Function at 0x4233d0
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2fc
mov eax, dword [0x43735c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x300], eax
push edi
je 0x42368d
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov byte [esp + 0xc8], bl
xor eax, eax
mov ecx, 0x18
lea edi, [esp + 0xc9]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0xcc]
push 0x64
push edx
stosb byte es:[edi], al
call fcn.004244f0
lea eax, [esp + 0xd4]
push eax
push str.Error_occurred_at__s._r_n
push esi
call fcn.00424800
mov byte [esp + 0x210], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x211]
rep stosd dword es:[edi], eax
add esp, 0x18
push 0x104
lea ecx, [esp + 0x1fc]
stosw word es:[edi], ax
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
ja 0x423497
push 8
push 0x4306b0
lea edx, [esp + 0x200]
push 0x104
push edx
call fcn.00422b40
add esp, 0x10
xor eax, eax
mov byte [esp + 0x130], bl
mov ecx, 0x31
lea edi, [esp + 0x131]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x134]
push ecx
mov dword [esp + 0x38], 0xc8
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4234ec
push 8
push 0x4306b0
lea edx, [esp + 0x138]
push 0xc8
push edx
call fcn.00422b40
add esp, 0x10
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1fc]
push ecx
push str._s__run_by__s._r_n
push esi
call fcn.00424800
xor eax, eax
mov byte [esp + 0xa4], bl
mov ecx, 0xc
lea edi, [esp + 0xa5]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x70], bl
mov ecx, 0xc
lea edi, [esp + 0x71]
rep stosd dword es:[edi], eax
push 0x32
lea edx, [esp + 0x74]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0xac]
push 0x32
push eax
call fcn.004241f0
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0xb8]
push edx
push str.Operation_system_:__s___s_._r_n
push esi
call fcn.00424800
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
add esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 0x50], eax
push ecx
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push edx
push eax
push str._d_processor_s___type__d._r_n
push esi
call fcn.00424800
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
add esp, 0x10
lea edx, [esp + 0x10]
mov dword [esp + 0x28], ecx
push edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x14], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x14]
push eax
push str._d___memory_in_use._r_n
push esi
call fcn.00424800
mov ecx, dword [esp + 0x24]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_physical_memory._r_n
push esi
call fcn.00424800
mov edx, dword [esp + 0x34]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_physical_memory_free._r_n
push esi
call fcn.00424800
mov eax, dword [esp + 0x44]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
push esi
call fcn.00424800
mov ecx, dword [esp + 0x54]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_paging_file_free._r_n
push esi
call fcn.00424800
mov edx, dword [esp + 0x64]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_user_address_space._r_n
push esi
call fcn.00424800
mov eax, dword [esp + 0x74]
add eax, 0xfffff
add esp, 0x48
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
push esi
call fcn.00424800
add esp, 0xc
mov ecx, dword [esp + 0x304]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415465
mov esp, ebp
pop ebp
ret 4