Function at 0x1401672f0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rbx, rcx
xor esi, esi
mov dword [rcx + 0xbc], esi
mov qword [rcx + 0xc8], rsi
mov qword [rcx + 0xd0], rsi
mov dword [rcx + 0xd8], esi
lea r9, [rcx + 0xe8]
lea r8, [rcx + 0xe4]
lea rdx, [rcx + 0xe0]
add rcx, 0xdc
call fcn.1401671f0
mov qword [rbx + 0xec], rsi
mov qword [rbx + 0xf4], rsi
mov dword [rbx + 0x100], 0x7fffffff
mov dword [rbx + 0xfc], 0x7fffffff
mov qword [rbx + 0x104], rsi
mov qword [rbx + 0x10c], rsi
mov qword [rbx + 0x114], rsi
mov dword [rbx + 0x11c], 0xc8
mov dword [rbx + 0x120], 0x64
mov dword [rbx + 0x124], 0x64
mov dword [rbx + 0x128], 0x12c
mov dword [rbx + 0x12c], 0x64
mov dword [rbx + 0x130], 0x64
mov dword [rbx + 0x134], ILFree
mov dword [rbx + 0x138], ILFree
mov dword [rbx + 0x13c], 0x46
mov dword [rbx + 0x140], 0x46
mov dword [rbx + 0x144], 0x46
mov dword [rbx + 0x148], 0x32
mov dword [rbx + 0x14c], 0x64
mov dword [rbx + 0x150], 0x64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x154], xmm0
movups xmmword [rbx + 0x164], xmm0
mov qword [rbx + 0x174], rax
mov qword [rbx + 0x17c], rax
mov qword [rbx + 0x184], rsi
mov qword [rbx + 0x18c], 1
call fcn.140022880
mov ecx, esi
cmp eax, 0xb
setl cl
mov dword [rbx + 0x194], ecx
mov qword [rbx + 0x198], 1
call fcn.14012bfe0
mov ecx, esi
cmp dword [rax + 0xc], 0xb
setge cl
mov dword [rbx + 0x1a0], ecx
mov dword [rbx + 0x1a4], esi
mov dword [rbx + 0x1a8], 1
lea rcx, [rbx + 0x1b0]
lea rdx, str.default
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rdx + r8*2], si
jne 0x1401674b2
call fcn.140018f50
mov dword [rbx + 0x1b8], esi
lea r14, [0x140267540]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1400285a0
nop
lea rcx, [rbx + 0x1c0]
mov rdx, rax
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140167511
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov dword [rbx + 0x1c8], esi
mov dword [rbx + 0x1cc], 1
mov dword [rbx + 0x1d0], 1
mov qword [rbx + 0x1d4], 1
mov qword [rbx + 0x1dc], rsi
mov qword [rbx + 0x1e4], 1
mov dword [rbx + 0x1ec], esi
mov r12d, 0x40
mov eax, dword [0x140315cb4]
test eax, eax
jne 0x14016757a
mov dword [rbp - 0x70], r12d
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp - 0x68]
shr rax, 0x14
mov dword [0x140315cb4], eax
cmp eax, 0x7d0
jl 0x14016758a
mov eax, 1
mov ecx, esi
jmp 0x140167591
mov eax, esi
mov ecx, 1
mov dword [rbx + 0x1f0], ecx
mov dword [rbx + 0x1f4], eax
call fcn.14012bfe0
cmp byte [rax + 0x11], 0
jne 0x1401675b3
call fcn.1400e2200
cmp byte [rax + 0x14], 0
je 0x1401675be
mov qword [rbx + 0x1f0], 1
mov dword [rbx + 0x1f8], 6
mov ecx, dword [0x140315cb4]
test ecx, ecx
jne 0x1401675ee
mov dword [rbp - 0x30], r12d
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rbp - 0x28]
shr rcx, 0x14
mov dword [0x140315cb4], ecx
mov eax, esi
cmp ecx, 0x1770
setge al
mov dword [rbx + 0x1fc], eax
mov qword [rbx + 0x200], 1
mov qword [rbx + 0x208], rsi
mov qword [rbx + 0x210], rsi
mov qword [rbx + 0x218], rsi
mov qword [rbx + 0x220], rsi
mov qword [rbx + 0x228], 1
mov qword [rbx + 0x230], rsi
mov qword [rbx + 0x238], 1
mov qword [rbx + 0x240], 1
mov dword [rbx + 0x248], esi
lea rcx, [rbx + 0x250]
lea rdx, str._NAME__Y__m__d__H__M__S.zip
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140167665
call fcn.140018f50
mov qword [rbx + 0x258], 1
mov qword [rbx + 0x260], rsi
mov qword [rbx + 0x268], rsi
mov qword [rbx + 0x270], rsi
mov dword [rbx + 0x278], 1
mov qword [rbx + 0x27c], 1
mov dword [rbx + 0x284], 1
call fcn.1400e2200
cmp dword [rax + 0x10], 0
jne 0x1401676cf
call fcn.1400e2200
cmp byte [rax + 0x14], 0
mov eax, 1
je 0x1401676d1
mov eax, esi
mov dword [rbx + 0x288], eax
mov qword [rbx + 0x28c], 1
mov dword [rbx + 0x294], esi
mov dword [rbx + 0x298], 1
mov qword [rbx + 0x29c], 1
call fcn.140022880
cmp eax, 0x12
jl 0x140167781
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140167eab
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r15, [0x1402aaac0]
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140018bb0
test al, al
jne 0x14016776c
mov r8, rdi
inc r8
cmp word [r15 + r8*2], 0
jne 0x140167753
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140018f50
nop
lea rcx, [rsp + 0x20]
call fcn.1401ae340
cmp eax, 1
jne 0x140167781
mov dword [rbx + 0x2a0], eax
mov dword [rbx + 0x2a4], esi
mov qword [rbx + 0x2a8], 1
mov dword [rbx + 0x2b0], esi
mov eax, dword [0x140315cb4]
test eax, eax
jne 0x1401677be
mov dword [rbp + 0x10], r12d
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x18]
shr rax, 0x14
mov dword [0x140315cb4], eax
add eax, 0x200
cdq
and edx, 0x1fff
add eax, edx
sar eax, 0xd
shl eax, 2
mov ecx, 4
cmp eax, ecx
cmovge ecx, eax
cmp ecx, 0x40
cmovg ecx, r12d
mov dword [rbx + 0x2b4], ecx
lea rcx, [rbx + 0x2b8]
lea rdx, str..exe__.msi__.htm__.html_
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140167800
call fcn.140018f50
mov qword [rbx + 0x2c0], 1
mov dword [rbx + 0x2c8], 1
mov dword [rbx + 0x2cc], 1
mov dword [rbx + 0x2d0], 1
mov dword [rbx + 0x2d4], 1
mov dword [rbx + 0x2d8], 1
mov dword [rbx + 0x2dc], 1
mov dword [rbx + 0x2e0], 6
mov dword [rbx + 0x2e4], 1
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400285a0
nop
lea rcx, [rbx + 0x2e8]
mov rdx, rax
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401678ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov dword [rbx + 0x2f0], esi
lea rcx, [rbx + 0x2f8]
lea rdx, str..bak__.tmp_
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401678c4
call fcn.140018f50
mov dword [rbx + 0x300], esi
call fcn.14012bfe0
mov ecx, esi
cmp dword [rax + 0x118], 2
sete cl
mov dword [rbx + 0x304], ecx
call fcn.1400e2200
mov ecx, esi
cmp dword [rax + 0x10], esi
sete cl
mov dword [rbx + 0x308], ecx
mov qword [rbx + 0x30c], rsi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x314], xmm0
movups xmmword [rbx + 0x324], xmm0
movups xmmword [rbx + 0x334], xmm0
movups xmmword [rbx + 0x344], xmm0
movups xmmword [rbx + 0x354], xmm0
mov qword [rbx + 0x364], rax
mov qword [rbx + 0x36c], rax
movups xmmword [rbx + 0x374], xmm0
movups xmmword [rbx + 0x384], xmm0
movups xmmword [rbx + 0x394], xmm0
movups xmmword [rbx + 0x3a4], xmm0
movups xmmword [rbx + 0x3b4], xmm0
mov qword [rbx + 0x3c4], rax
mov qword [rbx + 0x3cc], rax
movups xmmword [rbx + 0x3d4], xmm0
movups xmmword [rbx + 0x3e4], xmm0
movups xmmword [rbx + 0x3f4], xmm0
movups xmmword [rbx + 0x404], xmm0
movups xmmword [rbx + 0x414], xmm0
mov qword [rbx + 0x424], rax
mov dword [rbx + 0x42c], eax
call fcn.1400e2200
mov ecx, dword [rax + 0x10]
neg ecx
sbb eax, eax
add eax, 2
mov dword [rbx + 0x430], eax
mov dword [rbx + 0x434], 1
mov dword [rbx + 0x438], 1
mov dword [rbx + 0x43c], 1
mov dword [rbx + 0x440], 1
mov qword [rbx + 0x444], 1
mov qword [rbx + 0x44c], rsi
mov qword [rbx + 0x454], rsi
mov dword [rbx + 0x45c], esi
lea rcx, [rbx + 0x460]
lea rdx, str.notepad.exe
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140167a10
call fcn.140018f50
mov qword [rbx + 0x468], 0xd77100
mov qword [rbx + 0x470], 0xffffff
mov dword [rbx + 0x478], esi
mov dword [rbx + 0x47c], 1
mov dword [rbx + 0x480], 1
mov dword [rbx + 0x484], 1
mov dword [rbx + 0x488], 1
mov dword [rbx + 0x48c], 1
mov dword [rbx + 0x490], 1
mov dword [rbx + 0x494], 1
mov dword [rbx + 0x498], 1
mov dword [rbx + 0x49c], 1
call fcn.140022880
cmp eax, 0x11
jge 0x140167aa6
mov dword [rbx + 0x494], esi
