Function at 0x413d60
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x472008]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov ebx, ecx
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x413e10
mov esi, dword [esp + 0x34]
test esi, esi
je 0x413e10
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
lea esp, [esp]
lea ecx, [eax - 2]
mov edx, esi
shr edx, cl
lea ecx, [eax - 1]
and edx, 1
add edi, edx
mov edx, esi
shr edx, cl
mov ecx, eax
and edx, 1
add dword [esp + 0x10], edx
mov edx, esi
shr edx, cl
lea ecx, [eax + 1]
and edx, 1
add eax, 4
add dword [esp + 0xc], edx
mov edx, esi
shr edx, cl
and edx, 1
lea ecx, [eax - 2]
add ebx, edx
cmp ecx, 0x20
jb 0x413dc0
mov ecx, dword [esp + 0x10]
add ecx, ebx
mov ebx, dword [esp + 0x18]
add ecx, dword [esp + 0xc]
add ecx, edi
jmp 0x413e1f
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x50]
push str.GlobalMemoryStatusEx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov byte [ebx + 8], 0
mov dword [ebx + 0x20], 0x40000000
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x10], 0x40000000
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0x40000000
mov dword [ebx + 0x1c], 0
mov dword [esp + 0x68], 0x40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x413ebc
lea eax, [esp + 0x60]
mov ecx, esi
push eax
call dword [0x4642a0]
call esi
test eax, eax
je 0x413ebc
mov ecx, dword [esp + 0x8c]
mov esi, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x10], ecx
cmp ecx, esi
ja 0x413eb2
mov eax, dword [esp + 0x88]
mov dword [esp + 0xc], eax
jb 0x413eeb
cmp eax, edx
jb 0x413eeb
mov eax, edx
mov ecx, esi
mov dword [esp + 0xc], eax
jmp 0x413ee7
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0xc], eax
cmp eax, ecx
jb 0x413ee5
mov eax, ecx
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov byte [ebx + 9], 1
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], ecx
test ecx, ecx
jne 0x413f00
cmp eax, 0x70000000
jbe 0x413f0f
mov eax, 0x70000000
xor ecx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov ebx, eax
mov edx, ecx
shld ecx, eax, 2
mov edi, 0x47ae147a
shl eax, 2
add ebx, eax
adc edx, ecx
mov ecx, 0xe147ae15
shld edx, ebx, 4
shl ebx, 4
mov eax, ebx
mov dword [esp + 0x14], edx
mul ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], eax
mov esi, edx
mov eax, ebx
mul edi
mov edi, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x14]
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x14]
mov edx, 0x47ae147a
mul edx
add ecx, esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x20], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x1c]
adc ecx, 0
mov edi, dword [esp + 0x10]
xor eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x20]
adc eax, eax
add ecx, ebx
mov ebx, dword [esp + 0x14]
adc edx, eax
mov eax, dword [esp + 0x34]
sub eax, ecx
sbb ebx, edx
shrd eax, ebx, 1
shr ebx, 1
add eax, ecx
adc ebx, edx
mov edx, dword [esp + 0x18]
shrd eax, ebx, 6
shrd esi, edi, 5
shr ebx, 6
shr edi, 5
mov dword [edx + 0x10], eax
mov ecx, edi
mov eax, esi
mov dword [edx + 0x14], ebx
shld ecx, eax, 4
shl eax, 4
add eax, esi
mov dword [edx + 0x18], eax
adc ecx, edi
pop edi
mov dword [edx + 0x1c], ecx
mov ecx, dword [esp + 0xa0]
pop esi
pop ebx
xor ecx, esp
call fcn.0045e090
mov esp, ebp
pop ebp
ret