Function at 0x140001070
Capabilities:
Get disk size
Get file size

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov rbx, rdx
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r14, rcx
mov dword [rsp + 0x20], 4
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14000132e
lea edx, [rdi + 0x30]
mov qword [rsp + 0xb0], rsi
xor ecx, ecx
lea r9d, [rdi + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
lea rdx, [rbp + 0x40]
mov rcx, r15
lea rbx, [rdi - 1]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
cmovne rbx, qword [rbp + 0x40]
mov qword [rsi + 0x18], rbx
cmp rbx, 0x400
jle 0x14000130e
movzx r14d, byte [r14]
test r14b, r14b
je 0x14000120a
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], edi
lea rcx, [rbp - 0x34]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov dword [rbp - 0x34], 0x5c2e5c5c
mov word [rbp - 0x2f], 0x3a
mov byte [rbp - 0x30], r14b
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000120a
xor r9d, r9d
mov qword [rsp + 0xb8], r12
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rbp + 0x48]
mov dword [rbp - 0x3b], 0x3a00
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsi + 0x10]
mov byte [rbp - 0x37], dil
lea rdx, [rsi + 0xc]
mov byte [rbp - 0x3c], r14b
lea rcx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1400011f9
mov eax, dword [rsi + 0xc]
xor r9d, r9d
imul eax, dword [rsi + 0x10]
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov edx, 0x560000
mov rcx, rbx
mov dword [rbp + 0x40], edi
mov dword [rsi + 8], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400011f9
mov eax, dword [rbp - 0x20]
mov dword [rsi + 4], eax
mov rax, qword [rbp - 0x18]
mov qword [rsi + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xb8]
cmp dword [rsi + 8], edi
jle 0x140001302
cmp qword [rsi + 0x20], rdi
jle 0x140001302
mov eax, dword [rsi + 0x10]
mov r8d, 0x1000
imul eax, dword [rsi + 0xc]
mov dword [rbp + 0x40], edi
mov qword [rbp + 0x48], rdi
movsxd rcx, eax
mov rax, qword [rsi + 0x18]
dec rax
add rax, rcx
cqo
idiv rcx
xor ecx, ecx
lea ebx, [rax + 1]
shl ebx, 4
lea r9d, [rcx + 4]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x48]
mov r14, rax
mov r9d, 8
lea rax, [rbp + 0x40]
mov edx, 0x90073
mov qword [rsp + 0x30], rax
mov rcx, r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400012ef
movsxd rax, dword [r14]
xor ecx, ecx
mov rbx, qword [r14 + 8]
mov rdx, rax
shl rdx, 4
mov r8d, 0x1000
mov dword [rsi], eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsi + 0x28], rax
cmp dword [r14], edi
jbe 0x1400012ef
nop
mov rax, qword [rsi + 0x28]
mov edx, edi
inc edi
add rdx, rdx
mov rcx, qword [r14 + rdx*8 + 0x10]
sub rcx, rbx
mov qword [rax + rdx*8 + 8], rcx
mov rcx, qword [rsi + 0x28]
mov rax, qword [r14 + rdx*8 + 0x18]
mov qword [rcx + rdx*8], rax
mov rbx, qword [r14 + rdx*8 + 0x10]
cmp edi, dword [r14]
jb 0x1400012c0
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000130e
lea rcx, str.failed_r_n
call fcn.140001010
mov rcx, r15
mov rsi, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbx
pop rbp
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.failed_r_n
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbx
pop rbp
jmp fcn.140001010