mov dword [rbx + 0x4a0], 1
call fcn.14012bfe0
mov ecx, esi
cmp dword [rax + 0x118], 2
sete cl
mov dword [rbx + 0x4a4], ecx
mov dword [rbx + 0x4a8], 1
mov qword [rbx + 0x4ac], 0xa
lea rcx, [rsp + 0x38]
call fcn.140022fd0
nop
lea rcx, [rbx + 0x4b8]
mov rdx, rax
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140167b1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov dword [rbx + 0x4c0], esi
lea rcx, [rbx + 0x4c8]
lea rdx, str..cbr_.cbz_.ear
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140167b33
call fcn.140018f50
mov dword [rbx + 0x4d0], esi
mov dword [rbx + 0x4d4], 1
mov dword [rbx + 0x4d8], 1
mov qword [rbx + 0x4dc], 1
mov qword [rbx + 0x4e4], 1
mov dword [rbx + 0x4ec], 1
mov eax, dword [0x140315cb4]
test eax, eax
jne 0x140167ba3
mov dword [rbp + 0x50], r12d
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x58]
shr rax, 0x14
mov dword [0x140315cb4], eax
cmp eax, 0xfa0
jl 0x140167bcd
call fcn.140022880
cmp eax, 0xa
jle 0x140167bcd
cmp eax, 0xd
je 0x140167bcd
cmp eax, 0x10
je 0x140167bcd
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140167bd3
mov dword [rbx + 0x4ec], esi
mov qword [rbx + 0x4f0], 1
mov dword [rbx + 0x4f8], esi
mov dword [rbx + 0x4fc], 1
mov qword [rbx + 0x500], 1
lea rcx, [rbx + 0x510]
mov r8, rdi
inc r8
cmp word [r14 + r8*2], 0
jne 0x140167c03
mov rdx, r14
call fcn.140018f50
lea rcx, [rbx + 0x518]
mov r8, rdi
inc r8
cmp word [r14 + r8*2], 0
jne 0x140167c20
mov rdx, r14
call fcn.140018f50
lea rcx, [rbx + 0x520]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140167c40
mov rdx, r14
call fcn.140018f50
mov qword [rbx + 0x528], rsi
mov qword [rbx + 0x530], rsi
mov qword [rbx + 0x538], rsi
mov qword [rbx + 0x540], rsi
mov dword [rbx + 0x548], 1
mov qword [rbx + 0x54c], 1
mov dword [rbx + 0x554], 1
mov qword [rbx + 0x558], 0x20000000
mov qword [rbx + 0x560], 1
mov dword [rbx + 0x568], esi
mov dword [rbx + 0x570], esi
lea rcx, [rbx + 0x578]
call fcn.140018cc0
lea rcx, [rbx + 0x580]
call fcn.140018cc0
lea rcx, [rbx + 0x588]
call fcn.140018cc0
lea rcx, [rbx + 0x590]
call fcn.140018cc0
lea rcx, [rbx + 0x598]
call fcn.140018cc0
mov qword [rbx + 0x5a0], rsi
mov dword [rbx + 0x5a8], esi
mov qword [rbx + 0x5ac], 1
mov dword [rbx + 0x5b4], esi
lea rcx, [rbx + 0x5b8]
call fcn.140029d60
mov qword [rbx + 0x5e8], rsi
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400285a0
nop
lea rcx, [rbx + 0x5f0]
mov rdx, rax
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140167d60
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov dword [rbx + 0x5f8], esi
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.1400285a0
nop
lea rcx, [rbx + 0x600]
mov rdx, rax
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140167da7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov qword [rbx + 0x608], rsi
mov qword [rbx + 0x610], 0x12c
mov dword [rbx + 0x618], esi
mov dword [rbx + 0x61c], 1
mov qword [rbx + 0x620], 1
mov qword [rbx + 0x628], rsi
mov dword [rbx + 0x630], 0x80
mov dword [rbx + 0x634], 1
mov qword [rbx + 0x638], 1
cmp dword [rbx + 0xb8], 0
je 0x140167e3b
xor ecx, ecx
call fcn.14020d7f0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.14020db64
imul ecx, dword [rsp + 0x74], 0x64
mov eax, dword [rsp + 0x70]
add eax, 0x2e631
add ecx, eax
imul eax, ecx, 0x64
add eax, dword [rsp + 0x6c]
mov dword [rbx + 0x63c], eax
mov qword [rbx + 0x640], rsi
lea rcx, [rbx + 0x648]
call fcn.140018cc0
lea rcx, [rbx + 0x650]
call fcn.140018cc0
mov dword [rbx + 0x658], esi
lea rcx, [rbx + 0x660]
call fcn.140029d60
mov qword [rbx + 0x690], rsi
mov qword [rbx + 0x698], rsi
mov dword [rbx + 0x6a0], esi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
int3