Function at 0x44f9c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e6c9
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [esi], vtable.CStatistic.0
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fcf4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fcfe
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd08
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 2
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd12
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 3
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd1c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [ebp - 4], 4
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd26
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [ebp - 4], 5
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd30
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [ebp - 4], 6
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd3a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 7
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd44
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 8
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x44fd4e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x28], eax
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 9
call fcn.0045a4b0
cmp dword [0x4be080], 0
mov byte [ebp - 4], 0xa
je 0x44fc11
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push 0x483fbc
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44fc07
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x80]
push ecx
movups xmmword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x70], xmm0
call eax
mov ax, word [ebp - 0x80]
cmp ax, 9
je 0x44fbfd
cmp ax, 6
je 0x44fbfd
cmp ax, 0xc
je 0x44fbfd
push str.IsWow64Process2
push 0x484534
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x44fbf4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x44fbf4
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x54], cx
sete al
mov dword [0x4c2510], eax
jmp 0x44fc07
xor eax, eax
mov dword [0x4c2510], eax
jmp 0x44fc07
mov dword [0x4c2510], 1
mov dword [0x4be080], 0
cmp dword [0x4c2510], 0
mov edi, 0x484f20
mov eax, 0x484f28
cmove edi, eax
mov edx, edi
lea ecx, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44fc30
sub edx, ecx
lea ecx, [esi + 0x20]
sar edx, 1
push edx
push edi
call fcn.00416a50
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00432c40
add esp, 0xc
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp - 0x44]
lea eax, [esi + 0x24]
push dword [ebp - 0x48]
push str._lld
push eax
call fcn.00409e30
add esp, 0x10
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.SendData
push 1
lea ecx, [esi + 0x2c]
mov dword [0x4c3ae0], eax
mov eax, dword [ecx]
push 0x4c3ae4
push 0
push 0x450a50
call dword [eax + 4]
mov eax, dword [0x4c3ae0]
test eax, eax
je 0x44fcd7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4c3ae0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c3ae0], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
int3