecx, dword [0x5991f0]
push str.GetLongPathNameW
push ecx
call esi
test eax, eax
je 0x4b4db0
mov dword [0x58ef00], eax
mov edx, dword [0x5991f0]
push str.GetVolumePathNamesForVolumeNameW
push edx
call esi
test eax, eax
je 0x4b4dc7
mov dword [0x58ef20], eax
mov eax, dword [0x5991f0]
push str.CancelIo
push eax
call esi
test eax, eax
je 0x4b4ddd
mov dword [0x599228], eax
mov ecx, dword [0x5991f0]
push str.GetUserDefaultUILanguage
push ecx
call esi
test eax, eax
je 0x4b4df4
mov dword [0x599248], eax
mov edx, dword [0x5991f0]
push str.OpenThread
push edx
call esi
test eax, eax
je 0x4b4e0b
mov dword [0x599264], eax
mov eax, dword [0x5991f0]
push str.OpenFileById
push eax
call esi
test eax, eax
je 0x4b4e21
mov dword [0x599268], eax
mov ecx, dword [0x5991f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4e38
mov dword [0x59926c], eax
mov edx, dword [0x5991f0]
push str.TzSpecificLocalTimeToSystemTime
push edx
call esi
test eax, eax
je 0x4b4e4f
mov dword [0x599220], eax
mov eax, dword [0x5991f0]
push str.ReadDirectoryChangesW
push eax
call esi
test eax, eax
je 0x4b4e65
mov dword [0x599194], eax
mov ecx, dword [0x5991f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4e7c
mov dword [0x59926c], eax
mov edx, dword [0x5991f0]
push str.GetNativeSystemInfo
push edx
call esi
test eax, eax
je 0x4b4e93
mov dword [0x59919c], eax
mov eax, dword [0x5991f0]
push str.IsDebuggerPresent
push eax
call esi
test eax, eax
je 0x4b4ea9
mov dword [0x599278], eax
mov eax, dword [0x59919c]
test eax, eax
je 0x4b4ec3
lea ecx, [esp + 8]
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov dword [0x5991ac], edx
push str.user32.dll
call fcn.004b2330
test eax, eax
mov dword [0x5991f4], eax
je 0x4b4fa0
push str.AllowSetForegroundWindow
push eax
call esi
test eax, eax
je 0x4b4eeb
mov dword [0x58ef40], eax
mov eax, dword [0x5991f4]
push str.MonitorFromWindow
push eax
call esi
test eax, eax
je 0x4b4f01
mov dword [0x58ef04], eax
mov ecx, dword [0x5991f4]
push str.EnumDisplayMonitors
push ecx
call esi
test eax, eax
je 0x4b4f18
mov dword [0x58ef08], eax
mov edx, dword [0x5991f4]
push str.MonitorFromRect
push edx
call esi
test eax, eax
je 0x4b4f2f
mov dword [0x58ef0c], eax
mov eax, dword [0x5991f4]
push str.RegisterDeviceNotificationW
push eax
call esi
test eax, eax
je 0x4b4f45
mov dword [0x58ef10], eax
mov ecx, dword [0x5991f4]
push str.UnregisterDeviceNotification
push ecx
call esi
test eax, eax
je 0x4b4f5c
mov dword [0x58ef14], eax
mov edx, dword [0x5991f4]
push str.NotifyWinEvent
push edx
call esi
test eax, eax
je 0x4b4f73
mov dword [0x58ef7c], eax
mov eax, dword [0x5991f4]
push str.ChangeWindowMessageFilterEx
push eax
call esi
test eax, eax
je 0x4b4f89
mov dword [0x59924c], eax
mov ecx, dword [0x5991f4]
push str.SetLayeredWindowAttributes
push ecx
call esi
test eax, eax
je 0x4b4fa0
mov dword [0x599274], eax
push str.shell32.dll
call fcn.004b2330
test eax, eax
mov dword [0x5991f8], eax
je 0x4b50ab
push str.SHMultiFileProperties
push eax
call esi
test eax, eax
je 0x4b4fc8
mov dword [0x58ef1c], eax
mov edx, dword [0x5991f8]
push 0x2bd
push edx
call esi
test eax, eax
je 0x4b4fdf
mov dword [0x599230], eax
mov eax, dword [0x5991f8]
push str.SHBindToParent
push eax
call esi
test eax, eax
je 0x4b4ff5
mov dword [0x58ef18], eax
mov ecx, dword [0x5991f8]
push str.IsUserAnAdmin
push ecx
call esi
test eax, eax
je 0x4b500c
mov dword [0x599238], eax
mov edx, dword [0x5991f8]
push 0x2d7
push edx
call esi
test eax, eax
je 0x4b5023
mov dword [0x599250], eax
mov eax, dword [0x5991f8]
push str.SHGetSettings
push eax
call esi
test eax, eax
je 0x4b5039
mov dword [0x599254], eax
mov ecx, dword [0x5991f8]
push str.SHCreateItemFromIDList
push ecx
call esi
test eax, eax
je 0x4b5050
mov dword [0x599224], eax
mov edx, dword [0x5991f8]
push str.SHGetPropertyStoreFromIDList
push edx
call esi
