Function at 0x10028c28
Capabilities:
Get memory capacity
Resume thread

Disassembly:
mov eax, 0x1005ff76
call fcn.1005ecf4
sub esp, 0x38
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x28], ecx
je 0x10028e3f
mov dword [ebp - 0x24], 0x6f25
xor esi, esi
cmp dword [ebp - 0x24], 0x7041
jle 0x10028cb4
mov ebx, esi
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x20], esi
mov dword [ebp - 0x1c], 0x3102
mov edi, esi
mov esi, dword [ebp + 0x20]
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10079358
and eax, ebx
cdq
push edx
push eax
call fcn.100033d6
inc edi
cmp edi, 0x4d64
jl 0x10028c71
mov edi, dword [ebp - 0x20]
add esi, edi
dec dword [ebp - 0x1c]
push 0
mov dword [ebp + 0x20], esi
pop esi
jne 0x10028c6c
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x6dbb
jl 0x10028c62
inc ebx
cmp ebx, 0x64f7
jl 0x10028c5f
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x6c51
jge 0x10028ccf
mov edx, str.ing_bsemm_qwwolgvj_gwxwmt_wktvpd_yjjw_pxmehlvrn_cbzbo
mov ecx, 0x10079358
call fcn.1000562f
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x46ad
cmp dword [ebp - 0x20], 0x49a6
jle 0x10028d3b
mov ebx, esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x24], 0x6c43
mov dword [ebp + 0x20], eax
and eax, ebx
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001ac4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028d0a
mov eax, dword [eax]
push eax
call fcn.10046ccf
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.100038da
mov eax, dword [ebp + 0x20]
add eax, edi
dec dword [ebp - 0x24]
mov dword [ebp + 0x20], eax
jne 0x10028cf3
inc edi
cmp edi, 0x3b5f
jl 0x10028ce7
inc ebx
cmp ebx, 0x6851
jl 0x10028ce5
cmp dword [ebp - 0x20], 0x459f
jge 0x10028d4f
push str.fsfslf_usdnh_ysmbaod_sxnqemu_ijaoorib_kkiytb_mwxkd_guoxcw_gkovogpj_kxlmddlp_cvynja_sbalwmj_rkssiyo_wrnt
call fcn.10046ccf
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x10028e35
mov dword [ebp + 0x20], 0x1a2f
cmp dword [ebp + 0x20], 0x1d5b
jle 0x10028da6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10079358
or eax, edi
cdq
push edx
push eax
call fcn.100033d6
inc ebx
cmp ebx, 0x748b
jl 0x10028d78
inc edi
cmp edi, 0x2a72
jl 0x10028d76
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], 4
cmp dword [ebp + 0x20], 0x1651
jge 0x10028e08
mov edx, str.qwvd_xcwjy_pcumvzvs_bhoqk_rkhc_xxvpjepxf_hiyjiaxv_bazpfe_bhjid_fyn_pka_vyiocbiga
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x10028e08
mov edx, dword [ebp + 0x1c]
mov dword [edx], esi
cmp dword [edx], 1
jg 0x10028ef3
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edi]
mov eax, dword [eax]
cmp dword [eax + ecx*4], esi
jne 0x10028ef3
inc dword [edx]
cmp dword [edx], 1
jle 0x10028e19
jmp 0x10028ef3
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x10028ef3
cmp byte [ebp + 0x10], 0
je 0x10028e68
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10028ef3
push 1
push 0x3d67
xor dl, dl
xor cl, cl
call fcn.100257c0
pop ecx
pop ecx
jmp 0x10028ef3
mov dword [ebp + 0x20], 0x223f
cmp dword [ebp + 0x20], 0x22bc
jle 0x10028ec0
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov eax, esi
mov ecx, 0x10079358
and eax, ebx
and eax, edi
cdq
push edx
push eax
call fcn.100033d6
inc esi
cmp esi, 0x723d
jl 0x10028e88
inc ebx
push 0
pop esi
cmp ebx, 0x7058
jl 0x10028e85
inc edi
cmp edi, 0x4bb8
jl 0x10028e83
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], 6
cmp dword [ebp + 0x20], 0x1ebc
jge 0x10028edf
mov edx, str.vmepq_njkr_xri_nqylxtu
mov ecx, 0x10079358
call fcn.1000562f
mov eax, dword [ebp + 0x24]
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 0xc93c
mov eax, dword [ebp + 0xc]
setge cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret