Function at 0x100021c0
Capabilities:
Get memory capacity
Query or enumerate registry value
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x874
mov eax, dword [0x1000e01c]
xor eax, esp
mov dword [esp + 0x870], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x7f
xor edi, edi
lea ecx, [esp + 0x3fd]
push edi
push ecx
mov dword [esp + 0x30], eax
mov byte [esp + 0x404], 0
call sub.ntdll.dll_memset
push 0x7f
lea edx, [esp + 0x489]
push edi
push edx
mov byte [esp + 0x490], 0
call sub.ntdll.dll_memset
xor eax, eax
push 0xff
mov dword [esp + 0x12d], eax
mov word [esp + 0x131], ax
mov byte [esp + 0x133], al
mov byte [esp + 0x594], al
lea eax, [esp + 0x595]
push edi
push eax
mov byte [esp + 0x134], 0
call sub.ntdll.dll_memset
xor eax, eax
push 0x3f
lea ecx, [esp + 0x1e1]
push edi
push ecx
mov byte [esp + 0x148], 0
mov dword [esp + 0x149], eax
mov dword [esp + 0x14d], eax
mov dword [esp + 0x151], eax
mov dword [esp + 0x155], eax
mov dword [esp + 0x159], eax
mov dword [esp + 0x15d], eax
mov dword [esp + 0x161], eax
mov word [esp + 0x165], ax
mov byte [esp + 0x167], al
mov byte [esp + 0x50], al
mov word [esp + 0x51], ax
mov byte [esp + 0x53], al
mov byte [esp + 0x1e8], al
call sub.ntdll.dll_memset
push 0x3f
lea edx, [esp + 0x1ad]
push edi
push edx
mov byte [esp + 0x1b4], 0
call sub.ntdll.dll_memset
push 0x3f
lea eax, [esp + 0x179]
push edi
push eax
mov byte [esp + 0x180], 0
call sub.ntdll.dll_memset
add esp, 0x48
push 0x1ff
lea ecx, [esp + 0x67d]
push edi
push ecx
mov byte [esp + 0x684], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea edx, [esp + 0x67c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100028c3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x3fc]
push edx
lea eax, [esp + 0x24]
push eax
push edi
push str.ProductName
mov ebx, 0x80
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
call esi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x47c]
push eax
lea ecx, [esp + 0x24]
push ecx
push edi
push str.CSDVersion
push edx
mov dword [esp + 0x2c], ebx
call esi
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x7c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, dword [sym.imp.ntdll.dll_sprintf]
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x47c]
push 0x1000b4f4
push edx
call ebx
push 0x7f
lea eax, [esp + 0x509]
push edi
push eax
mov byte [esp + 0x510], 0
call sub.ntdll.dll_memset
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x98]
push edx
push eax
push ecx
lea edx, [esp + 0x520]
push str.___d._d._d._d_
push edx
call ebx
lea eax, [esp + 0x528]
add esp, 0x30
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10002420
lea edi, [esp + 0x3f8]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x10002435
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.CurrentVersion
push eax
mov dword [esp + 0x2c], 8
call esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x57c]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.SystemRoot
push ecx
mov dword [esp + 0x2c], pe_nt_image_headers32
call esi
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100028c3
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x11c]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.PROCESSOR_ARCHITECTURE
push ecx
mov dword [esp + 0x2c], 0x20
call esi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.NUMBER_OF_PROCESSORS
push edx
mov dword [esp + 0x2c], 4
call esi
mov eax, dword [esp + 0x18]
push eax
call edi
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x34]
movzx eax, word [esp + 0x32]
movzx ecx, word [esp + 0x30]
push edx
movzx edx, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x32]
push ecx
movzx ecx, word [esp + 0x34]
push edx
push eax
push ecx
lea edx, [esp + 0x1d0]
push str._d__d__d__d:_d:_d
push edx
call ebx
add esp, 0x20
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
lea eax, [esp + 0x180]
push str.Total_Memory:__d_MB
push eax
call ebx
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
lea eax, [esp + 0x150]
push str.Available_Memory:__d_MB
push eax
call ebx
mov eax, str._System_Information__r_n
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100025c0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, esi
mov esi, dword [esp + 0x2c]
push eax
push str._System_Information__r_n
push esi
call edi
push 0x1ff
lea edx, [esp + 0x1fd]
push 0
push edx
mov byte [esp + 0x204], 0
call sub.ntdll.dll_memset
lea eax, [esp + 0x684]
push eax
lea ecx, [esp + 0x208]
push str.Module_Path:__s_r_n
push ecx
call ebx
lea eax, [esp + 0x210]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002625
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ecx
push eax
lea eax, [esp + 0x204]
push eax
push esi
call edi
lea ecx, [esp + 0x3f8]
push ecx
lea edx, [esp + 0x1fc]
push str.Product_Name:__s_r_n
push edx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002667
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x204]
push edx
push esi
call edi
lea eax, [esp + 0x478]
push eax
lea ecx, [esp + 0x1fc]
push str.Service_Package:__s_r_n
push ecx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x100026b0
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ecx
push eax
lea eax, [esp + 0x204]
push eax
push esi
call edi
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x1fc]
push str.OS_Version:__s_r_n
push edx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x100026f2
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x204]
push edx
push esi
call edi
lea eax, [esp + 0x178]
push eax
lea ecx, [esp + 0x1fc]
push str._s_r_n
push ecx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002734
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ecx
push eax
lea eax, [esp + 0x204]
push eax
push esi
call edi
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x1fc]
push str._s_r_n
push edx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002776
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x204]
push edx
push esi
call edi
lea eax, [esp + 0x578]
push eax
lea ecx, [esp + 0x1fc]
push str.System_Root:__s_r_n
push ecx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x100027b8
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ecx
push eax
lea eax, [esp + 0x204]
push eax
push esi
call edi
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x1fc]
push str.Processor_Architecture:__s_r_n
push edx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002800
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x204]
push edx
push esi
call edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1fc]
push str.Processor_Number:__s_r_n
push ecx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002840
push 0
lea edx, [esp + 0x14]
push edx
sub eax, ecx
push eax
lea eax, [esp + 0x204]
push eax
push esi
call edi
lea ecx, [esp + 0x1b8]
push ecx
lea edx, [esp + 0x1fc]
push str.Current_Time:__s_r_n
push edx
call ebx
lea eax, [esp + 0x204]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10002882
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x204]
push edx
push esi
call edi
mov eax, str._r_n_r_n
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x100028a8
push 0
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push str._r_n_r_n
push esi
call edi
mov ecx, dword [esp + 0x87c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000a10d
mov esp, ebp
pop ebp
ret