Function at 0x4af300
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2cc
push ebx
push esi
push edi
push 0x58b5e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x244]
push eax
mov dword [esp + 0x248], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x254], 2
movsx edx, byte [esp + 0x248]
movsx eax, byte [esp + 0x24c]
sete cl
mov byte [0x58b3b8], cl
lea ecx, [esp + 0x220]
push ecx
mov dword [0x58b3bc], edx
mov dword [0x58b3c0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x234]
push 0
mov dword [0x58b3c4], edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x581dec], eax
call edi
push esi
push 0
mov dword [0x581df0], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [esp + 0xc]
push eax
call fcn.0051ec40
push str.kernel32.dll
lea ecx, [esp + 0x10]
push ecx
call fcn.00522b90
mov edx, dword [esp + 0x14]
mov ebx, dword [0x58af88]
push edx
call ebx
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00522920
test edi, edi
mov esi, dword [0x58af74]
mov dword [0x58b408], edi
je 0x4af57a
push str.FindFirstVolumeW
push edi
call esi
test eax, eax
je 0x4af3f8
mov dword [0x581e1c], eax
mov ecx, dword [0x58b408]
push str.FindNextVolumeW
push ecx
call esi
test eax, eax
je 0x4af40f
mov dword [0x581e20], eax
mov edx, dword [0x58b408]
push str.FindVolumeClose
push edx
call esi
test eax, eax
je 0x4af426
mov dword [0x581e24], eax
mov eax, dword [0x58b408]
push str.GetVolumeNameForVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4af43c
mov dword [0x581e28], eax
mov ecx, dword [0x58b408]
push str.FindFirstVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4af453
mov dword [0x581e2c], eax
mov edx, dword [0x58b408]
push str.FindNextVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4af46a
mov dword [0x581e30], eax
mov eax, dword [0x58b408]
push str.FindVolumeMountPointClose
push eax
call esi
test eax, eax
je 0x4af480
mov dword [0x581e34], eax
mov ecx, dword [0x58b408]
push str.GetDiskFreeSpaceExW
push ecx
call esi
test eax, eax
je 0x4af497
mov dword [0x581df4], eax
mov edx, dword [0x58b408]
push str.GetLongPathNameW
push edx
call esi
test eax, eax
je 0x4af4ae
mov dword [0x581df8], eax
mov eax, dword [0x58b408]
push str.GetVolumePathNamesForVolumeNameW
push eax
call esi
test eax, eax
je 0x4af4c4
mov dword [0x581e18], eax
mov ecx, dword [0x58b408]
push str.CancelIo
push ecx
call esi
test eax, eax
je 0x4af4db
mov dword [0x58b438], eax
mov edx, dword [0x58b408]
push str.GetUserDefaultUILanguage
push edx
call esi
test eax, eax
je 0x4af4f2
mov dword [0x58b458], eax
mov eax, dword [0x58b408]
push str.OpenThread
push eax
call esi
test eax, eax
je 0x4af508
mov dword [0x58b470], eax
mov ecx, dword [0x58b408]
push str.OpenFileById
push ecx
call esi
test eax, eax
je 0x4af51f
mov dword [0x58b474], eax
mov edx, dword [0x58b408]
push str.GetFileInformationByHandleEx
push edx
call esi
test eax, eax
je 0x4af536
mov dword [0x58b478], eax
mov eax, dword [0x58b408]
push str.TzSpecificLocalTimeToSystemTime
push eax
call esi
test eax, eax
je 0x4af54c
mov dword [0x58b430], eax
mov ecx, dword [0x58b408]
push str.ReadDirectoryChangesW
push ecx
call esi
test eax, eax
je 0x4af563
mov dword [0x58b3b0], eax
mov edx, dword [0x58b408]
push str.GetFileInformationByHandleEx
push edx
call esi
test eax, eax
je 0x4af57a
mov dword [0x58b478], eax
lea eax, [esp + 0xc]
push eax
call fcn.0051ec40
push str.user32.dll
lea ecx, [esp + 0x10]
push ecx
call fcn.00522b90
mov edx, dword [esp + 0x14]
push edx
call ebx
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00522920
test edi, edi
mov dword [0x58b40c], edi
je 0x4af67b
push str.AllowSetForegroundWindow
push edi
call esi
test eax, eax
je 0x4af5c5
mov dword [0x581e38], eax
mov ecx, dword [0x58b40c]
push str.MonitorFromWindow
push ecx
call esi
test eax, eax
je 0x4af5dc
mov dword [0x581dfc], eax
mov edx, dword [0x58b40c]
push str.EnumDisplayMonitors
push edx
call esi
test eax, eax
je 0x4af5f3
mov dword [0x581e00], eax
mov eax, dword [0x58b40c]
push str.MonitorFromRect
push eax
call esi
test eax, eax
je 0x4af609
mov dword [0x581e04], eax
mov ecx, dword [0x58b40c]
push str.RegisterDeviceNotificationW
push ecx
call esi
test eax, eax
je 0x4af620
mov dword [0x581e08], eax
mov edx, dword [0x58b40c]
push str.UnregisterDeviceNotification
push edx
call esi
test eax, eax
je 0x4af637
mov dword [0x581e0c], eax
mov eax, dword [0x58b40c]
push str.NotifyWinEvent
push eax
call esi
test eax, eax
je 0x4af64d
mov dword [0x581e74], eax
mov ecx, dword [0x58b40c]
push str.ChangeWindowMessageFilterEx
push ecx
call esi
test eax, eax
je 0x4af664
mov dword [0x58b45c], eax
mov edx, dword [0x58b40c]
push str.SetLayeredWindowAttributes
push edx
call esi
test eax, eax
je 0x4af67b
mov dword [0x58b480], eax
lea eax, [esp + 0xc]
push eax
call fcn.0051ec40
push str.shell32.dll
lea ecx, [esp + 0x10]
push ecx
call fcn.00522b90
mov edx, dword [esp + 0x14]
push edx
call ebx
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00522920
test edi, edi
mov dword [0x58b410], edi
je 0x4af792
push str.SHMultiFileProperties
push edi
call esi
test eax, eax
je 0x4af6c6
mov dword [0x581e14], eax
mov ecx, dword [0x58b410]
push 0x2bd
push ecx
call esi
test eax, eax
je 0x4af6dd
mov dword [0x58b440], eax
mov edx, dword [0x58b410]
push str.SHBindToParent
push edx
call esi
test eax, eax
je 0x4af6f4
mov dword [0x581e10], eax
mov eax, dword [0x58b410]
push str.IsUserAnAdmin
push eax
call esi
test eax, eax
je 0x4af70a
mov dword [0x58b448], eax
mov ecx, dword [0x58b410]
push 0x2d7
push ecx
call esi
test eax, eax
je 0x4af721
mov dword [0x58b460], eax
mov edx, dword [0x58b410]
push str.SHGetSettings
push edx
call esi
test eax, eax
je 0x4af738
mov dword [0x58b464], eax
mov eax, dword [0x58b410]
push str.SHCreateItemFromIDList
push eax
call esi
test eax, eax
je 0x4af74e
mov dword [0x58b434], eax
mov ecx, dword [0x58b410]
push str.SHGetPropertyStoreFromIDList
push ecx
call esi
test eax, eax
je 0x4af765
mov dword [0x58b468], eax
mov edx, dword [0x58b410]
push str.SHAddToRecentDocs
push edx
call esi
test eax, eax
je 0x4af77c
mov dword [0x58b46c], eax
mov eax, dword [0x58b410]
push str.SHOpenFolderAndSelectItems
push eax
call esi
test eax, eax
je 0x4af792
mov dword [0x58b47c], eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0051ec40
push str.shlwapi.dll
lea edx, [esp + 0x10]
push edx
call fcn.00522b90
mov eax, dword [esp + 0x14]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
mov edi, eax
call fcn.00522920
test edi, edi
mov dword [0x58b414], edi
je 0x4af7e5
push str.AssocCreate
push edi
call esi
test eax, eax
jne 0x4af7e0
push 0x1f4
push edi
call esi
test eax, eax
je 0x4af7e5
mov dword [0x58b444], eax
lea edx, [esp + 0xc]
push edx
call fcn.0051ec40
push str.uxtheme.dll
lea eax, [esp + 0x10]
push eax
