Function at 0x44ce28
Capabilities:
Get memory capacity
Get system information on windows
Identify system language via api

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
xor r14d, r14d
mov r10, rdx
test rdx, rdx
je 0x44d5ad
test r8, r8
je 0x44d5ad
cmp word [r8], r14w
je 0x44d5ad
test r9, r9
je 0x44d5ad
cmp word [r9], r14w
je 0x44d5ad
lea edx, [r14 + 0x7f]
lea rcx, [0x004dbf0a]
mov r11d, edx
sub r10, rcx
lea rax, [r11 + 0x7fffff7f]
test rax, rax
je 0x44ceb5
movzx eax, word [r10 + rcx]
test ax, ax
je 0x44ceb5
mov word [rcx], ax
add rcx, 2
sub r11, 1
jne 0x44ce92
test r11, r11
lea rax, [rcx - 2]
mov r10d, 0x27
cmovne rax, rcx
lea rcx, [0x004dc00a]
sub r8, rcx
mov word [rax], r14w
lea rax, [r10 + 0x7fffffd7]
test rax, rax
je 0x44cef7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x44cef7
mov word [rcx], ax
add rcx, 2
sub r10, 1
jne 0x44ced4
test r10, r10
lea rax, [rcx - 2]
cmovne rax, rcx
lea rcx, [0x004dc05a]
sub r9, rcx
mov word [rax], r14w
lea rax, [rdx + 0x7fffff7f]
test rax, rax
je 0x44cf33
movzx eax, word [rcx + r9]
test ax, ax
je 0x44cf33
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x44cf10
test rdx, rdx
lea rax, [rcx - 2]
mov r12d, 0x100
lea r15, str.SOFTWAREMetaQuotes_Software
cmovne rax, rcx
mov r13, 0xffffffff80000001
mov word [rax], r14w
cmp word [0x004dc15a], r14w
mov word [0x004e0aca], r14w
mov qword [0x004e0d28], r14
mov word [0x004e0bca], r14w
mov word [0x004e0c1a], r14w
jne 0x44d293
cmp byte [rbp + 0x590], r14b
je 0x44d293
lea rax, [0x00499e30]
or rsi, 0xffffffffffffffff
mov rbx, rsi
mov qword [rsp + 0x40], rax
lea r8d, [r12 + 3]
mov qword [rsp + 0x48], rbx
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44d274
cmp word [rbp + 0xc0], r14w
je 0x44d274
lea rdi, [0x004dc15a]
mov r8, rdi
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.00478a68
test al, al
je 0x44d26f
xor r8d, r8d
mov rdx, rdi
call fcn.0044c728
xor edx, edx
lea r8d, [r12 - 0x80]
lea rcx, [rbp - 0x80]
call fcn.00424830
lea r9, [rbp - 0x80]
mov dword [rsp + 0x20], 0x3f
lea r8, str.utm_cookie
mov rdx, rdi
call fcn.00448b54
test al, al
je 0x44d057
lea rcx, [rbp - 0x80]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x44d036
cmp rax, 8
jb 0x44d057
lea rcx, [rbp - 0x80]
call fcn.00436f70
cmp rax, 0x2710
jge 0x44d05c
mov word [rbp - 0x80], r14w
lea r9, [rbp + 0xc0]
mov dword [rsp + 0x20], 0x103
lea r8, str.utm_cookie_expiration
mov rdx, rdi
call fcn.00448b54
test al, al
je 0x44d0ba
cmp word [rbp + 0xc0], r14w
je 0x44d0ba
lea rcx, [rbp + 0xc0]
call fcn.00436f70
xor ecx, ecx
mov rbx, rax
call fcn.004370d4
lea rcx, [rax - 0x1c20]
cmp rbx, rcx
jl 0x44d0b5
cmp rbx, rax
jg 0x44d0b5
movzx eax, word [rbp - 0x80]
jmp 0x44d0c2
mov eax, r14d
jmp 0x44d0be
movzx eax, r14w
mov word [rbp - 0x80], ax
test ax, ax
je 0x44d26f
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x80
call fcn.00424830
lea rbx, [0x0048d8c4]
mov dword [rsp + 0x28], r12d
mov r8, rbx
mov dword [rsp + 0x20], 0x7e
lea r9, [rbp]
mov rdx, r15
mov rcx, 0xffffffff80000002
call fcn.00404704
test al, al
je 0x44d11b
lea rcx, [rbp]
call fcn.00436f70
cmp rax, 0x2710
jge 0x44d14f
mov dword [rsp + 0x28], r12d
lea r9, [rbp]
mov r8, rbx
mov dword [rsp + 0x20], 0x7e
mov rdx, r15
mov rcx, r13
call fcn.00404704
test al, al
je 0x44d155
lea rcx, [rbp]
call fcn.00436f70
cmp rax, 0x2710
jl 0x44d155
movzx eax, word [rbp]
jmp 0x44d15c
mov eax, r14d
mov word [rbp], ax
test ax, ax
je 0x44d187
lea r9, [rbp + 0xc0]
mov dword [rsp + 0x20], 0x103
lea r8, [0x0048ccd0]
mov rdx, rdi
call fcn.00448b54
test al, al
je 0x44d26f
lea rax, [rbp]
lea r8, [rbp - 0x80]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x44d1a6
add rax, 2
test edx, edx
jne 0x44d192
test ecx, ecx
je 0x44d26f
lea rax, [rbp + 0x570]
mov qword [rbp + 0x570], r14
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44d1f0
mov rcx, qword [rbp + 0x570]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44d1fb
