Function at 0x413070
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x46a008]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov ebx, ecx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x413120
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x413120
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
nop dword [eax]
lea ecx, [eax - 2]
mov edx, esi
shr edx, cl
lea ecx, [eax - 1]
and edx, 1
add edi, edx
mov edx, esi
shr edx, cl
mov ecx, eax
and edx, 1
add dword [esp + 0x10], edx
mov edx, esi
shr edx, cl
lea ecx, [eax + 1]
and edx, 1
add eax, 4
add dword [esp + 0xc], edx
mov edx, esi
shr edx, cl
and edx, 1
lea ecx, [eax - 2]
add ebx, edx
cmp ecx, 0x20
jb 0x4130d0
mov ecx, dword [esp + 0x10]
add ecx, ebx
mov ebx, dword [esp + 0x18]
add ecx, dword [esp + 0xc]
add ecx, edi
jmp 0x41312f
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x50]
push str.GlobalMemoryStatusEx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov byte [ebx + 8], 0
mov dword [ebx + 0x20], 0x40000000
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x10], 0x40000000
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0x40000000
mov dword [ebx + 0x1c], 0
mov dword [esp + 0x68], 0x40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4131be
lea ecx, [esp + 0x60]
push ecx
call eax
test eax, eax
je 0x4131be
mov esi, dword [esp + 0x8c]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], esi
cmp esi, edx
ja 0x4131b8
mov ecx, dword [esp + 0x88]
mov dword [esp + 0xc], ecx
jb 0x4131e8
cmp ecx, eax
jb 0x4131e8
mov ecx, eax
mov esi, edx
jmp 0x4131e0
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x44]
cmp dword [esp + 0x54], ecx
cmovb ecx, dword [esp + 0x54]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov byte [ebx + 9], 1
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], esi
test esi, esi
jne 0x4131fe
cmp ecx, 0x70000000
jbe 0x41320d
mov ecx, 0x70000000
xor esi, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], esi
mov ebx, ecx
mov eax, ecx
mov ecx, esi
mov edx, esi
shld ecx, eax, 2
mov edi, 0x47ae147a
shl eax, 2
add ebx, eax
adc edx, ecx
mov ecx, 0xe147ae15
shld edx, ebx, 4
shl ebx, 4
mov eax, ebx
mov dword [esp + 0x14], edx
mul ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov esi, edx
mov eax, ebx
mul edi
mov edi, eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x14]
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x14]
mov edx, 0x47ae147a
mul edx
add ecx, esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x28], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x24]
adc ecx, 0
mov dword [esp + 0x30], edi
xor eax, eax
mov edi, dword [esp + 0x10]
add ebx, ecx
mov ecx, dword [esp + 0x28]
adc eax, eax
add ecx, ebx
mov ebx, dword [esp + 0x14]
adc edx, eax
mov eax, dword [esp + 0x1c]
sub eax, ecx
sbb ebx, edx
shrd eax, ebx, 1
shr ebx, 1
add eax, ecx
adc ebx, edx
mov edx, dword [esp + 0x18]
shrd eax, ebx, 6
shrd esi, edi, 5
shr ebx, 6
shr edi, 5
mov dword [edx + 0x10], eax
mov ecx, edi
mov eax, esi
mov dword [edx + 0x14], ebx
shld ecx, eax, 4
shl eax, 4
add eax, esi
mov dword [edx + 0x18], eax
adc ecx, edi
pop edi
mov dword [edx + 0x1c], ecx
mov ecx, dword [esp + 0xa0]
pop esi
pop ebx
xor ecx, esp
call fcn.0044823d
mov esp, ebp
pop ebp
ret