Function at 0x4b4c70
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xbc
mov eax, dword [0x597f98]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
push edi
push 0x599dc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 2
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x34]
sete cl
mov byte [0x599180], cl
lea ecx, [esp + 8]
push ecx
mov dword [0x599184], edx
mov dword [0x599188], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x59918c], edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4b4d0d
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x58eed4], eax
call edi
push esi
push 0
mov dword [0x58eed8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.kernel32.dll
call fcn.004b2380
test eax, eax
mov esi, dword [0x598d20]
mov dword [0x5991d0], eax
je 0x4b4f03
push str.FindFirstVolumeW
push eax
call esi
test eax, eax
je 0x4b4d3b
mov dword [0x58ef04], eax
mov eax, dword [0x5991d0]
push str.FindNextVolumeW
push eax
call esi
test eax, eax
je 0x4b4d51
mov dword [0x58ef08], eax
mov ecx, dword [0x5991d0]
push str.FindVolumeClose
push ecx
call esi
test eax, eax
je 0x4b4d68
mov dword [0x58ef0c], eax
mov edx, dword [0x5991d0]
push str.GetVolumeNameForVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4b4d7f
mov dword [0x58ef10], eax
mov eax, dword [0x5991d0]
push str.FindFirstVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4b4d95
mov dword [0x58ef14], eax
mov ecx, dword [0x5991d0]
push str.FindNextVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4b4dac
mov dword [0x58ef18], eax
mov edx, dword [0x5991d0]
push str.FindVolumeMountPointClose
push edx
call esi
test eax, eax
je 0x4b4dc3
mov dword [0x58ef1c], eax
mov eax, dword [0x5991d0]
push str.GetDiskFreeSpaceExW
push eax
call esi
test eax, eax
je 0x4b4dd9
mov dword [0x58eedc], eax
mov ecx, dword [0x5991d0]
push str.GetLongPathNameW
push ecx
call esi
test eax, eax
je 0x4b4df0
mov dword [0x58eee0], eax
mov edx, dword [0x5991d0]
push str.GetVolumePathNamesForVolumeNameW
push edx
call esi
test eax, eax
je 0x4b4e07
mov dword [0x58ef00], eax
mov eax, dword [0x5991d0]
push str.CancelIo
push eax
call esi
test eax, eax
je 0x4b4e1d
mov dword [0x599208], eax
mov ecx, dword [0x5991d0]
push str.GetUserDefaultUILanguage
push ecx
call esi
test eax, eax
je 0x4b4e34
mov dword [0x599228], eax
mov edx, dword [0x5991d0]
push str.OpenThread
push edx
call esi
test eax, eax
je 0x4b4e4b
mov dword [0x599244], eax
mov eax, dword [0x5991d0]
push str.OpenFileById
push eax
call esi
test eax, eax
je 0x4b4e61
mov dword [0x599248], eax
mov ecx, dword [0x5991d0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4e78
mov dword [0x59924c], eax
mov edx, dword [0x5991d0]
push str.TzSpecificLocalTimeToSystemTime
push edx
call esi
test eax, eax
je 0x4b4e8f
mov dword [0x599200], eax
mov eax, dword [0x5991d0]
push str.ReadDirectoryChangesW
push eax
call esi
test eax, eax
je 0x4b4ea5
mov dword [0x599174], eax
mov ecx, dword [0x5991d0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4ebc
mov dword [0x59924c], eax
mov edx, dword [0x5991d0]
push str.GetNativeSystemInfo
push edx
call esi
test eax, eax
je 0x4b4ed3
mov dword [0x59917c], eax
mov eax, dword [0x5991d0]
push str.IsDebuggerPresent
push eax
call esi
test eax, eax
je 0x4b4ee9
mov dword [0x599258], eax
mov eax, dword [0x59917c]
test eax, eax
je 0x4b4f03
lea ecx, [esp + 8]
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov dword [0x59918c], edx
push str.user32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991d4], eax
je 0x4b4fe0
push str.AllowSetForegroundWindow
push eax
call esi
test eax, eax
je 0x4b4f2b
mov dword [0x58ef20], eax
mov eax, dword [0x5991d4]
push str.MonitorFromWindow
push eax
call esi
test eax, eax
je 0x4b4f41
mov dword [0x58eee4], eax
mov ecx, dword [0x5991d4]
push str.EnumDisplayMonitors
push ecx
call esi
test eax, eax
je 0x4b4f58
mov dword [0x58eee8], eax
mov edx, dword [0x5991d4]
push str.MonitorFromRect
push edx
call esi
test eax, eax
je 0x4b4f6f
mov dword [0x58eeec], eax
mov eax, dword [0x5991d4]
push str.RegisterDeviceNotificationW
push eax
call esi
test eax, eax
je 0x4b4f85
mov dword [0x58eef0], eax
mov ecx, dword [0x5991d4]
push str.UnregisterDeviceNotification
push ecx
call esi
test eax, eax
je 0x4b4f9c
mov dword [0x58eef4], eax
mov edx, dword [0x5991d4]
push str.NotifyWinEvent
push edx
call esi
test eax, eax
je 0x4b4fb3
mov dword [0x58ef5c], eax
mov eax, dword [0x5991d4]
push str.ChangeWindowMessageFilterEx
push eax
call esi
test eax, eax
je 0x4b4fc9
mov dword [0x59922c], eax
mov ecx, dword [0x5991d4]
push str.SetLayeredWindowAttributes
push ecx
call esi
test eax, eax
je 0x4b4fe0
mov dword [0x599254], eax
push str.shell32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991d8], eax
je 0x4b50eb
push str.SHMultiFileProperties
push eax
call esi
test eax, eax
je 0x4b5008
mov dword [0x58eefc], eax
mov edx, dword [0x5991d8]
push 0x2bd
push edx
call esi
test eax, eax
je 0x4b501f
mov dword [0x599210], eax
mov eax, dword [0x5991d8]
push str.SHBindToParent
push eax
call esi
test eax, eax
je 0x4b5035
mov dword [0x58eef8], eax
mov ecx, dword [0x5991d8]
push str.IsUserAnAdmin
push ecx
call esi
test eax, eax
je 0x4b504c
mov dword [0x599218], eax
mov edx, dword [0x5991d8]
push 0x2d7
push edx
call esi
test eax, eax
je 0x4b5063
mov dword [0x599230], eax
mov eax, dword [0x5991d8]
push str.SHGetSettings
push eax
call esi
test eax, eax
je 0x4b5079
mov dword [0x599234], eax
mov ecx, dword [0x5991d8]
push str.SHCreateItemFromIDList
push ecx
call esi
test eax, eax
je 0x4b5090
mov dword [0x599204], eax
mov edx, dword [0x5991d8]
push str.SHGetPropertyStoreFromIDList
push edx
call esi
test eax, eax
je 0x4b50a7
mov dword [0x599238], eax
mov eax, dword [0x5991d8]
push str.SHAddToRecentDocs
push eax
call esi
test eax, eax
je 0x4b50bd
mov dword [0x599240], eax
mov ecx, dword [0x5991d8]
push str.SHOpenFolderAndSelectItems
push ecx
call esi
test eax, eax
je 0x4b50d4
mov dword [0x599250], eax
mov edx, dword [0x5991d8]
push str.SHQueryUserNotificationState
push edx
call esi
test eax, eax
je 0x4b50eb
mov dword [0x59925c], eax
push str.shlwapi.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991dc], eax
je 0x4b511d
push str.AssocCreate
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4b5118
push 0x1f4
push edi
call esi
test eax, eax
je 0x4b511d
mov dword [0x599214], eax
push str.uxtheme.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991cc], eax
je 0x4b5227
push str.EnableThemeDialogTexture
push eax
call esi
test eax, eax
je 0x4b5145
mov dword [0x58ef28], eax
mov eax, dword [0x5991cc]
push str.OpenThemeData
push eax
call esi
test eax, eax
je 0x4b515b
mov dword [0x58ef2c], eax
mov ecx, dword [0x5991cc]
push str.CloseThemeData
push ecx
call esi
test eax, eax
je 0x4b5172
mov dword [0x58ef24], eax
mov edx, dword [0x5991cc]
push str.IsThemePartDefined
push edx
call esi
test eax, eax
je 0x4b5189
mov dword [0x58ef30], eax
mov eax, dword [0x5991cc]
push str.DrawThemeBackgroundEx
push eax
call esi
test eax, eax
je 0x4b519f
mov dword [0x58ef34], eax
mov ecx, dword [0x5991cc]
push str.DrawThemeEdge
push ecx
call esi
test eax, eax
je 0x4b51b6
mov dword [0x58ef38], eax
mov edx, dword [0x5991cc]
push str.IsThemeBackgroundPartiallyTransparent
push edx
call esi
test eax, eax
je 0x4b51cd
mov dword [0x58ef3c], eax
mov eax, dword [0x5991cc]
push str.IsAppThemed
push eax
call esi
test eax, eax
je 0x4b51e3
mov dword [0x58ef40], eax
mov ecx, dword [0x5991cc]
push str.IsThemeActive
push ecx
call esi
test eax, eax
je 0x4b51fa
mov dword [0x58ef44], eax
mov edx, dword [0x5991cc]
push str.GetThemeBackgroundContentRect
push edx
call esi
test eax, eax
je 0x4b5211
mov dword [0x58ef48], eax
mov eax, dword [0x5991cc]
push str.SetWindowTheme
push eax
call esi
test eax, eax
je 0x4b5227
mov dword [0x599220], eax
push str.ws2_32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991c8], eax
je 0x4b5262
push str.getaddrinfo
push eax
call esi
test eax, eax
je 0x4b524b
mov dword [0x58ef4c], eax
mov ecx, dword [0x5991c8]
push str.freeaddrinfo
push ecx
call esi
test eax, eax
je 0x4b5262
mov dword [0x58ef50], eax
push str.gdi32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991e0], eax
je 0x4b529d
push str.SetLayout
push eax
call esi
test eax, eax
je 0x4b5286
mov dword [0x58ef54], eax
mov edx, dword [0x5991e0]
push str.GetLayout
push edx
call esi
test eax, eax
je 0x4b529d
mov dword [0x58ef64], eax
push str.advapi32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991e4], eax
je 0x4b5305
push str.QueryServiceStatusEx
push eax
call esi
test eax, eax
je 0x4b52c1
mov dword [0x58ef58], eax
mov eax, dword [0x5991e4]
push str.RegDeleteKeyExW
push eax
call esi
test eax, eax
je 0x4b52d7
mov dword [0x59921c], eax
mov ecx, dword [0x5991e4]
push str.RegisterServiceCtrlHandlerExW
push ecx
call esi
test eax, eax
je 0x4b52ee
mov dword [0x58ef60], eax
mov edx, dword [0x5991e4]
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push edx
call esi
test eax, eax
je 0x4b5305
mov dword [0x59923c], eax
push str.urlmon.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991f8], eax
je 0x4b5329
push str.CopyStgMedium
push eax
call esi
test eax, eax
je 0x4b5329
mov dword [0x599260], eax
push str.imm32.dll
call fcn.004b2380
test eax, eax
mov dword [0x5991fc], eax
je 0x4b534d
push str.ImmGetVirtualKey
push eax
call esi
test eax, eax
je 0x4b534d
mov dword [0x599264], eax
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
xor ecx, esp
call fcn.005498cd
add esp, 0xbc
ret