Function at 0x140002ef8
Capabilities:
Enumerate files on windows
Get memory capacity

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
call fcn.140005b30
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
sub r8d, ecx
mov edi, r8d
lea rcx, [rbp + 0x120]
call fcn.140001f0c
mov rbx, qword [rbp + 0x120]
mov rdx, rbx
test rdi, rdi
je 0x140002fb8
imul rcx, rdi, 0xf4240
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rdx, rax
jge 0x140002fb8
lea rbx, [rdx + rcx]
jmp 0x140002fb8
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914f0000
cmp rcx, rax
jl 0x140002f87
mov ecx, 0x5265c00
jmp 0x140002fb3
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140002fb1
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x120]
call fcn.140001f0c
mov rax, qword [rbp + 0x120]
cmp rax, rbx
jl 0x140002f6b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14000321c
mov qword [rbp + 0x128], 8
lea rcx, [rbp + 0x128]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x140003012
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x12c]
cmp eax, 0xea60
ja 0x14000321c
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp - 0x78], 0xffffffff80000000
jb 0x14000321c
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140003058
cmp dword [rbp + 0x130], 0
jne 0x140003058
cmp dword [rbp + 0x134], 0
je 0x14000321c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140023120]
movdqu xmmword [rsp + 0x30], xmm1
movsd xmm0, qword [str.C:Users.]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x140022c68]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x2c], 0
mov al, byte [0x140029c20]
mov byte [rbp + 0x120], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x14000322f
mov rax, qword [rcx]
lea r9, [rbp + 0x120]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029d68]
test rcx, rcx
je 0x140003235
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov ebx, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000313b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x140003136
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000323b
call fcn.1400072a8
movdqa xmm0, xmmword [0x1400230e0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000318f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x140003182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003241
call fcn.1400072a8
movdqa xmm0, xmmword [0x1400230e0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400031d7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x1400031ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003229
call fcn.1400072a8
movdqa xmm0, xmmword [0x1400230e0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
cmp rdi, 0xffffffffffffffff
je 0x140003218
xor ebx, ebx
test byte [rbp - 0x40], 0x10
lea eax, [rbx + 1]
cmovne eax, ebx
mov ebx, eax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400031ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
setl al
jmp 0x14000321e
xor al, al
jmp 0x14000321e
mov al, 1
add rsp, 0x200
pop rdi
pop rbx
pop rbp
ret
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
int3
call fcn.14000d1a0
nop
call fcn.14000d1a0
int3
jmp 0x140002ef8