Function at 0x1400d25f0
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rcx, [0x1401f4960]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsx eax, byte [rsp + 0x54]
cmp dword [rsp + 0x60], 2
mov dword [0x1401f37d4], eax
movsx eax, byte [rsp + 0x58]
lea rcx, [rsp + 0x20]
mov dword [0x1401f37d8], eax
sete byte [0x1401f37d0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [0x1401f37dc], r11d
call qword [sym.imp.USER32.dll_GetDC]
test rax, rax
mov rbx, rax
je 0x1400d26a7
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x1401e90c0], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x1401e90c4], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.kernel32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3858], rax
je 0x1400d2a12
lea rdx, str.FindFirstVolumeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9118]
lea rdx, str.FindNextVolumeW
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9118], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.FindVolumeClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.GetVolumeNameForVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.FindFirstVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str.__f_]
lea rdx, str.FindNextVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [str.__f_], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.FindVolumeMountPointClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.GetDiskFreeSpaceExW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e90c8]
lea rdx, str.GetLongPathNameW
test rax, rax
cmovne rcx, rax
mov qword [0x1401e90c8], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e90d0]
lea rdx, str.GetVolumePathNamesForVolumeNameW
test rax, rax
cmovne rcx, rax
mov qword [0x1401e90d0], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9110]
lea rdx, str.CancelIo
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9110], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38c0]
lea rdx, str.GetUserDefaultUILanguage
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38c0], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3900]
test rax, rax
lea rdx, str.OpenThread
cmovne rcx, rax
mov qword [0x1401f3900], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3938]
lea rdx, str.OpenFileById
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3938], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3940]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3940], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3948]
lea rdx, str.TzSpecificLocalTimeToSystemTime
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3948], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38b0]
lea rdx, str.ReadDirectoryChangesW
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38b0], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f37b8]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x1401f37b8], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3948]
lea rdx, str.GetNativeSystemInfo
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3948], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f37c8]
lea rdx, [0x1401b80b0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f37c8], rcx
mov rcx, qword [0x1401f3858]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3960]
test rax, rax
cmovne rcx, rax
mov rax, qword [0x1401f37c8]
test rax, rax
mov qword [0x1401f3960], rcx
je 0x1400d2a12
lea rcx, [rsp + 0x20]
call rax
mov r11d, dword [rsp + 0x40]
mov dword [0x1401f37dc], r11d
lea rcx, str.user32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3860], rax
je 0x1400d2b9b
lea rdx, str.AllowSetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.MonitorFromWindow
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.EnumDisplayMonitors
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.MonitorFromRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.RegisterDeviceNotificationW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.UnregisterDeviceNotification
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.NotifyWinEvent
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.140194a00]
lea rdx, str.ChangeWindowMessageFilterEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.140194a00], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3908]
lea rdx, str.SetLayeredWindowAttributes
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3908], rcx
mov rcx, qword [0x1401f3860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3958]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3958], rcx
lea rcx, str.shell32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3868], rax
je 0x1400d2d72
lea rdx, str.SHMultiFileProperties
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9108]
mov edx, 0x2bd
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9108], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38d0]
lea rdx, str.SHBindToParent
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38d0], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9100]
lea rdx, str.IsUserAnAdmin
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9100], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38e0]
mov edx, 0x2d7
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38e0], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3910]
lea rdx, str.SHGetSettings
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3910], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3918]
lea rdx, str.SHCreateItemFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3918], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38b8]
lea rdx, str.SHGetPropertyStoreFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38b8], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3920]
lea rdx, str.SHAddToRecentDocs
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3920], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3930]
lea rdx, str.SHOpenFolderAndSelectItems
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3930], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3950]
lea rdx, str.SHQueryUserNotificationState
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3950], rcx
mov rcx, qword [0x1401f3868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3968]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3968], rcx
lea rcx, str.shlwapi.dll
call fcn.1400ced10
test rax, rax
mov rbx, rax
mov qword [0x1401f3870], rax
je 0x1400d2dce
lea rdx, str.AssocCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d2dab
mov qword [0x1401f38d8], rax
jmp 0x1400d2dce
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38d8]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38d8], rcx
lea rcx, str.uxtheme.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3850], rax
je 0x1400d2fa9
lea rdx, str.EnableThemeDialogTexture
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9160]
lea rdx, str.OpenThemeData
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9160], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.CloseThemeData
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9158]
lea rdx, str.IsThemePartDefined
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9158], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.DrawThemeBackgroundEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9178]
lea rdx, str.DrawThemeEdge
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9178], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e9180]
lea rdx, str.IsThemeBackgroundPartiallyTransparent
test rax, rax
cmovne rcx, rax
mov qword [0x1401e9180], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.IsAppThemed
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.IsThemeActive
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.GetThemeBackgroundContentRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e91a0]
lea rdx, str.SetWindowTheme
test rax, rax
cmovne rcx, rax
mov qword [0x1401e91a0], rcx
mov rcx, qword [0x1401f3850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38f0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38f0], rcx
lea rcx, str.ws2_32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3848], rax
je 0x1400d300f
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e91a8]
lea rdx, str.freeaddrinfo
test rax, rax
cmovne rcx, rax
mov qword [0x1401e91a8], rcx
mov rcx, qword [0x1401f3848]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e91b0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401e91b0], rcx
lea rcx, str.gdi32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3878], rax
je 0x1400d3075
lea rdx, str.SetLayout
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400c7c70]
lea rdx, str.GetLayout
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400c7c70], rcx
mov rcx, qword [0x1401f3878]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str.p_f_]
test rax, rax
cmovne rcx, rax
mov qword [str.p_f_], rcx
lea rcx, str.advapi32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f3880], rax
je 0x1400d3131
lea rdx, [0x1401b7d18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e91c0]
lea rdx, str.RegDeleteKeyExW
test rax, rax
cmovne rcx, rax
mov qword [0x1401e91c0], rcx
mov rcx, qword [0x1401f3880]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f38e8]
lea rdx, str.RegisterServiceCtrlHandlerExW
test rax, rax
cmovne rcx, rax
mov qword [0x1401f38e8], rcx
mov rcx, qword [0x1401f3880]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401e91d0]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
test rax, rax
cmovne rcx, rax
mov qword [0x1401e91d0], rcx
mov rcx, qword [0x1401f3880]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3928]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3928], rcx
lea rcx, str.urlmon.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f38a0], rax
je 0x1400d316e
lea rdx, str.CopyStgMedium
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3970]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3970], rcx
lea rcx, str.imm32.dll
call fcn.1400ced10
test rax, rax
mov qword [0x1401f38a8], rax
je 0x1400d31ab
lea rdx, str.ImmGetVirtualKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401f3978]
test rax, rax
cmovne rcx, rax
mov qword [0x1401f3978], rcx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x100
pop rbx
ret