Function at 0x14001de54
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x70
mov rbx, rcx
lea rax, [0x140059810]
mov qword [rcx], rax
lea rax, [0x14005a5f0]
mov qword [rcx + 8], rax
xor ebp, ebp
mov dword [rcx + 0x10], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea esi, [rbp + 1]
test eax, eax
je 0x14001deca
mov r8, qword [rsp + 0x20]
test r8, r8
je 0x14001deca
mov edx, ebp
mov ecx, ebp
mov rax, r8
shr rax, cl
and eax, esi
add edx, eax
add ecx, esi
cmp ecx, 0x40
jb 0x14001deb7
jmp 0x14001ded9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x50]
mov dword [rbx + 0x18], edx
mov dword [rbx + 0x1c], edx
mov byte [rbx + 0x20], bpl
mov eax, 0x80000000
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
movabs rdi, 0x100000000
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x14001df1a
mov sil, bpl
jmp 0x14001df2a
mov rdi, qword [rsp + 0x38]
cmp qword [rsp + 0x58], rdi
cmovb rdi, qword [rsp + 0x58]
mov byte [rbx + 0x21], sil
test sil, sil
je 0x14001df95
mov qword [rbx + 0x38], rdi
movabs rax, 0x333333333333333
cmp rdi, rax
movabs rax, 0x47ae147ae147ae15
ja 0x14001df6a
lea rcx, [rdi + rdi*4]
shl rcx, 4
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 6
jmp 0x14001df85
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
lea rcx, [rax + rax*4]
shl rcx, 4
mov qword [rbx + 0x28], rcx
shr rdi, 5
imul rax, rdi, 0x11
mov qword [rbx + 0x30], rax
lea rax, [0x14005a660]
mov qword [rbx], rax
lea rax, [0x14005a628]
mov qword [rbx + 8], rax
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0x60], rbp
mov qword [rbx + 0x68], rbp
mov qword [rbx + 0x70], rbp
mov qword [rbx + 0x78], rbp
mov qword [rbx + 0x80], rbp
mov qword [rbx + 0x88], rbp
mov qword [rbx + 0x90], rbp
mov qword [rbx + 0x98], rbp
mov qword [rbx + 0xa0], rbp
mov qword [rbx + 0xa8], rbp
mov qword [rbx + 0xb0], rbp
mov byte [rbx + 0xb8], bpl
mov dword [rbx + 0xbc], ebp
mov qword [rbx + 0xc0], rbp
mov qword [rbx + 0xc8], rbp
mov qword [rbx + 0xd0], rbp
mov qword [rbx + 0xd8], rbp
mov qword [rbx + 0xe0], rbp
mov qword [rbx + 0xe8], rbp
mov qword [rbx + 0xf0], rbp
mov qword [rbx + 0xf8], rbp
mov qword [rbx + 0x100], rbp
mov qword [rbx + 0x108], rbp
mov qword [rbx + 0x110], rbp
mov qword [rbx + 0x118], rbp
mov qword [rbx + 0x120], rbp
mov qword [rbx + 0x128], rbp
mov qword [rbx + 0x130], rbp
mov qword [rbx + 0x138], rbp
mov qword [rbx + 0x140], rbp
mov qword [rbx + 0x148], rbp
mov qword [rbx + 0x150], rbp
mov qword [rbx + 0x158], rbp
mov qword [rbx + 0x160], rbp
mov qword [rbx + 0x168], rbp
mov qword [rbx + 0x170], rbp
mov qword [rbx + 0x178], rbp
mov qword [rbx + 0x180], rbp
mov qword [rbx + 0x188], rbp
mov qword [rbx + 0x190], rbp
mov qword [rbx + 0x198], rbp
mov qword [rbx + 0x1a0], rbp
mov qword [rbx + 0x1d0], rbp
mov qword [rbx + 0x1d8], rbp
mov qword [rbx + 0x1e0], rbp
mov qword [rbx + 0x1e8], rbp
lea rcx, [rbx + 0x210]
call fcn.140002ca8
mov word [rbx + 0x208], bp
mov dword [rbx + 0x220], 4
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret