Function at 0x1003def
Capabilities:
Get memory capacity
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x100923c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
xor eax, eax
push 0x40
mov byte [ebp - 0x108], 0
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
cmp edi, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
je 0x1003ea8
lea ecx, [ebp - 0x10c]
push ecx
push 0x20019
push eax
push 0x1001334
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ea8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x10013b0
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003e9c
test byte [ebp - 0x114], 1
je 0x1003e9c
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.010063ea
test eax, eax
jne 0x1003ecb
test edi, edi
mov eax, 0x1001a88
jne 0x1003ebf
mov eax, 0x1001a78
push dword [ebp + 0x14]
push edi
push edi
push eax
push esi
call fcn.0100265e
cmp dword [0x1009258], 0
je 0x1003ee5
test ebx, ebx
jne 0x1003ee5
push dword [ebp + 0x14]
push 1
push edi
push 0x1001a60
jmp 0x1003eec
push dword [ebp + 0x14]
push 1
push edi
push ebx
push esi
call fcn.0100265e
xor ebx, ebx
cmp edi, ebx
je 0x1003f19
call fcn.0100320c
test eax, eax
je 0x1003f19
call fcn.01003299
test eax, eax
jne 0x1003f19
push 5
push ebx
push edi
push 0x1001a44
push esi
call fcn.0100265e
cmp dword [ebp - 0x110], ebx
je 0x1003f40
cmp dword [0x1009250], ebx
mov eax, 0x1001a38
jne 0x1003f33
mov eax, 0x1001a28
push dword [ebp + 0x14]
push 1
push edi
push eax
push esi
call fcn.0100265e
cmp edi, ebx
jne 0x1003f73
call fcn.010024ad
test eax, eax
jne 0x10040bc
cmp dword [0x1009250], ebx
mov eax, 0x1001a18
jne 0x1003f63
mov eax, 0x1001a04
push 0xd
push ebx
push ebx
push eax
push esi
call fcn.0100265e
jmp 0x10040bc
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [0x1009250], ebx
je 0x1003fa5
cmp dword [ebp - 0x134], 0x3f00000
jb 0x1003fc2
mov eax, 0x10019f4
jmp 0x1003fb6
cmp dword [ebp - 0x134], 0x1f00000
jb 0x1003fc2
mov eax, 0x10019e4
push 0xd
push 1
push edi
push eax
push esi
call fcn.0100265e
push ebx
call fcn.01002403
test eax, eax
je 0x1003fe9
cmp dword [0x1009258], ebx
mov eax, 0x10019d0
jne 0x1003fde
mov eax, 0x10019c0
push 5
push ebx
push edi
push eax
push esi
call fcn.0100265e
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push ebx
push 0x1001280
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10040bc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x10019b4
push dword [ebp - 0x10c]
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10040b0
cmp dword [0x1009250], ebx
je 0x100406f
push 0x10019ac
lea eax, [ebp - 0x108]
push eax
call fcn.01005f6d
test eax, eax
je 0x100406f
push 0x10019a4
lea eax, [ebp - 0x108]
push eax
call fcn.01005f6d
test eax, eax
jne 0x100409b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1001988
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x1004099
push 0x100196c
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
jne 0x10040ae
xor ebx, ebx
push dword [ebp + 0x14]
push 1
push edi
push 0x1001958
push esi
call fcn.0100265e
jmp 0x10040b0
xor ebx, ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], ebx
jne 0x10040d5
push dword [ebp + 0x14]
push 1
push edi
push ebx
push 0x1001948
call fcn.0100265e
cmp edi, ebx
pop edi
pop esi
pop ebx
jne 0x10040e1
call fcn.0100279e
mov ecx, dword [ebp - 4]
call fcn.01005857
leave
ret 0x10