Function at 0x402e06
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x255c
call fcn.004079e4
push ebx
push esi
push edi
call fcn.00402822
mov byte [ebp - 0x201d], 0
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x402e35
mov byte [ebp - 0x201d], 1
mov byte [ebp - 0x100d], 0
add dword [0x42a100], 7
cmp byte [ebp - 0x201d], 0
jne 0x402e5d
movzx eax, byte [ebp - 0x100d]
cmp byte [eax + 0x42a8ec], 1
je 0x402e77
cmp byte [ebp - 0x201d], 0
je 0x402e79
movzx eax, byte [ebp - 0x100d]
cmp byte [eax + 0x42a8ec], 2
jne 0x402e79
jmp 0x402ed7
movzx edx, byte [ebp - 0x100d]
mov dword [ebp - 0x2158], edx
imul ecx, edx, 0xf
lea ecx, [ecx + 0x42a8c4]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov edx, dword [ebp - 0x2158]
mov dword [edx*4 + 0x418950], eax
movzx edx, byte [ebp - 0x100d]
imul ecx, edx, 0x1e
lea ecx, [ecx + str.Process32Next]
push ecx
shl edx, 2
mov dword [ebp - 0x215c], edx
push dword [edx + 0x418950]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 0x215c]
mov dword [edx + 0x408120], eax
add byte [ebp - 0x100d], 1
movzx eax, byte [ebp - 0x100d]
imul eax, eax, 0x1e
cmp byte [eax + str.Process32Next], 0
jne 0x402e43
mov byte [ebp - 0x100d], 0
movzx edx, byte [ebp - 0x100d]
shl edx, 2
cmp dword [edx + 0x408120], 0
je 0x4033af
movzx edx, byte [ebp - 0x100d]
shl edx, 2
mov edx, dword [edx + 0x418950]
mov dword [ebp - 0x202c], edx
inc dword [0x42a100]
cmp byte [ebp - 0x201d], 0
je 0x4030d6
call fcn.0040289a
mov dword [ebp - 0x2028], eax
inc dword [0x42a100]
mov edx, dword [ebp - 0x202c]
mov ebx, edx
shr ebx, 0x16
shl ebx, 0x16
mov eax, ebx
add eax, 0x400000
mov dword [ebp - 0x100c], eax
xor edi, edi
jmp 0x402f90
push 0x1000
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
mov esi, eax
xor esi, 1
shl esi, 2
mov dword [ebp + edi*4 - 0x1008], esi
inc edi
add ebx, 0x1000
cmp ebx, dword [ebp - 0x100c]
jbe 0x402f6f
lea eax, [ebp - 0x217c]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
inc dword [0x42a100]
and dword [ebp - 0x1014], 0
jmp 0x403042
push 0xffff
push dword [ebp - 0x1014]
push dword [ebp - 0x2028]
call fcn.004029dd
add esp, 0xc
mov dword [ebp - 4], eax
or eax, eax
je 0x403038
and dword [ebp - 0x2180], 0
mov ebx, dword [ebp - 0x2180]
jmp 0x403027
xor edi, edi
mov edx, ebx
shr edx, 2
shl edx, 2
add edx, dword [ebp - 4]
mov esi, dword [edx + edi*4]
and esi, 4
cmp esi, dword [ebp + edi*4 - 0x1008]
jne 0x40300a
inc edi
cmp edi, 0x400
jb 0x402fe7
cmp edi, 0x3ff
jb 0x403021
mov eax, ebx
add eax, 0x1000
mov dword [ebp - 0x2180], eax
jmp 0x40306f
add ebx, 0x1000
cmp ebx, 0xf000
jbe 0x402fe5
push dword [ebp - 4]
call fcn.00402a4b
pop ecx
add dword [ebp - 0x1014], 0x10000
mov eax, dword [ebp - 0x2174]
sub eax, 0xffff
cmp dword [ebp - 0x1014], eax
jbe 0x402fb6
inc dword [0x42a100]
push dword [ebp - 0x2028]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4033af
movzx edx, byte [ebp - 0x100d]
shl edx, 2
mov edx, dword [edx + 0x408120]
mov dword [ebp - 0x100c], edx
and dword [ebp - 0x100c], 0
mov edx, dword [ebp - 0x100c]
shl edx, 2
mov ecx, ebx
shr ecx, 2
shl ecx, 2
add ecx, dword [ebp - 4]
mov ecx, dword [ecx + edx]
mov dword [ebp + edx - 0x2018], ecx
mov edx, dword [ebp - 0x100c]
shl edx, 2
mov ecx, ebx
shr ecx, 2
shl ecx, 2
add ecx, dword [ebp - 4]
add edx, ecx
or byte [edx], 2
inc dword [ebp - 0x100c]
cmp dword [ebp - 0x100c], 0x400
jb 0x40308d
inc dword [0x42a100]
cmp byte [ebp - 0x201d], 0
jne 0x403140
push 0x42a9ea
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 0x2160], eax
