Function at 0x4791bb
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7f4
mov eax, dword [0x820ac4]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [esp + 0x30]
lea esi, [esp + 0x194]
push dword [esp + 0x30]
call fcn.00478ecc
mov eax, esi
push eax
push str.Error_occurred_at__s._r_n
push ebx
call fcn.00478d64
add esp, 0x14
push 0x410
lea eax, [esp + 0x3ec]
push 0
push eax
call fcn.0054b920
add esp, 0xc
push 0x206
lea eax, [esp + 0x3ec]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, 0x7b5f6c
ja 0x479255
push edi
lea eax, [esp + 0x3ec]
push eax
call esi
push 0x190
lea eax, [esp + 0x25c]
push 0
push eax
call fcn.0054b920
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x25c]
push eax
mov dword [esp + 0x1c], 0xc6
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x479296
push edi
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0x258]
push eax
lea eax, [esp + 0x3ec]
push eax
push str._s__run_by__s._r_n
push ebx
call fcn.00478d64
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0xd4]
lea edi, [esp + 0x20]
call fcn.00478f41
add esp, 0x14
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x12c]
push eax
push str.Operating_system:___s___s_._r_n
push ebx
call fcn.00478d64
add esp, 0x10
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [esp + 0xb4]
push dword [esp + 0xb4]
push str._d_processor_s___type__d._r_n
push ebx
call fcn.00478d64
add esp, 0x10
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [esp + 0x5c]
push str._d___memory_in_use._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x6c]
add eax, 0xfffff
add esp, 0xc
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x70]
add eax, 0xfffff
add esp, 0xc
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory_free._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x74]
add eax, 0xfffff
add esp, 0xc
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x78]
add eax, 0xfffff
add esp, 0xc
shr eax, 0x14
push eax
push str._d_MBytes_paging_file_free._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x7c]
add eax, 0xfffff
add esp, 0xc
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space._r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x80]
add esp, 0xc
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
push ebx
call fcn.00478d64
add esp, 0xc
mov esi, 0x7b62a8
push esi
push ebx
call fcn.00478d64
pop ecx
pop ecx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esp + 0xc], eax
je 0x4794ed
push str.GetProcessTimes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4794e3
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x4794e3
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x38]
xor esi, esi
xor eax, eax
or ecx, esi
mov esi, dword [esp + 0x34]
or eax, edx
xor edx, edx
xor ebx, ebx
or edx, esi
or edi, ebx
sub edx, eax
sbb edi, ecx
xor esi, esi
push esi
push 0x989680
push edi
push edx
call fcn.006cd970
push esi
push 0x15180
push edx
push eax
call fcn.00560f80
push esi
push 0xe10
push ebx
push ecx
mov edi, eax
mov dword [esp + 0x2c], edx
call fcn.00560f80
push esi
push 0x3c
push ebx
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.00560f80
push ecx
push eax
push dword [esp + 0x20]
mov dword [esp + 0x88], ebx
mov ebx, dword [esp + 0x1c]
push edi
push str.Process_execute_time:__d_day__d:_d:_d_r_n
push ebx
mov dword [esp + 0x94], edx
call fcn.00478d64
add esp, 0x18
mov esi, 0x7b62a8
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [0x8b502c]
push str.Program_status:__s_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x8b5030]
push str.Program_mode:__s_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x83b674]
push str.Socket_init_version:__s_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x8b5034]
push str.web_frame:__s_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x8b543c]
push str.msg_id:__u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x8b5844]
push str.cache_size:__u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [0x8b5848]
push str.bt_mem_block_size:__u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push ebx
mov edi, str.debug_info:
call fcn.00478db9
pop ecx
push ebx
mov edi, 0x8b5038
call fcn.00478db9
pop ecx
push ebx
mov edi, 0x7b46d4
call fcn.00478db9
pop ecx
push esi
push ebx
call fcn.00478d64
lea eax, [esp + 0x44]
push eax
call fcn.0045ec3f
add esp, 0xc
push str.pool_block_dump:_r_n
push ebx
call fcn.00478d64
mov edi, dword [esp + 0x48]
push edi
push str.__allocated_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0x14
push dword [esp + 0x3c]
push str.__allocated_list_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [esp + 0x48]
push str.__free_block_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [esp + 0x44]
push str.__free_block_num___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [esp + 0x4c]
push str.__commited_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [esp + 0x50]
push str.__notblock_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push dword [esp + 0x54]
push str.__notblock_number___u_r_n
push ebx
call fcn.00478d64
mov eax, dword [esp + 0x5c]
add esp, 0xc
add eax, edi
push eax
push str.__total_size___u_r_n
push ebx
call fcn.00478d64
add esp, 0xc
push esi
push ebx
call fcn.00478d64
pop ecx
pop ecx
mov ecx, dword [esp + 0x7fc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0054ae61
mov esp, ebp
pop ebp
ret