Function at 0x42e7a0
Capabilities:
Get memory capacity
Get session user name
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88c
mov eax, dword [0x45b990]
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [esi]
xor eax, ebp
mov dword [esp + 0x894], eax
mov eax, dword [edi]
mov dword [esp + 0x14], ecx
push edi
mov ecx, esi
mov dword [esp + 0x14], eax
call dword [edx + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xb8]
mov edx, dword [eax + 0xbc]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [eax]
push edx
mov edx, dword [esi]
push ebx
push ecx
push edi
mov ecx, esi
call dword [edx + 0x18]
push eax
push str._s__0x_08x___s_at__04x:_08x._r_n_r_n
call fcn.0042e720
mov eax, dword [esi]
add esp, 0x18
push ebx
push edi
mov ecx, esi
call dword [eax + 0x1c]
push eax
push str.Crashed_at_FileOffset__08x__s._r_n_r_n
call fcn.0042e720
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
mov ecx, eax
call fcn.0042ef70
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x26]
movzx ecx, word [esp + 0x24]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push ecx
movzx ecx, word [esp + 0x28]
push edx
push eax
push ecx
push str._04d._02d._02d__02d:_02d:_02d
lea edx, [esp + 0x3c4]
push pe_nt_image_headers32
push edx
call fcn.004375dd
lea eax, [esp + 0x3cc]
push eax
push str._s._r_n
call fcn.0042e720
add esp, 0x2c
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
push 0x206
lea ecx, [esp + 0x1a4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
ja 0x42e8cb
push 0x208
push str.Unknown
lea edx, [esp + 0x1a8]
push edx
call esi
xor eax, eax
mov ecx, 0x32
lea edi, [esp + 0xd8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xdc]
push ecx
mov dword [esp + 0x20], 0xc6
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x42e90e
push 0xc8
push str.Unknown
lea edx, [esp + 0xe0]
push edx
call esi
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x1a4]
push ecx
push str._s__run_by__s._r_n
call fcn.0042e720
push 0x32
lea edx, [esp + 0x80]
push edx
push 0x32
lea edi, [esp + 0x2c]
lea esi, [esp + 0xbc]
call fcn.004303e0
lea eax, [esp + 0x88]
push eax
mov ecx, esi
push ecx
push str.Operating_system:___s___s_._r_n
call fcn.0042e720
add esp, 0x24
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
push eax
push ecx
push str._d_processor_s___type__d._r_n
call fcn.0042e720
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x30]
push eax
push str._d___memory_in_use._r_n
call fcn.0042e720
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_physical_memory._r_n
call fcn.0042e720
mov edx, dword [esp + 0x48]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_physical_memory_free._r_n
call fcn.0042e720
mov eax, dword [esp + 0x54]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
call fcn.0042e720
mov ecx, dword [esp + 0x60]
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_paging_file_free._r_n
call fcn.0042e720
mov edx, dword [esp + 0x6c]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_user_address_space._r_n
call fcn.0042e720
mov eax, dword [esp + 0x78]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
call fcn.0042e720
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
add esp, 0x38
cmp ecx, 0xc0000005
jne 0x42ea88
cmp dword [eax + 0x10], 2
jb 0x42ea88
mov edx, dword [eax + 0x14]
test edx, edx
mov ecx, str.Read_from
je 0x42ea56
mov ecx, str.Write_to
mov edx, dword [eax + 0x18]
push edx
push ecx
push str._s_location__08x_caused_an_access_violation._r_n
lea eax, [esp + 0x4b4]
push 0x3e7
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea ecx, [esp + 0x4bc]
push ecx
push 0x4535f0
call fcn.0042e720
add esp, 0x1c
mov ecx, dword [esp + 0x894]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004395fe
mov esp, ebp
pop ebp
ret