Function at 0x14003d988
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x7a8]
sub rsp, 0x890
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov rsi, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x50], r14
lea r15d, [r14 + 1]
mov r9d, r15d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140018038
test eax, eax
je 0x14003db8d
lea rcx, [rsp + 0x38]
call fcn.1400221c0
nop
mov rax, qword [rsp + 0x38]
mov edx, dword [rax - 0x10]
or rdi, 0xffffffffffffffff
test edx, edx
je 0x14003db6b
lea ecx, [rdx - 1]
test ecx, ecx
js 0x14003db60
cmp ecx, edx
jg 0x14003db60
movsxd rcx, ecx
cmp word [rax + rcx*2], 0x5c
je 0x14003da5a
mov r8d, r15d
lea rdx, [0x140130a20]
lea rcx, [rsp + 0x38]
call fcn.14000df38
lea r8, str.Mozilla_Firefox_firefox.exe
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140017478
nop
mov r8d, dword [0x14019fd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 9
jne 0x14003dad6
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400b8688
mov rcx, rax
call fcn.1400ba0bc
lea rcx, [rsp + 0x58]
call fcn.140022490
test al, al
je 0x14003db3f
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14000291c
mov dword [rsp + 0x30], r15d
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003db16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003dc91
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x14003dc91
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003db6b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003db6b
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x14012e2f8]
mov rcx, rsi
call fcn.140001cb0
mov dword [rsp + 0x30], r15d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
jmp 0x14003dc7a
mov word [rbp - 0x80], r14w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x7e]
call fcn.1400be450
mov ecx, dword [0x14019fd80]
imul ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 6
jne 0x14003dbdf
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [rsp + 0x68], 0x400
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x80]
lea rdx, [0x14012e2f8]
lea rcx, [rsp + 0x40]
call fcn.140018118
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x14003dc4a
lea rcx, [rbp - 0x80]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14003dc2a
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140001e74
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003dc5f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14000291c
mov dword [rsp + 0x30], r15d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003dc91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003dca6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov rax, rsi
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret