Function at 0x4d2cf0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ebp, ecx
push 0x661408
call esi
mov bl, byte [esp + 0x118]
mov al, byte [ebp + 0x29fc3]
cmp bl, al
jl 0x4d2d27
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x104
ret 8
push edi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.004d47a0
push 0x661408
call esi
movsx esi, byte [esp + 0x118]
cmp esi, 0x13
ja case.0x4d2d54.14
jmp dword [esi*4 + 0x4d3338]
mov byte [ebp + 0x2ce44], bl
mov byte [ebp + 0x2ce71], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce47], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce4a], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce4d], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce50], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce53], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce56], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce59], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce5c], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce5f], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce62], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce65], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce68], bl
jmp case.0x4d2d54.14
mov byte [ebp + 0x2ce6b], bl
jmp case.0x4d2d54.14
mov al, byte [ebp + 0x16c1]
test al, al
jne case.0x4d2d54.14
mov byte [ebp + 0x2ce41], bl
mov byte [ebp + 0x2ce6e], bl
jmp case.0x4d2d54.14
test bl, bl
je 0x4d2e19
add bl, 0x1f
mov byte [ebp + 0x2ce41], bl
mov byte [ebp + 0x2ce6e], bl
jmp case.0x4d2d54.14
mov al, byte [ebp + 0x16bf]
mov byte [ebp + 0x2ce6e], 0
mov byte [ebp + 0x2ce41], al
jmp case.0x4d2d54.14
test bl, bl
je 0x4d2e3d
add bl, 0x1f
mov byte [ebp + 0x2ce3e], bl
jmp case.0x4d2d54.14
mov cl, byte [ebp + 0x16c0]
mov byte [ebp + 0x2ce3e], cl
lea edx, [ebp + 0x2ce3c]
mov ecx, 0x64ee90
push edx
call fcn.00443810
push 0x661408
mov dword [ebp + 0x2ce38], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp esi, 0x13
ja case.default.0x4d2e74
jmp dword [esi*4 + 0x4d3388]
mov eax, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [eax + 8]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0xc]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x10]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x14]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x18]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x1c]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x20]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x24]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x28]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x2c]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x30]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x34]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x38]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x3c]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x40]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 0x44]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx + 4]
jmp 0x4d2fa1
mov ecx, dword [ebp + 0x2ce38]
lea edx, [esp + 0x14]
mov edi, dword [ecx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov bl, byte [esp + 0x118]
cmp bl, 0x12
jne 0x4d2fd4
mov byte [esp + 0x118], 0x11
jmp 0x4d2fe1
cmp bl, 0x13
jne 0x4d2fe8
mov byte [esp + 0x118], 0x10
mov bl, byte [esp + 0x118]
movsx esi, bl
xor edi, edi
mov dword [esp + 0x10], esi
mov eax, dword [esi*4 + 0x64f57c]
cmp eax, edi
je 0x4d300e
push eax
mov ecx, 0x63b370
call fcn.004197f0
mov dword [esi*4 + 0x64f57c], edi
push 5
lea ecx, [esp + 0x18]
push str.Character_
push ecx
mov ecx, 0x63b370
call fcn.00418500
test bl, bl
mov dword [esi*4 + 0x64f57c], eax
jne 0x4d3090
mov eax, dword [0x64f5b8]
cmp eax, edi
je 0x4d3049
push eax
mov ecx, 0x63b370
call fcn.004197f0
mov dword [0x64f5b8], edi
mov eax, dword [ebp + 0x2ce38]
or ecx, 0xffffffff
lea edx, [esp + 0x14]
push 1
mov edi, dword [eax + 0x44]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Character_
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x63b370
call fcn.00418500
mov dword [0x64f5b8], eax
jmp 0x4d30f4
cmp bl, 0x11
jne 0x4d30f4
mov eax, dword [0x64f5b4]
cmp eax, edi
je 0x4d30af
push eax
mov ecx, 0x63b370
call fcn.004197f0
mov dword [0x64f5b4], edi
mov eax, dword [ebp + 0x2ce38]
or ecx, 0xffffffff
lea edx, [esp + 0x14]
push 1
mov edi, dword [eax + 0x40]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Character_
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x63b370
call fcn.00418500
mov dword [0x64f5b4], eax
push 0x661408
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor edi, edi
mov esi, 0x64f7a0
push edi
lea edx, [esp + 0x98]
push str.I_.3d
push edx
call fcn.005753d0
mov eax, dword [0x64f5b4]
add esp, 0xc
lea ecx, [esp + 0x94]
mov dword [0x63b390], eax
push 0
push ecx
mov ecx, 0x63b370
call fcn.00419a50
test eax, eax
mov dword [esi], eax
jne 0x4d3161
mov edx, dword [0x64f5b8]
push eax
lea eax, [esp + 0x98]
mov ecx, 0x63b370
push eax
mov dword [0x63b390], edx
call fcn.00419a50
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x64f8a0
jl 0x4d3106
cmp bl, 0x10
jne 0x4d31e7
mov ecx, dword [0x64f5bc]
lea edx, [esp + 0x14]
push str.n_HEAD
push edx
mov dword [0x63b390], ecx
call fcn.005753d0
add esp, 8
lea eax, [esp + 0x14]
mov ecx, 0x63b370
push 0
push eax
call fcn.00419a50
test eax, eax
je 0x4d31a9
or byte [eax + 4], 1
xor edi, edi
mov esi, 0x64f614
push edi
lea ecx, [esp + 0x18]
push str.H_HEAD_.2d
push ecx
call fcn.005753d0
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, 0x63b370
push 0
push edx
call fcn.00419a50
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x64f634
jl 0x4d31b0
jmp 0x4d32d1
cmp bl, 3
jne 0x4d325c
mov eax, dword [0x64f588]
lea ecx, [esp + 0x14]
push str.n_HANDL
push ecx
mov dword [0x63b390], eax
call fcn.005753d0
add esp, 8
lea edx, [esp + 0x14]
mov ecx, 0x63b370
push 0
push edx
call fcn.00419a50
test eax, eax
je 0x4d3221
or byte [eax + 4], 1
xor edi, edi
mov esi, 0x64f634
push edi
lea eax, [esp + 0x18]
push str.H_HANDL_.2d
push eax
call fcn.005753d0
add esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
mov ecx, 0x63b370
call fcn.00419a50
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x64f68c
jl 0x4d3228
jmp 0x4d32d1
cmp bl, 6
jne 0x4d32d1
mov edx, dword [0x64f594]
lea eax, [esp + 0x14]
push str.n_HANDR
push eax
mov dword [0x63b390], edx
call fcn.005753d0
add esp, 8
lea ecx, [esp + 0x14]
push 0
push ecx
mov ecx, 0x63b370
call fcn.00419a50
test eax, eax
je 0x4d3298
or byte [eax + 4], 1
xor edi, edi
mov esi, 0x64f68c
push edi
lea edx, [esp + 0x18]
push str.H_HANDR_.2d
push edx
call fcn.005753d0
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, 0x63b370
push 0
push eax
call fcn.00419a50
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x64f6e4
jl 0x4d329f
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x661408
call esi
mov ecx, dword [0x64f57c]
mov edx, dword [0x64f578]
mov dword [0x63b390], ecx
mov ecx, 0x63b370
mov dword [0x63b394], edx
call fcn.00410ab0
mov eax, dword [ebp + 0x2ce38]
mov ecx, 0x64ee90
push eax
call fcn.00443ed0
push 0x661408
call esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, dword [ecx*4 + 0x64f57c]
pop ebx
test eax, eax
setne al
add esp, 0x104
ret 8