call fcn.00522b90
mov ecx, dword [esp + 0x14]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
mov edi, eax
call fcn.00522920
test edi, edi
mov dword [0x58b404], edi
je 0x4af912
push str.EnableThemeDialogTexture
push edi
call esi
test eax, eax
je 0x4af830
mov dword [0x581e40], eax
mov eax, dword [0x58b404]
push str.OpenThemeData
push eax
call esi
test eax, eax
je 0x4af846
mov dword [0x581e44], eax
mov ecx, dword [0x58b404]
push str.CloseThemeData
push ecx
call esi
test eax, eax
je 0x4af85d
mov dword [0x581e3c], eax
mov edx, dword [0x58b404]
push str.IsThemePartDefined
push edx
call esi
test eax, eax
je 0x4af874
mov dword [0x581e48], eax
mov eax, dword [0x58b404]
push str.DrawThemeBackgroundEx
push eax
call esi
test eax, eax
je 0x4af88a
mov dword [0x581e4c], eax
mov ecx, dword [0x58b404]
push str.DrawThemeEdge
push ecx
call esi
test eax, eax
je 0x4af8a1
mov dword [0x581e50], eax
mov edx, dword [0x58b404]
push str.IsThemeBackgroundPartiallyTransparent
push edx
call esi
test eax, eax
je 0x4af8b8
mov dword [0x581e54], eax
mov eax, dword [0x58b404]
push str.IsAppThemed
push eax
call esi
test eax, eax
je 0x4af8ce
mov dword [0x581e58], eax
mov ecx, dword [0x58b404]
push str.IsThemeActive
push ecx
call esi
test eax, eax
je 0x4af8e5
mov dword [0x581e5c], eax
mov edx, dword [0x58b404]
push str.GetThemeBackgroundContentRect
push edx
call esi
test eax, eax
je 0x4af8fc
mov dword [0x581e60], eax
mov eax, dword [0x58b404]
push str.SetWindowTheme
push eax
call esi
test eax, eax
je 0x4af912
mov dword [0x58b450], eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0051ec40
push str.ws2_32.dll
lea edx, [esp + 0x10]
push edx
call fcn.00522b90
mov eax, dword [esp + 0x14]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
mov edi, eax
call fcn.00522920
test edi, edi
mov dword [0x58b400], edi
je 0x4af970
push str.getaddrinfo
push edi
call esi
test eax, eax
je 0x4af959
mov dword [0x581e64], eax
mov edx, dword [0x58b400]
push str.freeaddrinfo
push edx
call esi
test eax, eax
je 0x4af970
mov dword [0x581e68], eax
lea eax, [esp + 0xc]
push eax
call fcn.0051ec40
push str.gdi32.dll
lea ecx, [esp + 0x10]
push ecx
call fcn.00522b90
mov edx, dword [esp + 0x14]
push edx
call ebx
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00522920
test edi, edi
mov dword [0x58b418], edi
je 0x4af9ce
push str.SetLayout
push edi
call esi
test eax, eax
je 0x4af9b7
mov dword [0x581e6c], eax
mov ecx, dword [0x58b418]
push str.GetLayout
push ecx
call esi
test eax, eax
je 0x4af9ce
mov dword [0x581e80], eax
lea edx, [esp + 0xc]
push edx
call fcn.0051ec40
push str.advapi32.dll
lea eax, [esp + 0x10]
push eax
call fcn.00522b90
mov ecx, dword [esp + 0x14]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
mov edi, eax
call fcn.00522920
test edi, edi
mov dword [0x58b41c], edi
je 0x4afa59
push str.QueryServiceStatusEx
push edi
call esi
test eax, eax
je 0x4afa15
mov dword [0x581e70], eax
mov eax, dword [0x58b41c]
push str.RegDeleteKeyExW
push eax
call esi
test eax, eax
je 0x4afa2b
mov dword [0x58b44c], eax
mov ecx, dword [0x58b41c]
push str.RegisterServiceCtrlHandlerExW
push ecx
call esi
test eax, eax
je 0x4afa42
mov dword [0x581e78], eax
mov edx, dword [0x58b41c]
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push edx
call esi
test eax, eax
je 0x4afa59
mov dword [0x581e7c], eax
pop edi
pop esi
pop ebx
add esp, 0x2cc
ret