mov rdx, r15
mov rcx, rdi
call fcn.00404678
lea rax, [rbp - 0x80]
mov r8, rbx
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.004045c0
lea rax, [rbp + 0x578]
mov qword [rbp + 0x578], r14
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44d24d
mov rcx, qword [rbp + 0x578]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44d258
mov rdx, r15
mov rcx, r13
call fcn.00404678
lea rax, [rbp - 0x80]
mov r8, rbx
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, r13
call fcn.004045c0
mov rbx, qword [rsp + 0x48]
lea rax, [0x00486230]
mov qword [rsp + 0x40], rax
cmp rbx, rsi
je 0x44d293
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], rsi
cmp word [0x004dd15a], r14w
jne 0x44d5a2
lea rax, [rbp + 0x328]
mov dword [rbp + 0x320], r14d
mov qword [rbp + 0x318], rax
lea rcx, [rbp + 0x80]
lea rax, [0x004837b0]
mov dword [rbp + 0x324], r12d
mov qword [rbp + 0x310], rax
mov word [rbp + 0x328], r14w
mov dword [rbp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x44d2f3
mov esi, r14d
jmp 0x44d2fe
mov rsi, qword [rbp + 0x88]
shr rsi, 0x14
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
lea r8, [rbp + 0x2d0]
call fcn.00458194
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x2d0]
call fcn.00452188
mov rdi, qword [rbp + 0x318]
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x38], rdi
lea ecx, [rsi + 0xff]
and ecx, 0xfffff00
lea rsi, [0x004dd15a]
mov dword [rsp + 0x30], ecx
lea r8, str.modeldesktopscr_res_dx_dcpu_umemory_ul_s
mov ecx, dword [rsp + 0x70]
mov edi, 0x1ff
mov dword [rsp + 0x28], ecx
mov r9d, eax
mov rcx, rsi
mov dword [rsp + 0x20], ebx
mov edx, edi
call fcn.0040457c
mov rbx, 0xffffffff80000002
mov dword [rsp + 0x28], r12d
mov rcx, rbx
mov dword [rsp + 0x20], 0x206
lea r9, [rbp + 0xc0]
lea r8, str.SystemManufacturer
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
call fcn.00404704
test al, al
je 0x44d41c
lea rdx, [rbp + 0xc0]
call fcn.00448844
cmp rax, 3
jbe 0x44d41c
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0xc0]
call fcn.00452188
lea r8, str.model_vendor
mov edx, edi
mov rcx, rsi
call fcn.004044ac
mov r8, qword [rbp + 0x318]
mov edx, edi
mov rcx, rsi
call fcn.004044ac
mov dword [rsp + 0x28], r12d
lea r9, [rbp + 0xc0]
lea r8, [0x0048d810]
mov dword [rsp + 0x20], 0x206
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, rbx
call fcn.00404704
test al, al
je 0x44d493
lea rdx, [rbp + 0xc0]
call fcn.00448844
cmp rax, 3
jbe 0x44d493
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0xc0]
call fcn.00452188
lea r8, str.model_device
mov rdx, rdi
mov rcx, rsi
call fcn.004044ac
mov r8, qword [rbp + 0x318]
mov rdx, rdi
mov rcx, rsi
call fcn.004044ac
xor ecx, ecx
call fcn.004370d4
lea r9, [rbp + 0xc0]
mov dword [rsp + 0x28], r12d
lea r8, str.Install.Time
mov dword [rsp + 0x20], 0x206
mov rdx, r15
mov rcx, r13
mov rbx, rax
call fcn.00404704
test al, al
je 0x44d4f5
cmp word [rbp + 0xc0], r14w
je 0x44d4f5
lea rcx, [rbp + 0xc0]
call fcn.00436f70
cmp rax, rbx
cmovg rax, rbx
lea rcx, [rax + 0x128a1800]
cmp rcx, rbx
cmovl rax, rbx
mov rbx, rax
mov r9, rbx
lea r8, str.fv_date_I64d
mov edx, 0x103
lea rcx, [rbp + 0xc0]
call fcn.0040457c
lea r8, [rbp + 0xc0]
mov rdx, rdi
mov rcx, rsi
call fcn.004044ac
lea r9, [rbp + 0xc0]
mov dword [rsp + 0x28], r12d
lea r8, [0x0048ce10]
mov dword [rsp + 0x20], 0x206
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAdvertisingInfo
mov rcx, r13
call fcn.00404704
test al, al
jne 0x44d586
lea rdx, [rbp + 0xc0]
call fcn.00448844
cmp rax, 0x10
jbe 0x44d586
lea r8, str.advid
mov rdx, rdi
mov rcx, rsi
call fcn.004044ac
lea r8, [rbp + 0xc0]
mov rdx, rdi
mov rcx, rsi
call fcn.004044ac
lea rcx, [0x004837b8]
mov qword [rbp + 0x318], r14
mov qword [rbp + 0x310], rcx
mov dword [rbp + 0x320], r14d
mov byte [0x004dbe08], 1
mov al, 1
jmp 0x44d5af
xor al, al
mov rbx, qword [rsp + 0x680]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret