Function at 0x1001878
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x1006140
mov dword [0x1006140], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x10065e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [0x10060c8]
xor ebx, ebx
inc ebx
test edx, edx
mov ebp, 0x1cf3
jne 0x1001933
cmp dword [0x1006154], edx
mov ecx, 0x3fffffff
ja 0x10018cb
mov eax, dword [0x1006150]
jb 0x10018cd
cmp eax, ecx
jb 0x10018cd
mov eax, ecx
cmp dword [0x10061b8], ebx
jne 0x10018f7
cmp dword [0x10061d0], ebx
jne 0x10018f7
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x10018ef
fadd qword [0x1001198]
fmul qword [0x1001190]
jmp 0x100190f
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x1001909
fadd qword [0x1001198]
fmul qword [0x1001188]
call sub.msvcrt.dll__ftol
mov esi, dword [0x10065e4]
or edi, 0xffffffff
cmp eax, edi
jbe 0x100192a
lea eax, [esi + esi]
mov ecx, eax
mov eax, edi
sub eax, ecx
lea eax, [esi + eax - 1]
jmp 0x10019bd
cmp edx, 0xa0
jae 0x1001951
push ebp
call fcn.01001423
mov esi, dword [0x10065e4]
mov eax, 0x28000
jmp 0x10019d4
mov eax, dword [0x1006164]
or edi, 0xffffffff
test eax, eax
ja 0x1001969
mov ecx, dword [0x1006160]
jb 0x100196d
cmp ecx, edi
jb 0x100196d
mov ecx, edi
xor eax, eax
shrd ecx, eax, 0xa
shr eax, 0xa
xor esi, esi
cmp esi, eax
jb 0x10019a8
ja 0x1001980
cmp edx, ecx
jbe 0x10019a8
push 0x1cf4
call fcn.01001423
cmp dword [0x1006164], 0
ja 0x100199e
mov eax, dword [0x1006160]
jb 0x10019a0
cmp eax, edi
jb 0x10019a0
mov eax, edi
mov esi, dword [0x10065e4]
jmp 0x10019c4
cmp edx, edi
mov eax, edx
jb 0x10019b0
mov eax, edi
mov esi, dword [0x10065e4]
shl eax, 0xa
lea eax, [eax + esi - 1]
xor edx, edx
div esi
imul eax, esi
mov ecx, 0x28000
cmp eax, ecx
mov dword [0x1006124], eax
jae 0x10019d9
mov eax, ecx
mov dword [0x1006124], eax
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x10019eb
fadd qword [0x1001198]
fmul qword [0x1001180]
call sub.msvcrt.dll__ftol
cdq
push 4
pop ecx
idiv ecx
xor edx, edx
div esi
imul eax, esi
cmp eax, esi
jg 0x1001a09
mov eax, esi
mov ecx, 0x40000
cmp eax, ecx
jl 0x1001a14
mov eax, ecx
cmp dword [0x10061b8], ebx
mov dword [0x10060c0], eax
mov dword [0x100618c], eax
mov dword [0x10060bc], eax
jne 0x1001a30
mov dword [0x1006128], eax
push 0x10061a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov eax, dword [0x10061a0]
cmp eax, 2
jae 0x1001a49
push 2
pop eax
mov esi, dword [section..data]
mov ecx, dword [0x10065e4]
imul eax, esi
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
mov ebx, eax
imul ebx, ecx
mov eax, 0x1000
cmp esi, eax
mov dword [esp + 0x10], ebx
jg 0x1001a74
mov esi, eax
lea eax, [ecx + esi*4 + 0xf9f]
xor edx, edx
div ecx
mov edi, eax
mov eax, dword [0x10060c0]
imul edi, ecx
mov ecx, dword [0x100618c]
cmp eax, ecx
jg 0x1001a95
mov eax, ecx
mov ecx, dword [0x10060bc]
add eax, ecx
lea esi, [edi + eax*2]
add esi, ebx
cmp esi, dword [0x1006124]
jbe 0x1001ac6
mov eax, dword [0x10060c8]
test eax, eax
je 0x1001ac0
cmp eax, 0xa0
jb 0x1001ac0
push ebp
call fcn.01001423
mov dword [0x1006124], esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [0x1006124]
push 0
call ebx
test eax, eax
mov dword [0x100660c], eax
jne 0x1001af5
push 0x1cf0
call fcn.01001447
mov eax, dword [0x100660c]
mov edx, dword [0x10060c0]
xor ecx, ecx
mov esi, 0x1006118
lea ebp, [eax + ecx]
mov dword [esi], ebp
mov ebp, dword [0x100618c]
cmp edx, ebp
jle 0x1001b13
mov ebp, edx
add esi, 4
add ecx, ebp
cmp esi, 0x1006120
jl 0x1001b02
lea esi, [eax + ecx]
add ecx, dword [esp + 0x10]
mov dword [0x10060cc], esi
mov esi, 0x10060d8
lea ebp, [eax + ecx]
add ecx, dword [0x10060bc]
mov dword [esi], ebp
add esi, 4
cmp esi, 0x10060e0
jl 0x1001b32
mov esi, dword [0x10060d8]
push 4
mov dword [0x10060c4], edx
lea edx, [eax + ecx]
add ecx, edi
push 0x1000
mov dword [0x10060b8], edx
mov dword [0x10065d0], edx
lea edx, [eax + ecx]
push ecx
push eax
mov dword [0x10060f8], esi
mov dword [0x10060e8], edx
mov dword [0x10060e4], edx
mov dword [0x1006110], edx
call ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret