Function at 0x1400e37c0
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rcx, [0x14020f360]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsx eax, byte [rsp + 0x54]
cmp dword [rsp + 0x60], 2
mov dword [0x14020e1cc], eax
movsx eax, byte [rsp + 0x58]
lea rcx, [rsp + 0x20]
mov dword [0x14020e1d0], eax
sete byte [0x14020e1c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [0x14020e1d4], r11d
call qword [sym.imp.USER32.dll_GetDC]
test rax, rax
mov rbx, rax
je 0x1400e3877
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x140203a00], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x140203a04], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.kernel32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e250], rax
je 0x1400e3be2
lea rdx, str.FindFirstVolumeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a58]
lea rdx, str.FindNextVolumeW
test rax, rax
cmovne rcx, rax
mov qword [0x140203a58], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.FindVolumeClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.GetVolumeNameForVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.FindFirstVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a78]
lea rdx, str.FindNextVolumeMountPointW
test rax, rax
cmovne rcx, rax
mov qword [0x140203a78], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.FindVolumeMountPointClose
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.GetDiskFreeSpaceExW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a08]
lea rdx, str.GetLongPathNameW
test rax, rax
cmovne rcx, rax
mov qword [0x140203a08], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [str._s_r_]
lea rdx, str.GetVolumePathNamesForVolumeNameW
test rax, rax
cmovne rcx, rax
mov qword [str._s_r_], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a50]
lea rdx, str.CancelIo
test rax, rax
cmovne rcx, rax
mov qword [0x140203a50], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2b8]
lea rdx, str.GetUserDefaultUILanguage
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2b8], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2f8]
test rax, rax
lea rdx, str.OpenThread
cmovne rcx, rax
mov qword [0x14020e2f8], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e330]
lea rdx, str.OpenFileById
test rax, rax
cmovne rcx, rax
mov qword [0x14020e330], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e338]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020e338], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e340]
lea rdx, str.TzSpecificLocalTimeToSystemTime
test rax, rax
cmovne rcx, rax
mov qword [0x14020e340], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2a8]
lea rdx, str.ReadDirectoryChangesW
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2a8], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e1b0]
lea rdx, str.GetFileInformationByHandleEx
test rax, rax
cmovne rcx, rax
mov qword [0x14020e1b0], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e340]
lea rdx, str.GetNativeSystemInfo
test rax, rax
cmovne rcx, rax
mov qword [0x14020e340], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e1c0]
lea rdx, [0x1401d0e10]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e1c0], rcx
mov rcx, qword [0x14020e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e358]
test rax, rax
cmovne rcx, rax
mov rax, qword [0x14020e1c0]
test rax, rax
mov qword [0x14020e358], rcx
je 0x1400e3be2
lea rcx, [rsp + 0x20]
call rax
mov r11d, dword [rsp + 0x40]
mov dword [0x14020e1d4], r11d
lea rcx, str.user32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e258], rax
je 0x1400e3d6b
lea rdx, str.AllowSetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.MonitorFromWindow
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.EnumDisplayMonitors
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.MonitorFromRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.RegisterDeviceNotificationW
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.UnregisterDeviceNotification
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.NotifyWinEvent
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.140160010]
lea rdx, str.ChangeWindowMessageFilterEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.140160010], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e300]
lea rdx, str.SetLayeredWindowAttributes
test rax, rax
cmovne rcx, rax
mov qword [0x14020e300], rcx
mov rcx, qword [0x14020e258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e350]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e350], rcx
lea rcx, str.shell32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e260], rax
je 0x1400e3f19
lea rdx, str.SHMultiFileProperties
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a48]
mov edx, 0x2bd
test rax, rax
cmovne rcx, rax
mov qword [0x140203a48], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2c8]
lea rdx, str.SHBindToParent
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2c8], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a40]
lea rdx, str.IsUserAnAdmin
test rax, rax
cmovne rcx, rax
mov qword [0x140203a40], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2d8]
mov edx, 0x2d7
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2d8], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e308]
lea rdx, str.SHGetSettings
test rax, rax
cmovne rcx, rax
mov qword [0x14020e308], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e310]
lea rdx, str.SHCreateItemFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020e310], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2b0]
lea rdx, str.SHGetPropertyStoreFromIDList
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2b0], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e318]
lea rdx, str.SHAddToRecentDocs
test rax, rax
cmovne rcx, rax
mov qword [0x14020e318], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e328]
lea rdx, str.SHOpenFolderAndSelectItems
test rax, rax
cmovne rcx, rax
mov qword [0x14020e328], rcx
mov rcx, qword [0x14020e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e348]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e348], rcx
lea rcx, str.shlwapi.dll
call fcn.1400e0030
test rax, rax
mov rbx, rax
mov qword [0x14020e268], rax
je 0x1400e3f75
lea rdx, str.AssocCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e3f52
mov qword [0x14020e2d0], rax
jmp 0x1400e3f75
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2d0]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2d0], rcx
lea rcx, str.uxtheme.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e248], rax
je 0x1400e4150
lea rdx, str.EnableThemeDialogTexture
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203aa0]
lea rdx, str.OpenThemeData
test rax, rax
cmovne rcx, rax
mov qword [0x140203aa0], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.CloseThemeData
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203a98]
lea rdx, str.IsThemePartDefined
test rax, rax
cmovne rcx, rax
mov qword [0x140203a98], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.DrawThemeBackgroundEx
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ab8]
lea rdx, str.DrawThemeEdge
test rax, rax
cmovne rcx, rax
mov qword [0x140203ab8], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ac0]
lea rdx, str.IsThemeBackgroundPartiallyTransparent
test rax, rax
cmovne rcx, rax
mov qword [0x140203ac0], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.IsAppThemed
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.IsThemeActive
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.GetThemeBackgroundContentRect
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ae0]
lea rdx, str.SetWindowTheme
test rax, rax
cmovne rcx, rax
mov qword [0x140203ae0], rcx
mov rcx, qword [0x14020e248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2e8]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2e8], rcx
lea rcx, str.ws2_32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e240], rax
je 0x1400e41b6
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203ae8]
lea rdx, str.freeaddrinfo
test rax, rax
cmovne rcx, rax
mov qword [0x140203ae8], rcx
mov rcx, qword [0x14020e240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203af0]
test rax, rax
cmovne rcx, rax
mov qword [0x140203af0], rcx
lea rcx, str.gdi32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e270], rax
je 0x1400e421c
lea rdx, str.SetLayout
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
lea rdx, str.GetLayout
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
mov rcx, qword [0x14020e270]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1400d9080]
test rax, rax
cmovne rcx, rax
mov qword [fcn.1400d9080], rcx
lea rcx, str.advapi32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e278], rax
je 0x1400e42d8
lea rdx, str.QueryServiceStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b00]
lea rdx, str.RegDeleteKeyExW
test rax, rax
cmovne rcx, rax
mov qword [0x140203b00], rcx
mov rcx, qword [0x14020e278]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e2e0]
lea rdx, str.RegisterServiceCtrlHandlerExW
test rax, rax
cmovne rcx, rax
mov qword [0x14020e2e0], rcx
mov rcx, qword [0x14020e278]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140203b10]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
test rax, rax
cmovne rcx, rax
mov qword [0x140203b10], rcx
mov rcx, qword [0x14020e278]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e320]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e320], rcx
lea rcx, str.urlmon.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e298], rax
je 0x1400e4315
lea rdx, str.CopyStgMedium
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e360]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e360], rcx
lea rcx, str.imm32.dll
call fcn.1400e0030
test rax, rax
mov qword [0x14020e2a0], rax
je 0x1400e4352
lea rdx, str.ImmGetVirtualKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14020e368]
test rax, rax
cmovne rcx, rax
mov qword [0x14020e368], rcx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x100
pop rbx
ret