Function at 0x41563a
Capabilities:
Check os version
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
pushal
cld
mov byte [0x41d912], 0
lea ebx, [ebp - 0x488]
mov dword [ebp - 0x488], 0x9c
push ebx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea edi, [ebp - 0x384]
mov esi, 0x1c2
push dword [ebp - 0x47c]
push dword [ebp - 0x480]
push dword [ebp - 0x484]
push 0x415ad7
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x18
test eax, eax
js 0x415698
sub esi, eax
add edi, eax
mov eax, dword [ebp - 0x3f4]
test eax, eax
je 0x4156ce
movzx eax, word [ebp - 0x3f4]
movzx ecx, word [ebp - 0x3f2]
test esi, esi
jle 0x4156ce
push ecx
push eax
push 0x415aeb
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x14
test eax, eax
js 0x4156ce
sub esi, eax
add edi, eax
movzx eax, word [ebp - 0x3f0]
test esi, esi
jle 0x4156f2
push eax
push 0x415af4
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
test eax, eax
js 0x4156f2
sub esi, eax
add edi, eax
movzx eax, word [ebp - 0x3ee]
test esi, esi
jle 0x415716
push eax
push 0x415b04
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
test eax, eax
js 0x415716
sub esi, eax
add edi, eax
push 0x59
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x41573e
test esi, esi
jle 0x41573e
push 0x415b5f
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x41573e
sub esi, eax
add edi, eax
push 0x57
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x415766
test esi, esi
jle 0x415766
push 0x415b6c
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x415766
sub esi, eax
add edi, eax
push 0x58
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x41578e
test esi, esi
jle 0x41578e
push 0x415b7c
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x41578e
sub esi, eax
add edi, eax
push 0x56
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x4157b6
test esi, esi
jle 0x4157b6
push 0x415b88
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x4157b6
sub esi, eax
add edi, eax
push 0x43
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x4157de
test esi, esi
jle 0x4157de
push 0x415b95
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x4157de
sub esi, eax
add edi, eax
push 0x2003
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x415809
test esi, esi
jle 0x415809
push 0x415ba3
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x415809
sub esi, eax
add edi, eax
push 0x2004
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x415834
test esi, esi
jle 0x415834
push 0x415bbc
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x415834
sub esi, eax
add edi, eax
push 0x3f
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x41585c
test esi, esi
jle 0x41585c
push 0x415bcd
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x41585c
sub esi, eax
add edi, eax
push 0x49
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x415884
test esi, esi
jle 0x415884
push 0x415bd9
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x415884
sub esi, eax
add edi, eax
push 0x2001
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x4158af
test esi, esi
jle 0x4158af
push 0x415be9
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x4158af
sub esi, eax
add edi, eax
push 0x1000
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
test eax, eax
je 0x4158da
test esi, esi
jle 0x4158da
push 0x415bfb
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x4158da
sub esi, eax
add edi, eax
push 0x415aa0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x415943
push 0x415aad
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x415943
push esi
push edi
movzx ecx, word [ebp - 0x3f4]
movzx edx, word [ebp - 0x3f2]
mov esi, dword [ebp - 0x484]
mov edi, dword [ebp - 0x480]
lea ebx, [ebp - 0x3ec]
push ebx
push edx
push ecx
push edi
push esi
call eax
pop edi
pop esi
mov eax, dword [ebx]
test esi, esi
jle 0x415943
push eax
push 0x415b16
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
test eax, eax
js 0x415943
sub esi, eax
add edi, eax
test esi, esi
jle 0x4159bf
lea ebx, [ebp - 0x3a8]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
mov cx, word [ebp - 0x3a8]
mov eax, 0x20363878
cmp cx, 0
je 0x415997
mov eax, 0x20343678
cmp cx, 9
je 0x415997
mov eax, 0x20465049
cmp cx, 6
je 0x415997
mov eax, 0x204d5241
cmp cx, 5
je 0x415997
mov eax, 0x20343641
cmp cx, 0xc
je 0x415997
mov eax, 0x206b6e55
stosd dword es:[edi], eax
sub esi, 4
movzx eax, word [ebp - 0x394]
test esi, esi
jle 0x4159bf
push eax
push 0x415b2b
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
test eax, eax
js 0x4159bf
sub esi, eax
add edi, eax
push 0x415abc
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x415a07
push 0x415ac6
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x415a07
call eax
test eax, eax
je 0x415a07
test esi, esi
jle 0x415a07
push 0x415b59
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0xc
test eax, eax
js 0x415a07
sub esi, eax
add edi, eax
mov byte [0x41d912], 1
lea ebx, [ebp - 0x3e8]
mov dword [ebp - 0x3e8], 0x40
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x3dc]
lea ecx, [0x415b38]
shrd eax, edx, 0x14
shr edx, 0x14
je 0x415a55
lea ecx, [0x415b43]
shrd eax, edx, 0xa
shr edx, 0xa
je 0x415a55
lea ecx, [0x415b4e]
shrd eax, edx, 0xa
shr edx, 0xa
test esi, esi
jle 0x415a6e
push eax
push ecx
push esi
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
test eax, eax
js 0x415a6e
sub esi, eax
add edi, eax
dec edi
mov ax, 0x2e
stosw word es:[edi], ax
lea edi, [ebp - 0x384]
push 0
push edi
call fcn.00414acf
cmp byte [0x4262c8], 1
je 0x415a98
push 0
push 0x415c0d
call fcn.00414acf
call fcn.00415c2a
popal
leave
ret