Function at 0x10009f7d
Capabilities:
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e0
push ebx
push esi
push edi
push 0x1001a52c
lea eax, [ebp - 0x564]
push str.SYSTEMCurrentControlSetServices_s
push eax
mov byte [ebp - 0x360], 0xc8
call dword [0x1001a424]
xor ebx, ebx
push 0x1e
lea eax, [ebp - 0x35f]
push ebx
push eax
call dword [0x1001a49c]
add esp, 0x18
lea eax, [ebp - 0x35f]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x35f]
push ebx
push eax
push 1
lea eax, [ebp - 0x564]
push str.Group
push eax
push SysReAllocString
call fcn.1000c2e8
push 0x10
lea eax, [ebp - 0x30]
pop edi
push edi
push ebx
push eax
call dword [0x1001a49c]
mov esi, dword [ebp + 8]
add esp, 0x2c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x48]
call dword [0x1001a4d4]
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x33c]
push 0x32
push eax
call fcn.10007ff5
add esp, 0xc
cmp dword [0x1001a6c0], ebx
je 0x1000a041
lea eax, [ebp - 0x340]
push eax
call fcn.10009db4
pop ecx
lea eax, [ebp - 0x2c]
push 4
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.10009f54
lea eax, [ebp - 0x33c]
push 0x32
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.10009f54
add esp, 0x18
lea eax, [ebp - 0x308]
mov dword [ebp - 0x308], 0x9c
push eax
call dword [0x1001a3ec]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100080cb
add esp, 0xc
test eax, eax
je 0x1000a0b5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x264], eax
call fcn.1000808b
test eax, eax
setne al
mov byte [ebp - 0x240], al
lea eax, [ebp - 0x260]
push eax
call fcn.10007f9b
pop ecx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
push 0x14
pop ecx
call fcn.1000c950
push ebx
mov dword [ebp - 0x23c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x10015150
push 0x17
push ebx
push 0x10015160
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000a123
mov eax, dword [ebp - 4]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x6e0]
mov dword [ebp - 0x6e0], 0x17c
push ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6a4]
mov ecx, 0x3f0
xor edx, edx
mov edi, ecx
div edi
xor edx, edx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x20], 8
div ecx
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [0x1001a3cc]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x2bf20
jbe 0x1000a193
mov dword [ebp - 0xfc], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], eax
call fcn.10008114
push eax
lea eax, [ebp - 0x1f2]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
call fcn.10007e76
mov dword [ebp - 0x248], eax
call fcn.10009c70
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x11c]
push eax
call edi
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x238]
push 0x32
push eax
call fcn.1000803f
add esp, 0xc
lea eax, [ebp - 0xf8]
push 0x1001a4f8
push eax
call edi
mov eax, dword [0x1001a528]
cmp eax, ebx
jne 0x1000a206
push 0x10018f8c
jmp 0x1000a22c
cmp eax, 1
jne 0x1000a21e
lea eax, [ebp - 0xe4]
push 0x10018f98
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [0x1001a528], 2
jne 0x1000a23a
push 0x10018fa4
lea eax, [ebp - 0xe4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x45f]
mov byte [ebp - 0x460], bl
mov dword [ebp - 0x18], 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x460]
push eax
push 0x10018fb0
call dword [sym.imp.MSVCRT.dll_printf]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0xb2]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 0x360]
mov ecx, esi
push 0x2f0
push eax
call fcn.10001b85
pop edi
pop esi
pop ebx
leave
ret