Function at 0x40e520
Capabilities:
Get memory capacity
Rebuild import table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x198
mov eax, dword [0x452074]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_calloc]
push 0x1b
push 1
call edi
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
je 0x40eb88
push 4
push 1
call edi
push 4
push 1
mov dword [esi + 0xc], eax
call edi
push str.System
mov dword [esi + 4], eax
lea eax, [esi + 0x14]
push 7
push eax
mov dword [esi], eax
call fcn.0041f560
mov eax, dword [0x1a278f8]
add esp, 0x1c
mov dword [esi + 0x10], 0
cmp dword [eax + 4], 0
je 0x40e61b
mov eax, dword [eax + 0x50]
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [eax + 0xc]
cmp dword [eax], edi
je 0x40e5af
lea eax, [eax + 4]
inc edi
cmp dword [eax], 0
jne 0x40e5a6
lea eax, [edi + 1]
mov dword [esp + 0xc], eax
inc eax
push 4
push eax
call dword [sym.imp.msvcrt.dll_calloc]
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40e5d5
push str.Failed_to_allocate_memory_for_appending_node_n
jmp 0x40eb8d
xor ecx, ecx
test edi, edi
jle 0x40e5f9
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [edx + 0xc]
mov eax, dword [eax + ecx*4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jl 0x40e5e3
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
mov dword [eax + ecx*4 - 4], esi
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [esp + 0x18]
add esp, 4
mov dword [edi + 0xc], eax
mov dword [esi + 8], edi
push 0x118
lea eax, [esp + 0x80]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40e7ad
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e7ad
lea ecx, [esp + 0x78]
mov dword [esp + 0x78], 0x11c
push ecx
call eax
mov edx, dword [esp + 0x7c]
mov edi, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
cmp edx, 0xa
jne 0x40e6cb
test ecx, ecx
jne 0x40e78f
cmp byte [esp + 0x192], 1
je 0x40e6ae
cmp edi, 0x4563
mov dword [esp + 0xc], str.Server_2016
mov eax, str.Server_2019
cmovb eax, dword [esp + 0xc]
jmp 0x40e794
cmp edi, 0x55f0
mov dword [esp + 0xc], 0x44dcf8
mov eax, 0x44dcf4
cmovb eax, dword [esp + 0xc]
jmp 0x40e794
cmp edx, 6
jne 0x40e75c
cmp ecx, 3
jne 0x40e6f8
cmp byte [esp + 0x192], 1
mov eax, str.Server_2012_R2
mov dword [esp + 0xc], 0x44dd0c
cmove eax, dword [esp + 0xc]
jmp 0x40e794
cmp ecx, 2
jne 0x40e71c
cmp byte [esp + 0x192], 1
mov eax, str.Server_2012
mov dword [esp + 0xc], 0x44dd1c
cmove eax, dword [esp + 0xc]
jmp 0x40e794
cmp ecx, 1
jne 0x40e73c
cmp byte [esp + 0x192], cl
mov eax, str.Server_2008_R2
mov dword [esp + 0xc], 0x44dd30
cmove eax, dword [esp + 0xc]
jmp 0x40e794
test ecx, ecx
jne 0x40e78f
cmp byte [esp + 0x192], 1
mov eax, str.Server_2008
mov dword [esp + 0xc], str.Vista
cmove eax, dword [esp + 0xc]
jmp 0x40e794
cmp edx, 5
jne 0x40e78f
cmp ecx, 2
jne 0x40e785
test dword [esp + 0x190], 0x8000
mov eax, str.Home_Server
mov dword [esp + 0xc], str.Server_2003
cmove eax, dword [esp + 0xc]
jmp 0x40e794
mov eax, 0x44dd60
cmp ecx, 1
je 0x40e794
mov eax, str.Unknown
push edi
push ecx
push edx
push eax
push str.Windows__s___lu._lu._lu_
push 0
push 0x44dd98
push esi
call fcn.00407f50
add esp, 0x20
mov ecx, esi
call fcn.0040df80
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x100
push 0x43
call esi
mov edi, 0x446ae4
test eax, eax
mov edx, 0x446ae8
mov ecx, edi
cmove ecx, edx
mov edx, str.Safe_Mode
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00407d00
add esp, 8
push 0x100
push 0x2a
call esi
test eax, eax
mov ecx, edi
mov eax, 0x446ae8
mov edx, str.DBCS_Enabled
cmove ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00407d00
add esp, 8
push 0x100
push 0x16
call esi
test eax, eax
mov ecx, edi
mov eax, 0x446ae8
mov edx, str.Debug_Version
cmove ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00407d00
add esp, 8
push 0x100
push 0x49
call esi
test eax, eax
mov ecx, edi
mov eax, 0x446ae8
mov edx, str.Slow_Processor
cmove ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00407d00
add esp, 8
push 0x100
push 0x3f
call esi
test al, 1
mov edx, str.Network_Presence
mov eax, 0x446ae8
cmove edi, eax
push edi
mov edi, dword [esp + 0x18]
mov ecx, edi
call fcn.00407d00
add esp, 8
mov ecx, edi
call fcn.0040e310
push str.kernel32
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e8c1
push str.GetFirmwareEnvironmentVariableA
push eax
call esi
test eax, eax
je 0x40e8c1
push 0
push 0
push str.00000000_0000_0000_0000_000000000000
push 0x445387
call eax
jmp 0x40e8c9
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Firmware
mov ecx, edi
push 0
cmp eax, 1
jne 0x40e8e7
push str.Legacy_BIOS
jmp 0x40e966
push str.UEFI
call fcn.00407d00
add esp, 8
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40e950
push str.GetFirmwareEnvironmentVariableA
push eax
call esi
test eax, eax
je 0x40e950
push 1
lea ecx, [esp + 0x23]
push ecx
push str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
push str.SecureBoot
call eax
test eax, eax
je 0x40e958
cmp byte [esp + 0x1f], 0
mov ecx, str.DISABLED
mov eax, str.ENABLED
cmove eax, ecx
push eax
push 0x448a34
push 0
push str.Secure_Boot
push edi
call fcn.00407f50
add esp, 0x14
jmp 0x40e96e
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push str.UNSUPPORTED
mov edx, str.Secure_Boot
mov ecx, edi
call fcn.00407d00
add esp, 8
push str.tbs.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
mov ecx, 0x324d5054
movaps xmmword [esp + 0x20], xmm0
call fcn.0040ab50
mov esi, eax
test esi, esi
je 0x40e99c
mov eax, str.v2.0
jmp 0x40e9b1
mov ecx, 0x41504354
call fcn.0040ab50
mov esi, eax
test esi, esi
je 0x40e9cf
mov eax, str.v1.2
push 0
mov ecx, edi
mov edx, 0x44df40
push eax
call fcn.00407d00
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 0xc
jmp 0x40ea4a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ea34
push str.Tbsi_GetDeviceInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ea34
lea ecx, [esp + 0x20]
push ecx
push 0x10
call eax
test eax, eax
jne 0x40ea17
mov eax, dword [esp + 0x24]
sub eax, 1
je 0x40ea10
sub eax, 1
je 0x40ea09
mov eax, str.UNKNOWN
jmp 0x40ea1c
mov eax, str.v2.0
jmp 0x40ea1c
mov eax, str.v1.2
jmp 0x40ea1c
mov eax, str.NOT_FOUND
push eax
push 0x448a34
push 0
push 0x44df40
push edi
call fcn.00407f50
add esp, 0x14
jmp 0x40ea4a
push 0
push str.UNSUPPORTED
mov edx, 0x44df40
mov ecx, edi
call fcn.00407d00
add esp, 8
push 0x40
lea eax, [esp + 0x3c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x38], 0x40
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [esp + 0x3c]
push 0x44df78
push 0
push str.Memory_Usage
push edi
call fcn.00407f50
add esp, 0x14
mov edx, str.Physical_Memory
mov ecx, edi
push 8
call fcn.00407bf0
add esp, 4
mov esi, eax
push 0x800
push ecx
push 0
push 0x400
push dword [esp + 0x5c]
mov ecx, 0x456fe0
push dword [esp + 0x5c]
call fcn.0040a530
add esp, 0x14
mov edx, str.Free
mov ecx, esi
push eax
call fcn.00407d00
add esp, 8
push 0x800
push ecx
push 0
push 0x400
push dword [esp + 0x54]
mov ecx, 0x456fe0
push dword [esp + 0x54]
call fcn.0040a530
add esp, 0x14
mov edx, str.Total
mov ecx, esi
push eax
call fcn.00407d00
push 8
mov edx, str.Paging_File
mov ecx, edi
call fcn.00407bf0
add esp, 0xc
mov esi, eax
push 0x800
push ecx
push 0
push 0x400
push dword [esp + 0x6c]
mov ecx, 0x456fe0
push dword [esp + 0x6c]
call fcn.0040a530
add esp, 0x14
mov edx, str.Free
mov ecx, esi
push eax
call fcn.00407d00
add esp, 8
push 0x800
push ecx
push 0
push 0x400
push dword [esp + 0x64]
mov ecx, 0x456fe0
push dword [esp + 0x64]
call fcn.0040a530
add esp, 0x14
mov edx, str.Total
push eax
mov ecx, esi
call fcn.00407d00
mov ecx, dword [esp + 0x1a4]
add esp, 8
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0041abcf
mov esp, ebp
pop ebp
ret
push str.Failed_to_allocate_memory_for_new_node_n
push 2
call fcn.0041be90
add esp, 4
push eax
call fcn.00401450
add esp, 8
push 0xe
call fcn.0041bdf0
int3