Function at 0x1001fd80
Capabilities:
Enumerate processes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b2f8
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2e0
mov eax, dword [0x100a21a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x100a57b0]
and eax, 1
jne 0x1001fde2
mov ecx, dword [0x100a57b0]
or ecx, 1
mov dword [0x100a57b0], ecx
mov ecx, 0x100a5780
call fcn.1001ed60
push 0x1007d4c0
call fcn.10037e6c
add esp, 4
push 8
lea ecx, [ebp - 0x1c]
call fcn.100062d0
movzx edx, byte [0x10086567]
push edx
push 0x100a5780
lea ecx, [ebp - 0x1c]
call fcn.1001e900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.100229f0
movzx eax, al
test eax, eax
jne 0x1001fe3b
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1001ef60
mov eax, dword [ebp - 0x2d8]
jmp 0x10020016
push 0x40
push 0
lea ecx, [ebp - 0x9c]
push ecx
call fcn.10054b00
add esp, 0xc
mov dword [ebp - 0x9c], 0x40
lea edx, [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0xffffffff
jne 0x1001fea1
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1001ef60
mov eax, dword [ebp - 0x2dc]
jmp 0x10020016
push 0x22c
push 0
lea eax, [ebp - 0x2c8]
push eax
call fcn.10054b00
add esp, 0xc
mov dword [ebp - 0x2c8], 0x22c
lea ecx, [ebp - 0x2c8]
push ecx
mov edx, dword [ebp - 0x2d0]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
je 0x1001ff6e
mov eax, dword [ebp - 0x2c0]
push eax
push 1
push 0x500
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
je 0x1001ff50
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x2cc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov edx, dword [ebp - 0x2cc]
push edx
call sub.KERNEL32.dll_K32EmptyWorkingSet
jmp 0x1001ff33
mov dword [ebp - 4], 0
jmp 0x1001ff43
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c8]
push ecx
mov edx, dword [ebp - 0x2d0]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x2d4], eax
jmp 0x1001feda
mov eax, dword [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2e0], 1
lea ecx, [ebp - 0x2e0]
push ecx
lea ecx, [ebp - 0x2f0]
call fcn.1001d8d0
push eax
call fcn.1001e760
add esp, 4
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.10054b00
add esp, 0xc
mov dword [ebp - 0x5c], 0x40
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
sbb edx, dword [ebp - 0x88]
push 0
push 0x400
push edx
push ecx
call fcn.10038100
push 0
push 0x400
push edx
push eax
call fcn.10038100
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1001ef60
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10037e81
mov esp, ebp
pop ebp
ret