test eax, eax
je 0x4b5067
mov dword [0x599258], eax
mov eax, dword [0x5991f8]
push str.SHAddToRecentDocs
push eax
call esi
test eax, eax
je 0x4b507d
mov dword [0x599260], eax
mov ecx, dword [0x5991f8]
push str.SHOpenFolderAndSelectItems
push ecx
call esi
test eax, eax
je 0x4b5094
mov dword [0x599270], eax
mov edx, dword [0x5991f8]
push str.SHQueryUserNotificationState
push edx
call esi
test eax, eax
je 0x4b50ab
mov dword [0x59927c], eax
push str.shlwapi.dll
call fcn.004b2330
test eax, eax
mov dword [0x5991fc], eax
je 0x4b50dd
push str.AssocCreate
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4b50d8
push 0x1f4
push edi
call esi
test eax, eax
je 0x4b50dd
mov dword [0x599234], eax
push str.uxtheme.dll
call fcn.004b2330
test eax, eax
mov dword [0x5991ec], eax
je 0x4b51e7
push str.EnableThemeDialogTexture
push eax
call esi
test eax, eax
je 0x4b5105
mov dword [0x58ef48], eax
mov eax, dword [0x5991ec]
push str.OpenThemeData
push eax
call esi
test eax, eax
je 0x4b511b
mov dword [0x58ef4c], eax
mov ecx, dword [0x5991ec]
push str.CloseThemeData
push ecx
call esi
test eax, eax
je 0x4b5132
mov dword [0x58ef44], eax
mov edx, dword [0x5991ec]
push str.IsThemePartDefined
push edx
call esi
test eax, eax
je 0x4b5149
mov dword [0x58ef50], eax
mov eax, dword [0x5991ec]
push str.DrawThemeBackgroundEx
push eax
call esi
test eax, eax
je 0x4b515f
mov dword [0x58ef54], eax
mov ecx, dword [0x5991ec]
push str.DrawThemeEdge
push ecx
call esi
test eax, eax
je 0x4b5176
mov dword [0x58ef58], eax
mov edx, dword [0x5991ec]
push str.IsThemeBackgroundPartiallyTransparent
push edx
call esi
test eax, eax
je 0x4b518d
mov dword [0x58ef5c], eax
mov eax, dword [0x5991ec]
push str.IsAppThemed
push eax
call esi
test eax, eax
je 0x4b51a3
mov dword [0x58ef60], eax
mov ecx, dword [0x5991ec]
push str.IsThemeActive
push ecx
call esi
test eax, eax
je 0x4b51ba
mov dword [0x58ef64], eax
mov edx, dword [0x5991ec]
push str.GetThemeBackgroundContentRect
push edx
call esi
test eax, eax
je 0x4b51d1
mov dword [0x58ef68], eax
mov eax, dword [0x5991ec]
push str.SetWindowTheme
push eax
call esi
test eax, eax
je 0x4b51e7
mov dword [0x599240], eax
push str.ws2_32.dll
call fcn.004b2330
test eax, eax
mov dword [0x5991e8], eax
je 0x4b5222
push str.getaddrinfo
push eax
call esi
test eax, eax
je 0x4b520b
mov dword [0x58ef6c], eax
mov ecx, dword [0x5991e8]
push str.freeaddrinfo
push ecx
call esi
test eax, eax
je 0x4b5222
mov dword [0x58ef70], eax
push str.gdi32.dll
call fcn.004b2330
test eax, eax
mov dword [0x599200], eax
je 0x4b525d
push str.SetLayout
push eax
call esi
test eax, eax
je 0x4b5246
mov dword [0x58ef74], eax
mov edx, dword [0x599200]
push str.GetLayout
push edx
call esi
test eax, eax
je 0x4b525d
mov dword [0x58ef84], eax
push str.advapi32.dll
call fcn.004b2330
test eax, eax
mov dword [0x599204], eax
je 0x4b52c5
push str.QueryServiceStatusEx
push eax
call esi
test eax, eax
je 0x4b5281
mov dword [0x58ef78], eax
mov eax, dword [0x599204]
push str.RegDeleteKeyExW
push eax
call esi
test eax, eax
je 0x4b5297
mov dword [0x59923c], eax
mov ecx, dword [0x599204]
push str.RegisterServiceCtrlHandlerExW
push ecx
call esi
test eax, eax
je 0x4b52ae
mov dword [0x58ef80], eax
mov edx, dword [0x599204]
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push edx
call esi
test eax, eax
je 0x4b52c5
mov dword [0x59925c], eax
push str.urlmon.dll
call fcn.004b2330
test eax, eax
mov dword [0x599218], eax
je 0x4b52e9
push str.CopyStgMedium
push eax
call esi
test eax, eax
je 0x4b52e9
mov dword [0x599280], eax
push str.imm32.dll
call fcn.004b2330
test eax, eax
mov dword [0x59921c], eax
je 0x4b530d
push str.ImmGetVirtualKey
push eax
call esi
test eax, eax
je 0x4b530d
mov dword [0x599284], eax
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
xor ecx, esp
call fcn.00549930
add esp, 0xbc
ret