Function at 0x140002ec4
Capabilities:
Enumerate files on windows
Get memory capacity

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
call fcn.140004abc
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
sub r8d, ecx
mov edi, r8d
lea rcx, [rbp + 0x120]
call fcn.140001f0c
mov rbx, qword [rbp + 0x120]
mov rdx, rbx
test rdi, rdi
je 0x140002f84
imul rcx, rdi, 0xf4240
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rdx, rax
jge 0x140002f84
lea rbx, [rdx + rcx]
jmp 0x140002f84
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914f0000
cmp rcx, rax
jl 0x140002f53
mov ecx, 0x5265c00
jmp 0x140002f7f
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140002f7d
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x120]
call fcn.140001f0c
mov rax, qword [rbp + 0x120]
cmp rax, rbx
jl 0x140002f37
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400031e8
mov qword [rbp + 0x128], 8
lea rcx, [rbp + 0x128]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x140002fde
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x12c]
cmp eax, 0xea60
ja 0x1400031e8
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp - 0x78], 0xffffffff80000000
jb 0x1400031e8
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140003024
cmp dword [rbp + 0x130], 0
jne 0x140003024
cmp dword [rbp + 0x134], 0
je 0x1400031e8
mov cl, byte [0x14002a108]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140022170]
movdqu xmmword [rsp + 0x30], xmm1
movsd xmm0, qword [str.C:Users.]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x140021c78]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x2c], 0
mov byte [rbp + 0x120], cl
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x1400031fb
mov rax, qword [rcx]
lea r9, [rbp + 0x120]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028d78]
test rcx, rcx
je 0x140003201
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov ebx, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003107
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x140003102
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003207
call fcn.1400062f8
movdqa xmm0, xmmword [0x140022150]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000315b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x14000314e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000320d
call fcn.1400062f8
movdqa xmm0, xmmword [0x140022150]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400031a3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x140003196
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031f5
call fcn.1400062f8
movdqa xmm0, xmmword [0x140022150]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
cmp rdi, 0xffffffffffffffff
je 0x1400031e4
xor ebx, ebx
test byte [rbp - 0x40], 0x10
lea eax, [rbx + 1]
cmovne eax, ebx
mov ebx, eax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400031b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
setl al
jmp 0x1400031ea
xor al, al
jmp 0x1400031ea
mov al, 1
add rsp, 0x200
pop rdi
pop rbx
pop rbp
ret
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
call fcn.14000c3ec
nop
call fcn.14000c3ec
int3
jmp 0x140002ec4