Function at 0x4526f4
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
call fcn.004525f6
test eax, eax
je 0x452b35
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea esi, [esp + 0x10]
call fcn.004038c8
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x452735
mov eax, dword [ebx]
push str.duba_otherproduct
mov ecx, ebx
call dword [eax + 0xc]
lea eax, [esp + 0x10]
call fcn.0045233a
test ebx, ebx
je 0x452750
push dword [eax]
mov edx, dword [ebx]
push 0x518a10
mov ecx, ebx
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401239
test ebx, ebx
je 0x452770
push dword [esp + 0x50]
mov eax, dword [ebx]
push str.cpunumber
mov ecx, ebx
call dword [eax + 0x14]
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x1c], 0x20
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
test ebx, ebx
je 0x4527a6
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx]
shr ecx, 0x14
push ecx
push str.memory
mov ecx, ebx
call dword [eax + 0x14]
call fcn.004523c2
test ebx, ebx
je 0x4527bc
mov edx, dword [ebx]
push eax
push str.windows
mov ecx, ebx
call dword [edx + 0x14]
call fcn.00452442
test ebx, ebx
je 0x4527d2
mov edx, dword [ebx]
push eax
push str.installtime
mov ecx, ebx
call dword [edx + 0x14]
call fcn.004a83cf
test ebx, ebx
je 0x4527e8
mov edx, dword [ebx]
push eax
push str.virus
mov ecx, ebx
call dword [edx + 0x14]
call fcn.004a8259
test ebx, ebx
je 0x4527fe
mov edx, dword [ebx]
push eax
push str.safe
mov ecx, ebx
call dword [edx + 0x14]
call fcn.00499918
test ebx, ebx
je 0x452814
mov edx, dword [ebx]
push eax
push str.pcmgr
mov ecx, ebx
call dword [edx + 0x14]
call fcn.004a8921
test ebx, ebx
je 0x45282a
mov edx, dword [ebx]
push eax
push str.rising
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push str.UninstallString
push 0x516a28
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.baidusdSvc.exe
mov dword [esp + 0x1c], str.baidusd.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452865
mov edx, dword [ebx]
push eax
push str.baidu
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
mov edi, str.InstallLocation
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallJiangMin
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.AntivirusKVMonXP.exe
mov dword [esp + 0x1c], str.AntivirusKVPad.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x4528a1
mov edx, dword [ebx]
push eax
push str.jiangmin
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallC759CEB1_F7B7_4E67_AF04_B2107346829D_is1
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.twsscan.exe
mov dword [esp + 0x1c], str.twister.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x4528d8
mov edx, dword [ebx]
push eax
push str.filseclab
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAvira_AntiVir_Desktop
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.avscan.exe
mov dword [esp + 0x1c], str.avcenter.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x45290f
mov edx, dword [ebx]
push eax
push str.acira
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall560985FB_4B76_4121_9189_7A2CDC7886D6
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.avp.exe
mov dword [esp + 0x1c], str.ffcert.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452946
mov edx, dword [ebx]
push eax
push str.kaspersky
mov ecx, ebx
call dword [edx + 0x14]
call fcn.004522ee
test ebx, ebx
je 0x45295c
mov edx, dword [ebx]
push eax
push 0x518abc
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMSC
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.MSCmcuihost.exe
mov dword [esp + 0x1c], str.MSCmcshell.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452993
mov edx, dword [ebx]
push eax
push str.mcafee
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push str.InstallDir
push str.SYSTEMCurrentControlSetServicesekrnParameters
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.egui.exe
mov dword [esp + 0x1c], str.SysRescue.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x4529ce
mov edx, dword [ebx]
push eax
push str.eset
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNAV
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.isolate.ini
mov dword [esp + 0x1c], str.Brandingmuis.dll
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452a05
mov edx, dword [ebx]
push eax
push str.symantec
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallF_Secure_ServiceEnabler_666
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.fs_aua_command.exe
mov dword [esp + 0x1c], str.fslauncher.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452a3c
mov edx, dword [ebx]
push eax
push str.fsecure
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_avast
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.sched.exe
mov dword [esp + 0x1c], str.ashUpd.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452a73
mov edx, dword [ebx]
push eax
push str.avast
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallABBD4BA8_6703_40D2_AB1E_5BB1F7DB49A4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.TitaniumWSCHandler.exe
mov dword [esp + 0x1c], str.TitaniumTiMiniService.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452aaa
mov edx, dword [ebx]
push eax
push str.trendmicro
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMicrosoft_Security_Client
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.MpAsDesc.dll
mov dword [esp + 0x1c], str.MpCommu.dll
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452ae1
mov edx, dword [ebx]
push eax
push 0x518b28
mov ecx, ebx
call dword [edx + 0x14]
and dword [esp + 0x18], 0
push str.DisplayIcon
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAVG
lea esi, [esp + 0x18]
mov dword [esp + 0x18], str.avgui.exe
mov dword [esp + 0x1c], str.avgmfapx.exe
call fcn.0044dc90
test ebx, ebx
pop ecx
pop ecx
je 0x452b25
mov edx, dword [ebx]
push eax
push 0x518b30
mov ecx, ebx
call dword [edx + 0x14]
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x20]
call fcn.004526a1
test ebx, ebx
je 0x452b35
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret