Function at 0x5ad830
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0xc0], rcx
mov eax, dword [0x00693988]
mov dword [0x00693924], eax
mov eax, dword [0x00693518]
cmp eax, dword [0x00693564]
je 0x5ad86c
mov eax, dword [0x00693518]
mov dword [0x00693564], eax
call fcn.005aa780
mov eax, dword [0x006932c4]
add eax, 1
cmp dword [0x006932c4], eax
jne 0x5ad8ab
mov ecx, dword [0x0069344c]
mov edx, dword [0x006935ec]
mov r8d, dword [0x00693948]
mov r9d, dword [0x006931e8]
mov eax, dword [0x006932ac]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006934dc]
add eax, dword [0x00693524]
mov ecx, dword [0x006935f0]
add ecx, dword [0x0069391c]
cmp eax, ecx
jle 0x5ad8d3
mov eax, dword [0x0069391c]
mov dword [0x006934dc], eax
mov byte [rbp + 0x8f], 0
call fcn.005a2d10
cmp eax, dword [0x006931f8]
jle 0x5ad8f1
mov dword [0x006931f8], 0x26
call fcn.005ad620
cmp eax, dword [0x006931cc]
jle 0x5ad908
mov dword [0x006931cc], 0x1b
call fcn.005ad620
cmp eax, dword [0x006931b8]
jle 0x5ad91f
mov dword [0x006931b8], 0x16
call fcn.005ad620
cmp eax, dword [0x006931c8]
jle 0x5ad936
mov dword [0x006931c8], 0x1a
mov eax, dword [0x00693284]
add eax, 1
cmp dword [0x00693284], eax
jne 0x5ad966
mov ecx, dword [0x00693530]
mov edx, dword [0x00693958]
mov r8d, dword [0x006931f4]
mov r9d, dword [0x006932b8]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006931fc]
add eax, 1
cmp dword [0x006931fc], eax
jne 0x5ad996
mov ecx, dword [0x0069352c]
mov edx, dword [0x00693938]
mov r8d, dword [0x006931c0]
mov r9d, dword [0x00693284]
call sub.advapi32.dll_CryptDuplicateKey
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
test rax, rax
jne 0x5ada94
mov eax, dword [0x00693440]
add eax, dword [0x006934e4]
mov ecx, dword [0x0069352c]
add ecx, dword [0x006935f8]
cmp eax, ecx
jle 0x5ad9d2
call fcn.004096f0
mov eax, dword [0x00693958]
mov dword [0x0069390c], eax
mov eax, dword [0x006935f8]
add eax, dword [0x00693938]
mov ecx, dword [0x006934e0]
add ecx, dword [0x0069352c]
cmp ecx, eax
jle 0x5ada06
mov ecx, dword [0x00693938]
mov dword [0x006934e0], ecx
mov ecx, dword [0x006934e0]
add ecx, dword [0x0069352c]
cmp ecx, eax
jle 0x5ada22
mov eax, dword [0x00693938]
mov dword [0x006934e0], eax
mov eax, dword [0x00693520]
cmp eax, dword [0x006935ec]
je 0x5ada3c
mov eax, dword [0x00693520]
mov dword [0x006935ec], eax
call fcn.005aba50
cmp eax, dword [0x006931b0]
jle 0x5ada53
mov dword [0x006931b0], 0x13
mov eax, dword [0x006931c8]
mov dword [0x0069395c], eax
mov eax, dword [0x006932a0]
add eax, 1
cmp dword [0x006932a0], eax
jne 0x5ada88
mov ecx, dword [0x006932a4]
mov edx, dword [0x006933b4]
mov r8d, dword [0x00693418]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov byte [rbp + 0x8f], 1
jmp 0x5adf3e
mov eax, dword [0x006931c8]
mov dword [0x0069395c], eax
mov eax, dword [0x006934f0]
cmp eax, dword [0x0069353c]
je 0x5adaba
mov eax, dword [0x006934f0]
mov dword [0x0069353c], eax
mov eax, dword [0x006931cc]
mov dword [0x00693960], eax
mov dword [0x006931d4], 0x301
mov eax, dword [0x006931d4]
sub eax, 0x1a3
mov dword [0x00693280], eax
mov eax, dword [0x00693974]
mov dword [0x00693928], eax
mov eax, dword [0x00693408]
mov dword [0x006933bc], eax
mov eax, dword [0x006931b4]
add eax, dword [0x00693200]
mov ecx, dword [0x006932ac]
add ecx, dword [0x006932f4]
cmp eax, ecx
jle 0x5adb20
mov dword [0x006931b4], 0x185
call fcn.005aa780
nop
lea rcx, [rbp + 0x90]
xor edx, edx
xor r8, r8
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call qword [0x006a8ea8]
test eax, eax
je 0x5ade7a
nop
mov rcx, qword [rbp + 0x90]
mov edx, 0x8003
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
call qword [0x006a8eb0]
test eax, eax
je 0x5ade37
nop
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x88]
mov r8d, 4
call fcn.004fab00
cmp dword [rbp + 0x88], 0x10000000
jge 0x5ade29
movsxd rcx, dword [rbp + 0x88]
call fcn.00409030
mov qword [rbp + 0xa0], rax
nop
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xa0]
movsxd r8, dword [rbp + 0x88]
call fcn.004fab00
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x70]
mov r8d, 0x14
call fcn.004fab00
cmp dword [rbp + 0x70], 0xffffffff
jne 0x5ade1c
mov rcx, qword [rbp + 0xa0]
mov edx, dword [rbp + 0x88]
lea r8, [rbp + 0xa8]
lea r9, [rbp + 0x84]
mov dword [rsp + 0x20], 0
call fcn.0055a220
nop
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0x84]
xor r9, r9
call qword [0x006a8eb8]
test eax, eax
je 0x5ade0f
mov eax, dword [0x006931dc]
mov dword [0x00693974], eax
mov eax, dword [0x006932ac]
add eax, 1
cmp dword [0x006932ac], eax
jne 0x5adcad
mov ecx, dword [0x00693800]
mov edx, dword [0x006931b4]
mov r8d, dword [0x006932c4]
mov r9d, dword [0x006933d0]
mov eax, dword [0x0069341c]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00693454]
mov dword [0x00693408], eax
mov dword [0x006931e0], 0x32e
mov eax, dword [0x006931e0]
sub eax, 0x1a9
mov dword [0x00693210], eax
mov eax, dword [0x00693954]
mov dword [0x0069390c], eax
mov eax, dword [0x00693954]
mov dword [0x0069390c], eax
mov eax, dword [0x0069354c]
cmp eax, dword [0x00693910]
je 0x5add07
mov eax, dword [0x0069354c]
mov dword [0x00693910], eax
call fcn.005aba50
mov eax, dword [0x006931bc]
mov dword [0x00693938], eax
mov eax, dword [0x00693434]
add eax, dword [0x006934d8]
mov ecx, dword [0x0069353c]
add ecx, dword [0x00693900]
cmp eax, ecx
jle 0x5add39
call fcn.004096f0
mov rcx, qword [rbp + 0x98]
mov edx, 2
xor r8, r8
lea r9, [rbp + 0x6c]
mov dword [rsp + 0x20], 0
call qword [0x006a8ec0]
test eax, eax
je 0x5ade0f
mov rcx, qword [rbp + 0x98]
mov edx, 2
lea r8, [rbp + 0x5c]
lea r9, [rbp + 0x6c]
mov dword [rsp + 0x20], 0
call qword [0x006a8ec0]
test eax, eax
je 0x5ade0f
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call fcn.004fd260
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xa8]
movsxd r8, dword [rbp + 0x84]
call fcn.004fbd70
mov byte [rbp + 0x8f], 1
mov dword [rbp + 0x88], 0
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x5c]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x48]
movzx rax, byte [rax]
cmp al, byte [rcx]
je 0x5addf4
mov byte [rbp + 0x8f], 0
jmp 0x5ade0e
add dword [rbp + 0x88], 1
add qword [rbp + 0x48], 1
add qword [rbp + 0x50], 1
cmp dword [rbp + 0x88], 0x10
jne 0x5adddb
nop
nop
mov rcx, qword [rbp + 0xa8]
call fcn.00409060
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00409060
nop
mov rcx, qword [rbp + 0x98]
call qword [0x006a8ec8]
nop
mov rcx, qword [rbp + 0x90]
xor edx, edx
call qword [0x006a8ed0]
jmp 0x5ade7a
call fcn.005aba50
cmp eax, dword [0x00693978]
jle 0x5ade91
mov dword [0x00693978], 0xe
call fcn.005ab920
mov dword [0x006931e8], 0x31b
mov eax, dword [0x006931e8]
sub eax, 0x1af
mov dword [0x00693294], eax
mov eax, dword [0x0069342c]
add eax, dword [0x006934d0]
mov ecx, dword [0x00693518]
add ecx, dword [0x00693564]
cmp eax, ecx
jle 0x5aded3
call fcn.004096f0
call fcn.005aba50
cmp eax, dword [0x00693984]
jle 0x5adeea
mov dword [0x00693984], 0x11
call fcn.005ad800
cmp eax, dword [0x006931d8]
jle 0x5adf01
mov dword [0x006931d8], 0x1d
mov eax, dword [0x00693980]
add eax, dword [0x006931ec]
mov ecx, dword [0x00693294]
add ecx, dword [0x006932e0]
cmp eax, ecx
jle 0x5adf27
mov dword [0x00693980], 0x10e
call fcn.005ad800
cmp eax, dword [0x006931d8]
jle 0x5adf3e
mov dword [0x006931d8], 0x1e
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xb0]
pop rbp
ret