mov edx, eax
add edx, dword [eax + 0x3c]
mov dword [ebp - 0x2164], edx
add edx, 0x78
add eax, dword [edx]
mov dword [ebp - 0x2168], eax
mov eax, dword [ebp - 0x2160]
mov edx, dword [ebp - 0x2168]
add edx, 0x1c
add eax, dword [edx]
mov dword [ebp - 0x216c], eax
mov eax, dword [ebp - 0x2160]
mov edx, dword [ebp - 0x216c]
add eax, dword [edx]
mov dword [ebp - 0x2170], eax
mov dword [ebp - 0x2054], eax
mov eax, dword [ebp - 0x202c]
mov dword [ebp - 0x2024], eax
push 0x1c
lea eax, [ebp - 0x2048]
push eax
push dword [ebp - 0x2024]
call sub.KERNEL32.DLL_VirtualQuery
mov eax, dword [ebp - 0x202c]
cmp dword [ebp - 0x2044], eax
jne 0x4031b1
mov eax, dword [ebp - 0x203c]
mov dword [ebp - 0x204c], eax
add dword [ebp - 0x2024], eax
cmp byte [ebp - 0x201d], 0
jne 0x40314c
push 0x20060000
push 0
mov edx, dword [ebp - 0x204c]
shr edx, 0xc
push edx
mov edx, dword [ebp - 0x2048]
shr edx, 0xc
push edx
push 0x1000d
call dword [ebp - 0x2054]
jmp 0x40314c
inc dword [0x42a100]
movzx edx, byte [ebp - 0x100d]
shl edx, 2
mov ecx, dword [ebp - 0x2024]
sub ecx, dword [ebp - 0x202c]
mov dword [edx + 0x408530], ecx
movzx edx, byte [ebp - 0x100d]
shl edx, 2
mov edx, dword [edx + 0x408120]
mov dword [ebp - 0x100c], edx
push 0x1000
push edx
call sub.KERNEL32.DLL_IsBadWritePtr
mov dword [ebp - 0x2050], eax
or eax, eax
jne 0x403364
cmp byte [ebp + 8], 0
je 0x403348
mov eax, dword [ebp - 0x100c]
movzx eax, byte [eax]
cmp eax, 0xe9
je 0x40322d
cmp byte [ebp + 8], 1
je 0x403364
jmp 0x403348
mov eax, dword [ebp - 0x100c]
mov edx, dword [eax + 1]
sub edx, 0xffffffff
lea eax, [edx + eax + 4]
mov dword [ebp - 0x201c], eax
mov byte [ebp - 0x215d], 0
sub dword [ebp - 0x201c], 5
mov esi, dword [ebp - 0x201c]
mov eax, esi
dec eax
cmp byte [eax], 0
jne 0x40328b
mov eax, esi
sub eax, 2
cmp byte [eax], 0
jne 0x40328b
mov eax, esi
sub eax, 3
cmp byte [eax], 0
jne 0x40328b
mov eax, esi
sub eax, 4
cmp byte [eax], 0
jne 0x40328b
mov eax, esi
sub eax, 5
cmp byte [eax], 0
je 0x403294
dec esi
jmp 0x40325b
movzx edx, byte [ebp - 0x215d]
shl edx, 2
mov dword [ebp + edx - 0x255c], esi
add byte [ebp - 0x215d], 1
movzx eax, byte [esi]
cmp eax, 0xe9
jne 0x4032cc
mov eax, dword [esi + 1]
sub eax, 0xffffffff
lea eax, [eax + esi + 4]
mov dword [ebp - 0x201c], eax
jmp 0x40324e
mov edi, esi
jmp 0x4032df
mov eax, dword [ebp - 0x100c]
add eax, edi
sub eax, esi
mov dl, byte [edi]
mov byte [eax], dl
inc edi
cmp edi, dword [ebp - 0x201c]
jb 0x4032d0
sub byte [ebp - 0x215d], 1
movzx edx, byte [ebp - 0x215d]
shl edx, 2
mov edi, dword [ebp + edx - 0x255c]
mov byte [edi], 0
cmp byte [edi + 1], 0
jne 0x403334
cmp byte [edi + 2], 0
jne 0x403334
cmp byte [edi + 3], 0
jne 0x403334
cmp byte [edi + 4], 0
jne 0x403334
cmp byte [edi + 5], 0
je 0x403337
inc edi
jmp 0x4032ff
movzx eax, byte [ebp - 0x215d]
or eax, eax
jg 0x4032e7
cmp byte [ebp + 8], 1
je 0x403364
movzx eax, byte [ebp - 0x100d]
push eax
push dword [ebp - 0x2024]
push dword [ebp - 0x202c]
call fcn.00402cd7
add esp, 0xc
cmp byte [ebp - 0x201d], 0
je 0x4033af
and dword [ebp - 0x100c], 0
mov edx, dword [ebp - 0x100c]
shl edx, 2
mov ecx, ebx
shr ecx, 2
shl ecx, 2
add ecx, dword [ebp - 4]
mov eax, dword [ebp + edx - 0x2018]
mov dword [ecx + edx], eax
inc dword [ebp - 0x100c]
cmp dword [ebp - 0x100c], 0x400
jb 0x403374
inc dword [0x42a100]
jmp 0x402fdd
add byte [ebp - 0x100d], 1
movzx eax, byte [ebp - 0x100d]
imul eax, eax, 0x1e
cmp byte [eax + str.Process32Next], 0
jne 0x402efd
pop edi
pop esi
pop ebx
leave
ret