Function at 0x140003470
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x804
cmp ax, cx
jne 0x14000370b
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, 0x77777777
imul dword [rbp]
sub edx, dword [rbp]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 8
jne 0x14000370b
call fcn.140023050
mov rdx, qword [rax]
mov rdx, qword [rdx]
lea rcx, [rbp - 0x80]
call fcn.140003ac0
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x68]
cmp rbx, 1
jb 0x14000353a
lea rax, [rbx - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x5c
jne 0x14000352b
mov eax, esi
test eax, eax
je 0x140003535
cmp rcx, rdx
je 0x14000353a
dec rcx
jmp 0x140003520
sub rcx, rdx
jmp 0x140003541
mov rcx, 0xffffffffffffffff
dec rbx
movsxd rdi, ecx
inc rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov ecx, 0x10
call fcn.140005950
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rax, qword [rbp - 0x68]
cmp rax, rdi
jb 0x140003735
sub rax, rdi
cmp rax, rbx
cmovb rbx, rax
lea r9, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r9, qword [rbp - 0x78]
add r9, rdi
cmp rbx, 0xf
ja 0x1400035e4
mov qword [rsp + 0x70], rbx
mov r8, rbx
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000f0e0
mov byte [rsp + rbx + 0x60], 0
jmp 0x1400035f5
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400048d0
nop
cmp qword [rsp + 0x70], 9
ja 0x1400036cb
mov dword [rbp - 0x40], 0x40
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rbx, qword [rbp - 0x38]
shr rbx, 0x14
lea rdx, str.check_RAM
lea rcx, [0x1400bf720]
call fcn.140004570
mov rcx, rax
call fcn.140004830
cmp ebx, 0x417
jb 0x1400036cb
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x54]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp - 0x44]
mov ecx, dword [rbp - 0x48]
imul rax, rcx
mov ecx, dword [rbp - 0x4c]
imul rax, rcx
imul rax, qword [rbp - 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x27
mov ebx, 1
jae 0x1400036cd
mov ebx, esi
lea rcx, [rsp + 0x58]
call fcn.140003d70
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
mov edx, 0x10
call fcn.140004d80
nop
lea rcx, [rbp - 0x80]
call fcn.140003d70
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x80], rsi
mov edx, 0x10
call fcn.140004d80
mov eax, ebx
jmp 0x14000370d
xor eax, eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140005910
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400043c0
nop
int3