Function at 0x1401641c0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
xor esi, esi
mov dword [rcx + 0xbc], esi
mov qword [rcx + 0xc8], rsi
mov qword [rcx + 0xd0], rsi
mov dword [rcx + 0xd8], esi
lea r9, [rcx + 0xe8]
lea r8, [rcx + 0xe4]
lea rdx, [rcx + 0xe0]
add rcx, 0xdc
call fcn.1401640c0
mov qword [rbx + 0xec], rsi
mov qword [rbx + 0xf4], rsi
mov dword [rbx + 0x100], 0x7fffffff
mov dword [rbx + 0xfc], 0x7fffffff
mov qword [rbx + 0x104], rsi
mov qword [rbx + 0x10c], rsi
mov qword [rbx + 0x114], rsi
mov dword [rbx + 0x11c], 0xc8
mov dword [rbx + 0x120], 0x64
mov dword [rbx + 0x124], 0x64
mov dword [rbx + 0x128], 0x12c
mov dword [rbx + 0x12c], 0x64
mov dword [rbx + 0x130], 0x64
mov dword [rbx + 0x134], ILFree
mov dword [rbx + 0x138], ILFree
mov dword [rbx + 0x13c], 0x46
mov dword [rbx + 0x140], 0x46
mov dword [rbx + 0x144], 0x46
mov dword [rbx + 0x148], 0x32
mov dword [rbx + 0x14c], 0x64
mov dword [rbx + 0x150], 0x64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x154], xmm0
movups xmmword [rbx + 0x164], xmm0
mov qword [rbx + 0x174], rax
mov qword [rbx + 0x17c], rax
mov qword [rbx + 0x184], rsi
mov qword [rbx + 0x18c], 1
call fcn.140022780
mov ecx, esi
cmp eax, 0xb
setl cl
mov dword [rbx + 0x194], ecx
mov qword [rbx + 0x198], 1
call fcn.1401285c0
mov ecx, esi
cmp dword [rax + 0xc], 0xb
setge cl
mov dword [rbx + 0x1a0], ecx
mov dword [rbx + 0x1a4], esi
mov dword [rbx + 0x1a8], 1
lea rcx, [rbx + 0x1b0]
lea rdx, str.default
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], si
jne 0x140164380
call fcn.140018f70
mov dword [rbx + 0x1b8], esi
lea r14, [0x140262520]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.140028470
nop
lea rcx, [rbx + 0x1c0]
mov rdx, rax
call fcn.140017ba0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401643df
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov dword [rbx + 0x1c8], esi
mov dword [rbx + 0x1cc], 1
mov dword [rbx + 0x1d0], 1
mov qword [rbx + 0x1d4], 1
mov qword [rbx + 0x1dc], rsi
mov qword [rbx + 0x1e4], 1
mov dword [rbx + 0x1ec], esi
mov eax, dword [0x14030fbb4]
test eax, eax
jne 0x140164445
mov dword [rbp - 0x70], 0x40
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp - 0x68]
shr rax, 0x14
mov dword [0x14030fbb4], eax
cmp eax, 0x7d0
jl 0x140164455
mov eax, 1
mov ecx, esi
jmp 0x14016445c
mov eax, esi
mov ecx, 1
mov dword [rbx + 0x1f0], ecx
mov dword [rbx + 0x1f4], eax
call fcn.1401285c0
cmp byte [rax + 0x11], 0
jne 0x14016447e
call fcn.1400dfe10
cmp byte [rax + 0x14], 0
je 0x140164489
mov qword [rbx + 0x1f0], 1
mov dword [rbx + 0x1f8], 6
mov ecx, dword [0x14030fbb4]
test ecx, ecx
jne 0x1401644bc
mov dword [rbp - 0x30], 0x40
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rbp - 0x28]
shr rcx, 0x14
mov dword [0x14030fbb4], ecx
mov eax, esi
cmp ecx, 0x1770
setge al
mov dword [rbx + 0x1fc], eax
mov qword [rbx + 0x200], 1
mov qword [rbx + 0x208], rsi
mov qword [rbx + 0x210], rsi
mov qword [rbx + 0x218], rsi
mov qword [rbx + 0x220], rsi
mov qword [rbx + 0x228], 1
mov qword [rbx + 0x230], rsi
mov qword [rbx + 0x238], 1
mov qword [rbx + 0x240], 1
mov dword [rbx + 0x248], esi
lea rcx, [rbx + 0x250]
lea rdx, str._NAME__Y__m__d__H__M__S.zip
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140164533
call fcn.140018f70
mov qword [rbx + 0x258], 1
mov qword [rbx + 0x260], rsi
mov qword [rbx + 0x268], rsi
mov qword [rbx + 0x270], rsi
mov dword [rbx + 0x278], 1
mov qword [rbx + 0x27c], 1
mov dword [rbx + 0x284], 1
call fcn.1400dfe10
cmp dword [rax + 0x10], 0
jne 0x14016459d
call fcn.1400dfe10
cmp byte [rax + 0x14], 0
mov eax, 1
je 0x14016459f
mov eax, esi
mov dword [rbx + 0x288], eax
mov qword [rbx + 0x28c], 1
mov dword [rbx + 0x294], esi
mov dword [rbx + 0x298], 1
mov qword [rbx + 0x29c], 1
call fcn.140022780
cmp eax, 0x12
jl 0x14016464f
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140164d33
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r15, [0x1402a4e10]
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140018bd0
test al, al
jne 0x14016463a
mov r8, rdi
inc r8
cmp word [r15 + r8*2], 0
jne 0x140164621
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140018f70
nop
lea rcx, [rsp + 0x20]
call fcn.1401aac10
cmp eax, 1
jne 0x14016464f
mov dword [rbx + 0x2a0], eax
mov dword [rbx + 0x2a4], esi
mov qword [rbx + 0x2a8], 1
mov dword [rbx + 0x2b0], esi
lea rcx, [rbx + 0x2b8]
lea rdx, str..exe__.msi__.htm__.html_
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140164680
call fcn.140018f70
mov qword [rbx + 0x2c0], 1
mov dword [rbx + 0x2c8], 1
mov dword [rbx + 0x2cc], 1
mov dword [rbx + 0x2d0], 1
mov dword [rbx + 0x2d4], 1
mov dword [rbx + 0x2d8], 1
mov dword [rbx + 0x2dc], 1
mov dword [rbx + 0x2e0], 6
mov dword [rbx + 0x2e4], 1
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140028470
nop
lea rcx, [rbx + 0x2e8]
mov rdx, rax
call fcn.140017ba0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14016472d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov dword [rbx + 0x2f0], esi
lea rcx, [rbx + 0x2f8]
lea rdx, str..bak__.tmp_
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140164744
call fcn.140018f70
mov dword [rbx + 0x300], esi
call fcn.1401285c0
mov ecx, esi
cmp dword [rax + 0x120], 2
sete cl
mov dword [rbx + 0x304], ecx
call fcn.1400dfe10
mov ecx, esi
cmp dword [rax + 0x10], esi
sete cl
mov dword [rbx + 0x308], ecx
mov qword [rbx + 0x30c], rsi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x314], xmm0
movups xmmword [rbx + 0x324], xmm0
movups xmmword [rbx + 0x334], xmm0
movups xmmword [rbx + 0x344], xmm0
movups xmmword [rbx + 0x354], xmm0
mov qword [rbx + 0x364], rax
mov qword [rbx + 0x36c], rax
movups xmmword [rbx + 0x374], xmm0
movups xmmword [rbx + 0x384], xmm0
movups xmmword [rbx + 0x394], xmm0
movups xmmword [rbx + 0x3a4], xmm0
movups xmmword [rbx + 0x3b4], xmm0
mov qword [rbx + 0x3c4], rax
mov qword [rbx + 0x3cc], rax
movups xmmword [rbx + 0x3d4], xmm0
movups xmmword [rbx + 0x3e4], xmm0
movups xmmword [rbx + 0x3f4], xmm0
movups xmmword [rbx + 0x404], xmm0
movups xmmword [rbx + 0x414], xmm0
mov qword [rbx + 0x424], rax
mov dword [rbx + 0x42c], eax
call fcn.1400dfe10
mov ecx, dword [rax + 0x10]
neg ecx
sbb eax, eax
add eax, 2
mov dword [rbx + 0x430], eax
mov dword [rbx + 0x434], 1
mov dword [rbx + 0x438], 1
mov dword [rbx + 0x43c], 1
mov dword [rbx + 0x440], 1
mov qword [rbx + 0x444], 1
mov qword [rbx + 0x44c], rsi
mov qword [rbx + 0x454], rsi
mov dword [rbx + 0x45c], esi
lea rcx, [rbx + 0x460]
lea rdx, str.notepad.exe
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140164890
call fcn.140018f70
mov qword [rbx + 0x468], 0xd77100
mov qword [rbx + 0x470], 0xffffff
mov dword [rbx + 0x478], esi
mov dword [rbx + 0x47c], 1
mov dword [rbx + 0x480], 1
mov dword [rbx + 0x484], 1
mov dword [rbx + 0x488], 1
mov dword [rbx + 0x48c], 1
mov dword [rbx + 0x490], 1
mov dword [rbx + 0x494], 1
mov dword [rbx + 0x498], 1
mov dword [rbx + 0x49c], 1
call fcn.140022780
cmp eax, 0x11
jge 0x140164926
mov dword [rbx + 0x494], esi
mov dword [rbx + 0x4a0], 1
call fcn.1401285c0
mov ecx, esi
cmp dword [rax + 0x120], 2
sete cl
mov dword [rbx + 0x4a4], ecx
