Function at 0x1400022cc
Capabilities:
Enumerate files on windows
Get memory capacity

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
call fcn.1400045fc
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
sub r8d, ecx
mov edi, r8d
lea rcx, [rbp + 0x120]
call fcn.14000135c
mov rbx, qword [rbp + 0x120]
mov rdx, rbx
test rdi, rdi
je 0x140002388
imul rcx, rdi, 0xf4240
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rdx, rax
jge 0x140002388
lea rbx, [rdx + rcx]
jmp 0x140002388
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914f0000
cmp rcx, rax
jl 0x140002357
mov ecx, 0x5265c00
jmp 0x140002383
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140002381
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x120]
call fcn.14000135c
mov rax, qword [rbp + 0x120]
cmp rax, rbx
jl 0x14000233b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400025a2
mov qword [rbp + 0x128], 8
lea rcx, [rbp + 0x128]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400023e2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x12c]
cmp eax, 0xea60
ja 0x1400025a2
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp - 0x78], 0xffffffff80000000
jb 0x1400025a2
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140002428
cmp dword [rbp + 0x130], 0
jne 0x140002428
cmp dword [rbp + 0x134], 0
je 0x1400025a2
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140020d90]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.C:Users.]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140020b98]
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000145c
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov ebx, 0x1000
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400024d4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x1400024cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025b5
call fcn.1400050ec
movdqa xmm0, xmmword [0x140020d50]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140002528
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x14000251b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025bb
call fcn.1400050ec
movdqa xmm0, xmmword [0x140020d50]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002568
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x140002563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025af
call fcn.1400050ec
cmp rdi, 0xffffffffffffffff
je 0x14000259e
xor ebx, ebx
test byte [rbp - 0x40], 0x10
lea eax, [rbx + 1]
cmovne eax, ebx
mov ebx, eax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002570
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
setl al
jmp 0x1400025a4
xor al, al
jmp 0x1400025a4
mov al, 1
add rsp, 0x200
pop rdi
pop rbx
pop rbp
ret
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
int3