Function at 0x140001cd0
Capabilities:
Get memory capacity
Get system information on windows
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
mov dword [rbp + 0x40], 0x40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov qword [rbp + 0x74], rax
mov dword [rbp + 0x7c], eax
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x60], r14d
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0x30]
lea r8, str.SELECT__FROM_Win32_PerfRawData_PerfOS_Memory
lea rdx, [0x140026c10]
mov rax, qword [rax + 0xa0]
call qword [0x14001e410]
test eax, eax
js 0x140002323
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140002323
mov rax, qword [rcx]
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov esi, 1
mov r8d, esi
lea edx, [rsi - 2]
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
test eax, eax
js 0x140002323
cmp dword [rsp + 0x64], r14d
jbe 0x140002326
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.PagesInputPerSec
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
movzx ecx, word [rsp + 0x40]
test eax, eax
js 0x140001e20
cmp cx, si
je 0x140001e20
mov rdi, qword [rsp + 0x48]
jmp 0x140001e4f
cmp cx, 0x14
je 0x140001e43
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x14000239a
mov ecx, 0x14
mov word [rsp + 0x40], cx
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
mov word [rbx + 0x18], r14w
cmp cx, 0x14
je 0x140001e93
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x14
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023a5
mov rdi, qword [rbp - 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [rbp + 0x84]
imul rax, rdi
mov qword [rbx + 0x1a], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.PagesOutputPerSec
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
movzx ecx, word [rsp + 0x40]
test eax, eax
js 0x140001ee2
cmp cx, 1
je 0x140001ee2
mov rdi, qword [rsp + 0x48]
jmp 0x140001f11
cmp cx, 0x14
je 0x140001f05
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x1400023b0
mov ecx, 0x14
mov word [rsp + 0x40], cx
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
mov word [rbx + 0x22], si
cmp cx, 0x14
je 0x140001f54
lea rcx, [rbp - 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x14
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023bb
mov rdi, qword [rbp - 0x60]
lea rcx, [rbp - 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [rbp + 0x84]
imul rax, rdi
mov qword [rbx + 0x24], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.PageReadsPerSec
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
movzx ecx, word [rsp + 0x40]
test eax, eax
js 0x140001f9c
cmp cx, 1
jne 0x140001fc8
cmp cx, 0x14
je 0x140001fbf
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x1400023c6
mov ecx, 0x14
mov word [rsp + 0x40], cx
mov qword [rsp + 0x48], 0xffffffffffffffff
mov eax, 2
mov word [rbx + 0x2c], ax
mov r15d, 3
cmp cx, r15w
jne 0x140001fe3
mov edi, dword [rsp + 0x48]
jmp 0x140002018
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023d1
mov edi, dword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
movsxd rax, edi
mov qword [rbx + 0x2e], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.PageFaultsPerSec
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
movzx ecx, word [rsp + 0x40]
test eax, eax
js 0x140002059
cmp cx, 1
jne 0x140002085
cmp cx, 0x14
je 0x14000207c
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x1400023dc
mov ecx, 0x14
mov word [rsp + 0x40], cx
mov qword [rsp + 0x48], 0xffffffffffffffff
mov word [rbx + 0x36], r15w
cmp cx, 3
jne 0x140002096
mov edi, dword [rsp + 0x48]
jmp 0x1400020cb
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023e7
mov edi, dword [rbp - 0x30]
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
movsxd rax, edi
mov qword [rbx + 0x38], rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, 4
mov word [rbx + 0x40], ax
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x42], rax
mov eax, 5
mov word [rbx + 0x4a], ax
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x4c], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.CacheBytes
mov rax, qword [rax + 0x20]
call qword [0x14001e410]
test eax, eax
js 0x14000224c
cmp word [rsp + 0x40], 1
je 0x14000224c
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
test eax, eax
je 0x140002245
test byte [rsp + 0x60], 4
je 0x140002245
movzx eax, word [rsp + 0x40]
cmp ax, 0x15
jne 0x140002177
mov rdi, qword [rsp + 0x48]
jmp 0x1400021b5
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x15
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023f2
mov rdi, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
movzx eax, word [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
cmp rdi, rcx
jbe 0x140002255
cmp ax, 0x15
jne 0x1400021d8
mov rdi, qword [rsp + 0x48]
sub rdi, rcx
mov qword [rsp + 0x48], rdi
jmp 0x140002255
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x15
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400023fd
mov rdi, qword [rbp]
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
sub rdi, qword [rsp + 0x68]
movzx eax, word [rsp + 0x40]
cmp ax, 0x15
je 0x14000223e
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x140002408
mov eax, 0x15
mov word [rsp + 0x40], ax
mov qword [rsp + 0x48], rdi
jmp 0x140002255
movzx eax, word [rsp + 0x40]
jmp 0x140002255
movzx eax, r14w
mov word [rsp + 0x40], ax
mov ecx, 6
mov word [rbx + 0x54], cx
cmp ax, 0x15
jne 0x14000226b
mov rdi, qword [rsp + 0x48]
jmp 0x1400022a9
lea rcx, [rbp + 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x15
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x140002413
mov rdi, qword [rbp + 0x18]
lea rcx, [rbp + 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
movzx eax, word [rsp + 0x40]
shr rdi, 1
add rdi, qword [rbp + 0x50]
mov qword [rbx + 0x56], rdi
mov ecx, 7
mov word [rbx + 0x5e], cx
cmp ax, 0x15
jne 0x1400022ca
mov rdi, qword [rsp + 0x48]
jmp 0x140002303
lea rcx, [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 0x15
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14000238f
mov rdi, qword [rbp + 0x30]
lea rcx, [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rbx + 0x60], rdi
mov eax, 8
mov word [rbx + 0x68], ax
mov qword [rbx + 0x6a], r14
mov eax, 9
mov word [rbx + 0x72], ax
mov qword [rbx + 0x74], r14
jmp 0x140002326
mov esi, r14d
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000234a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140002361
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x14001e410]
mov eax, esi
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1400033b0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
nop
lfence
mov ecx, eax
call fcn.140003210
int3