mov dword [rbx + 0x4a8], 1
mov qword [rbx + 0x4ac], 0xa
lea rcx, [rsp + 0x38]
call fcn.140022ed0
nop
lea rcx, [rbx + 0x4b8]
mov rdx, rax
call fcn.140017ba0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14016499c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov dword [rbx + 0x4c0], esi
lea rcx, [rbx + 0x4c8]
lea rdx, str..cbr_.cbz_.ear
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401649b3
call fcn.140018f70
mov dword [rbx + 0x4d0], esi
mov dword [rbx + 0x4d4], 1
mov dword [rbx + 0x4d8], 1
mov qword [rbx + 0x4dc], 1
mov qword [rbx + 0x4e4], 1
mov dword [rbx + 0x4ec], 1
mov eax, dword [0x14030fbb4]
test eax, eax
jne 0x140164a26
mov dword [rbp + 0x10], 0x40
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x18]
shr rax, 0x14
mov dword [0x14030fbb4], eax
cmp eax, 0xfa0
jl 0x140164a50
call fcn.140022780
cmp eax, 0xa
jle 0x140164a50
cmp eax, 0xd
je 0x140164a50
cmp eax, 0x10
je 0x140164a50
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140164a56
mov dword [rbx + 0x4ec], esi
mov qword [rbx + 0x4f0], 1
mov dword [rbx + 0x4f8], esi
mov dword [rbx + 0x4fc], 1
mov qword [rbx + 0x500], 1
lea rcx, [rbx + 0x510]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140164a90
mov rdx, r14
call fcn.140018f70
lea rcx, [rbx + 0x518]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140164ab0
mov rdx, r14
call fcn.140018f70
lea rcx, [rbx + 0x520]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140164ad0
mov rdx, r14
call fcn.140018f70
mov qword [rbx + 0x528], rsi
mov qword [rbx + 0x530], rsi
mov qword [rbx + 0x538], rsi
mov qword [rbx + 0x540], rsi
mov dword [rbx + 0x548], 1
mov qword [rbx + 0x54c], 1
mov dword [rbx + 0x554], 1
mov qword [rbx + 0x558], 0x20000000
mov qword [rbx + 0x560], 1
mov dword [rbx + 0x568], esi
mov dword [rbx + 0x570], esi
lea rcx, [rbx + 0x578]
call fcn.140018ce0
lea rcx, [rbx + 0x580]
call fcn.140018ce0
lea rcx, [rbx + 0x588]
call fcn.140018ce0
lea rcx, [rbx + 0x590]
call fcn.140018ce0
lea rcx, [rbx + 0x598]
call fcn.140018ce0
mov qword [rbx + 0x5a0], rsi
mov dword [rbx + 0x5a8], esi
mov qword [rbx + 0x5ac], 1
mov dword [rbx + 0x5b4], esi
lea rcx, [rbx + 0x5b8]
call fcn.140029c30
mov qword [rbx + 0x5e8], rsi
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140028470
nop
lea rcx, [rbx + 0x5f0]
mov rdx, rax
call fcn.140017ba0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140164bf0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov dword [rbx + 0x5f8], esi
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140028470
nop
lea rcx, [rbx + 0x600]
mov rdx, rax
call fcn.140017ba0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140164c37
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov qword [rbx + 0x608], rsi
mov qword [rbx + 0x610], 0x12c
mov dword [rbx + 0x618], esi
mov dword [rbx + 0x61c], 1
mov qword [rbx + 0x620], 1
mov qword [rbx + 0x628], rsi
mov dword [rbx + 0x630], 0x80
mov dword [rbx + 0x634], 1
mov qword [rbx + 0x638], 1
cmp dword [rbx + 0xb8], 0
je 0x140164ccb
xor ecx, ecx
call fcn.140209900
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140209c74
imul ecx, dword [rsp + 0x74], 0x64
mov eax, dword [rsp + 0x70]
add eax, 0x2e631
add ecx, eax
imul eax, ecx, 0x64
add eax, dword [rsp + 0x6c]
mov dword [rbx + 0x63c], eax
mov qword [rbx + 0x640], rsi
lea rcx, [rbx + 0x648]
call fcn.140018ce0
lea rcx, [rbx + 0x650]
call fcn.140018ce0
mov dword [rbx + 0x658], esi
lea rcx, [rbx + 0x660]
call fcn.140029c30
mov qword [rbx + 0x690], rsi
mov qword [rbx + 0x698], rsi
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
int3