Function at 0x4b49f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xbc
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
push edi
push 0x598de0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 2
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x34]
sete cl
mov byte [0x5981a0], cl
lea ecx, [esp + 8]
push ecx
mov dword [0x5981a4], edx
mov dword [0x5981a8], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x5981ac], edx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4b4a8d
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
push 0x5a
push esi
mov dword [0x58def4], eax
call edi
push esi
push 0
mov dword [0x58def8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.kernel32.dll
call fcn.004b20f0
test eax, eax
mov esi, dword [0x597d40]
mov dword [0x5981f0], eax
je 0x4b4c83
push str.FindFirstVolumeW
push eax
call esi
test eax, eax
je 0x4b4abb
mov dword [0x58df24], eax
mov eax, dword [0x5981f0]
push str.FindNextVolumeW
push eax
call esi
test eax, eax
je 0x4b4ad1
mov dword [0x58df28], eax
mov ecx, dword [0x5981f0]
push str.FindVolumeClose
push ecx
call esi
test eax, eax
je 0x4b4ae8
mov dword [0x58df2c], eax
mov edx, dword [0x5981f0]
push str.GetVolumeNameForVolumeMountPointW
push edx
call esi
test eax, eax
je 0x4b4aff
mov dword [0x58df30], eax
mov eax, dword [0x5981f0]
push str.FindFirstVolumeMountPointW
push eax
call esi
test eax, eax
je 0x4b4b15
mov dword [0x58df34], eax
mov ecx, dword [0x5981f0]
push str.FindNextVolumeMountPointW
push ecx
call esi
test eax, eax
je 0x4b4b2c
mov dword [0x58df38], eax
mov edx, dword [0x5981f0]
push str.FindVolumeMountPointClose
push edx
call esi
test eax, eax
je 0x4b4b43
mov dword [0x58df3c], eax
mov eax, dword [0x5981f0]
push str.GetDiskFreeSpaceExW
push eax
call esi
test eax, eax
je 0x4b4b59
mov dword [0x58defc], eax
mov ecx, dword [0x5981f0]
push str.GetLongPathNameW
push ecx
call esi
test eax, eax
je 0x4b4b70
mov dword [0x58df00], eax
mov edx, dword [0x5981f0]
push str.GetVolumePathNamesForVolumeNameW
push edx
call esi
test eax, eax
je 0x4b4b87
mov dword [0x58df20], eax
mov eax, dword [0x5981f0]
push str.CancelIo
push eax
call esi
test eax, eax
je 0x4b4b9d
mov dword [0x598228], eax
mov ecx, dword [0x5981f0]
push str.GetUserDefaultUILanguage
push ecx
call esi
test eax, eax
je 0x4b4bb4
mov dword [0x598248], eax
mov edx, dword [0x5981f0]
push str.OpenThread
push edx
call esi
test eax, eax
je 0x4b4bcb
mov dword [0x598264], eax
mov eax, dword [0x5981f0]
push str.OpenFileById
push eax
call esi
test eax, eax
je 0x4b4be1
mov dword [0x598268], eax
mov ecx, dword [0x5981f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4bf8
mov dword [0x59826c], eax
mov edx, dword [0x5981f0]
push str.TzSpecificLocalTimeToSystemTime
push edx
call esi
test eax, eax
je 0x4b4c0f
mov dword [0x598220], eax
mov eax, dword [0x5981f0]
push str.ReadDirectoryChangesW
push eax
call esi
test eax, eax
je 0x4b4c25
mov dword [0x598194], eax
mov ecx, dword [0x5981f0]
push str.GetFileInformationByHandleEx
push ecx
call esi
test eax, eax
je 0x4b4c3c
mov dword [0x59826c], eax
mov edx, dword [0x5981f0]
push str.GetNativeSystemInfo
push edx
call esi
test eax, eax
je 0x4b4c53
mov dword [0x59819c], eax
mov eax, dword [0x5981f0]
push str.IsDebuggerPresent
push eax
call esi
test eax, eax
je 0x4b4c69
mov dword [0x598278], eax
mov eax, dword [0x59819c]
test eax, eax
je 0x4b4c83
lea ecx, [esp + 8]
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov dword [0x5981ac], edx
push str.user32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x5981f4], eax
je 0x4b4d60
push str.AllowSetForegroundWindow
push eax
call esi
test eax, eax
je 0x4b4cab
mov dword [0x58df40], eax
mov eax, dword [0x5981f4]
push str.MonitorFromWindow
push eax
call esi
test eax, eax
je 0x4b4cc1
mov dword [0x58df04], eax
mov ecx, dword [0x5981f4]
push str.EnumDisplayMonitors
push ecx
call esi
test eax, eax
je 0x4b4cd8
mov dword [0x58df08], eax
mov edx, dword [0x5981f4]
push str.MonitorFromRect
push edx
call esi
test eax, eax
je 0x4b4cef
mov dword [0x58df0c], eax
mov eax, dword [0x5981f4]
push str.RegisterDeviceNotificationW
push eax
call esi
test eax, eax
je 0x4b4d05
mov dword [0x58df10], eax
mov ecx, dword [0x5981f4]
push str.UnregisterDeviceNotification
push ecx
call esi
test eax, eax
je 0x4b4d1c
mov dword [0x58df14], eax
mov edx, dword [0x5981f4]
push str.NotifyWinEvent
push edx
call esi
test eax, eax
je 0x4b4d33
mov dword [0x58df7c], eax
mov eax, dword [0x5981f4]
push str.ChangeWindowMessageFilterEx
push eax
call esi
test eax, eax
je 0x4b4d49
mov dword [0x59824c], eax
mov ecx, dword [0x5981f4]
push str.SetLayeredWindowAttributes
push ecx
call esi
test eax, eax
je 0x4b4d60
mov dword [0x598274], eax
push str.shell32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x5981f8], eax
je 0x4b4e6b
push str.SHMultiFileProperties
push eax
call esi
test eax, eax
je 0x4b4d88
mov dword [0x58df1c], eax
mov edx, dword [0x5981f8]
push 0x2bd
push edx
call esi
test eax, eax
je 0x4b4d9f
mov dword [0x598230], eax
mov eax, dword [0x5981f8]
push str.SHBindToParent
push eax
call esi
test eax, eax
je 0x4b4db5
mov dword [0x58df18], eax
mov ecx, dword [0x5981f8]
push str.IsUserAnAdmin
push ecx
call esi
test eax, eax
je 0x4b4dcc
mov dword [0x598238], eax
mov edx, dword [0x5981f8]
push 0x2d7
push edx
call esi
test eax, eax
je 0x4b4de3
mov dword [0x598250], eax
mov eax, dword [0x5981f8]
push str.SHGetSettings
push eax
call esi
test eax, eax
je 0x4b4df9
mov dword [0x598254], eax
mov ecx, dword [0x5981f8]
push str.SHCreateItemFromIDList
push ecx
call esi
test eax, eax
je 0x4b4e10
mov dword [0x598224], eax
mov edx, dword [0x5981f8]
push str.SHGetPropertyStoreFromIDList
push edx
call esi
test eax, eax
je 0x4b4e27
mov dword [0x598258], eax
mov eax, dword [0x5981f8]
push str.SHAddToRecentDocs
push eax
call esi
test eax, eax
je 0x4b4e3d
mov dword [0x598260], eax
mov ecx, dword [0x5981f8]
push str.SHOpenFolderAndSelectItems
push ecx
call esi
test eax, eax
je 0x4b4e54
mov dword [0x598270], eax
mov edx, dword [0x5981f8]
push str.SHQueryUserNotificationState
push edx
call esi
test eax, eax
je 0x4b4e6b
mov dword [0x59827c], eax
push str.shlwapi.dll
call fcn.004b20f0
test eax, eax
mov dword [0x5981fc], eax
je 0x4b4e9d
push str.AssocCreate
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4b4e98
push 0x1f4
push edi
call esi
test eax, eax
je 0x4b4e9d
mov dword [0x598234], eax
push str.uxtheme.dll
call fcn.004b20f0
test eax, eax
mov dword [0x5981ec], eax
je 0x4b4fa7
push str.EnableThemeDialogTexture
push eax
call esi
test eax, eax
je 0x4b4ec5
mov dword [0x58df48], eax
mov eax, dword [0x5981ec]
push str.OpenThemeData
push eax
call esi
test eax, eax
je 0x4b4edb
mov dword [0x58df4c], eax
mov ecx, dword [0x5981ec]
push str.CloseThemeData
push ecx
call esi
test eax, eax
je 0x4b4ef2
mov dword [0x58df44], eax
mov edx, dword [0x5981ec]
push str.IsThemePartDefined
push edx
call esi
test eax, eax
je 0x4b4f09
mov dword [0x58df50], eax
mov eax, dword [0x5981ec]
push str.DrawThemeBackgroundEx
push eax
call esi
test eax, eax
je 0x4b4f1f
mov dword [0x58df54], eax
mov ecx, dword [0x5981ec]
push str.DrawThemeEdge
push ecx
call esi
test eax, eax
je 0x4b4f36
mov dword [0x58df58], eax
mov edx, dword [0x5981ec]
push str.IsThemeBackgroundPartiallyTransparent
push edx
call esi
test eax, eax
je 0x4b4f4d
mov dword [0x58df5c], eax
mov eax, dword [0x5981ec]
push str.IsAppThemed
push eax
call esi
test eax, eax
je 0x4b4f63
mov dword [0x58df60], eax
mov ecx, dword [0x5981ec]
push str.IsThemeActive
push ecx
call esi
test eax, eax
je 0x4b4f7a
mov dword [0x58df64], eax
mov edx, dword [0x5981ec]
push str.GetThemeBackgroundContentRect
push edx
call esi
test eax, eax
je 0x4b4f91
mov dword [0x58df68], eax
mov eax, dword [0x5981ec]
push str.SetWindowTheme
push eax
call esi
test eax, eax
je 0x4b4fa7
mov dword [0x598240], eax
push str.ws2_32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x5981e8], eax
je 0x4b4fe2
push str.getaddrinfo
push eax
call esi
test eax, eax
je 0x4b4fcb
mov dword [0x58df6c], eax
mov ecx, dword [0x5981e8]
push str.freeaddrinfo
push ecx
call esi
test eax, eax
je 0x4b4fe2
mov dword [0x58df70], eax
push str.gdi32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x598200], eax
je 0x4b501d
push str.SetLayout
push eax
call esi
test eax, eax
je 0x4b5006
mov dword [0x58df74], eax
mov edx, dword [0x598200]
push str.GetLayout
push edx
call esi
test eax, eax
je 0x4b501d
mov dword [0x58df84], eax
push str.advapi32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x598204], eax
je 0x4b5085
push 0x56e668
push eax
call esi
test eax, eax
je 0x4b5041
mov dword [0x58df78], eax
mov eax, dword [0x598204]
push str.RegDeleteKeyExW
push eax
call esi
test eax, eax
je 0x4b5057
mov dword [0x59823c], eax
mov ecx, dword [0x598204]
push str.RegisterServiceCtrlHandlerExW
push ecx
call esi
test eax, eax
je 0x4b506e
mov dword [0x58df80], eax
mov edx, dword [0x598204]
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push edx
call esi
test eax, eax
je 0x4b5085
mov dword [0x59825c], eax
push str.urlmon.dll
call fcn.004b20f0
test eax, eax
mov dword [0x598218], eax
je 0x4b50a9
push str.CopyStgMedium
push eax
call esi
test eax, eax
je 0x4b50a9
mov dword [0x598280], eax
push str.imm32.dll
call fcn.004b20f0
test eax, eax
mov dword [0x59821c], eax
je 0x4b50cd
push str.ImmGetVirtualKey
push eax
call esi
test eax, eax
je 0x4b50cd
mov dword [0x598284], eax
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
xor ecx, esp
call fcn.00549750
add esp, 0xbc
ret