Function at 0x403c31
Capabilities:
Get memory capacity
Write file on windows

Disassembly:
sub esp, 0x2e8
mov eax, dword [0x4271a0]
xor eax, esp
mov dword [esp + 0x2e4], eax
push ebx
mov ebx, dword [esp + 0x2f0]
lea eax, [esp + 8]
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push eax
movzx eax, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push eax
push 0x7d5
call fcn.00403824
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x178]
push eax
call edi
add esp, 0x1c
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
push 0x105
lea eax, [esp + 0x48]
mov byte [esp + 0x48], 0
push eax
push dword [0x427c38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x44]
push eax
push 0x7d6
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
call fcn.004014ac
push eax
call fcn.00401493
push eax
push 0x7d7
call fcn.00403824
push eax
lea eax, [esp + 0x16c]
push eax
call edi
add esp, 0x10
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
xor eax, eax
mov dword [esp + 0x44], 0x11c
push 0x100
push eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x60]
push eax
call fcn.004037f6
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x15a], ax
mov dword [esp + 0x15c], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x50]
mov dword [esp + 0x54], 5
xor ecx, ecx
mov dword [esp + 0x58], 1
push eax
mov word [esp + 0x168], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x403de4
push 0x7d8
jmp 0x403de9
push 0x7da
call fcn.00403824
push eax
lea eax, [esp + 0x164]
push eax
call edi
pop ecx
pop ecx
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [esp + 0x28]
push 0x7dc
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x2c]
shr eax, 0xa
push eax
push 0x7dd
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x30]
shr eax, 0xa
push eax
push 0x7de
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x3c]
shr eax, 0xa
push eax
push 0x7df
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x40]
shr eax, 0xa
push eax
push 0x7e0
call fcn.00403824
push eax
lea eax, [esp + 0x168]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040c210
pop ecx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408783
add esp, 0x2e8
ret