Function at 0x10020435
Capabilities:
Get memory capacity

Disassembly:
push 0xd8
mov eax, 0x1005b41b
call fcn.10040d31
and dword [ebp - 0x20], 0
cmp dword [0x10074850], 0
jne 0x10020483
push str.NtQuerySystemInformation
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10074850], eax
test eax, eax
jne 0x10020483
mov ecx, dword [ebp + 8]
push 0x10060e9b
call fcn.10004842
jmp 0x100206d6
call fcn.10020113
call fcn.10020259
push 6
pop edx
lea ebx, [ebp - 0x54]
call fcn.1002fa07
mov dword [ebp - 4], 1
and dword [ebp - 0x18], 0
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x100206df
call fcn.10027bd6
push 6
pop edx
lea ebx, [ebp - 0x6c]
call fcn.1002fa07
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
call fcn.10030a94
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
push 1
call fcn.1002fa74
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x1006120c
mov byte [ebp - 4], 6
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 5
call fcn.1002fdd8
push 0x10063454
lea esi, [ebp - 0xc8]
call fcn.100048d8
mov eax, esi
push eax
lea eax, [ebp - 0xe4]
push eax
mov byte [ebp - 4], 7
call fcn.10001246
sub esp, 0x10
mov byte [ebp - 4], 8
mov edx, eax
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.1002fb85
lea eax, [ebp - 0x3c]
push eax
mov edx, str.name
mov byte [ebp - 4], 9
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 8
call fcn.1002fdd8
push ebx
push 1
lea ecx, [ebp - 0xe4]
call fcn.10004d05
push ebx
push 1
lea esi, [ebp - 0xc8]
mov byte [ebp - 4], 5
call fcn.10004dfd
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
push 0x10063464
call fcn.1002fad2
lea eax, [ebp - 0x3c]
push eax
mov edx, str.user
mov byte [ebp - 4], 0xa
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 5
call fcn.1002fdd8
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x18]
call fcn.1002fa74
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x10063468
mov byte [ebp - 4], 0xb
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 5
call fcn.1002fdd8
push 0x3c
lea eax, [ebp - 0xa8]
push ebx
push eax
mov dword [ebp - 0xac], 0x40
call fcn.10044e90
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0xa4]
sub ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa0]
sbb edx, dword [ebp - 0x98]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x14], esp
push edx
push ecx
call fcn.1002faa7
lea eax, [ebp - 0x3c]
push eax
mov edx, str.memory
mov byte [ebp - 4], 0xc
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 5
call fcn.1002fdd8
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
push 0x10060e9b
call fcn.1002fad2
lea eax, [ebp - 0x3c]
push eax
mov edx, str.hash4k
mov byte [ebp - 4], 0xd
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 5
call fcn.1002fdd8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10030e1a
lea eax, [ebp - 0x54]
xor esi, esi
call fcn.10030753
test eax, eax
jbe 0x100206a0
push esi
lea eax, [ebp - 0x54]
push eax
call fcn.100307a3
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10030e1a
lea eax, [ebp - 0x54]
inc esi
call fcn.10030753
cmp esi, eax
jb 0x1002067f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push eax
call fcn.1003125d
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x20], 1
mov byte [ebp - 4], 2
call fcn.1002fd55
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.1002fd55
lea esi, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.1002fd55
mov eax, dword [ebp + 8]
call fcn.10040e09
ret