Function at 0x5fd5a0
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x68]
call fcn.0040eab0
mov rcx, qword [rbp + 0x70]
call fcn.0040eab0
nop
nop
mov eax, dword [0x00693938]
add eax, 1
cmp dword [0x00693938], eax
jne 0x5fd63d
mov eax, dword [0x006940e4]
test eax, eax
jge 0x5fd5f5
call fcn.0040afc0
mov ecx, dword [0x00696308]
test ecx, ecx
jge 0x5fd604
call fcn.0040afc0
mov edx, dword [0x00696cdc]
test edx, edx
jge 0x5fd613
call fcn.0040afc0
mov r8d, dword [0x00697c84]
test r8d, r8d
jge 0x5fd624
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
test eax, eax
jne 0x5fd667
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
call fcn.0040ef50
jmp 0x5fd94e
mov rcx, qword [rbp + 0x60]
call fcn.0040e920
mov eax, dword [0x00693560]
add eax, 1
cmp dword [0x00693560], eax
jne 0x5fd756
mov eax, dword [0x00693954]
test eax, eax
jge 0x5fd694
call fcn.0040afc0
mov ecx, dword [0x00695c10]
test ecx, ecx
jge 0x5fd6a3
call fcn.0040afc0
mov edx, dword [0x00696570]
test edx, edx
jge 0x5fd6b2
call fcn.0040afc0
mov r8d, dword [0x00696ca8]
test r8d, r8d
jge 0x5fd6c3
call fcn.0040afc0
mov r9d, dword [0x006978d0]
test r9d, r9d
jge 0x5fd6d4
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
jmp 0x5fd756
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
mov r9d, eax
sub r9d, 1
call fcn.00410d90
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
call fcn.00410aa0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
lea rcx, [rbp + 0x68]
mov edx, 1
mov r8d, eax
call fcn.00410df0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
test eax, eax
jne 0x5fd6f4
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
test eax, eax
je 0x5fd7ac
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov r8d, 1
call fcn.00410f20
lea rcx, [rbp + 0x68]
mov edx, 1
mov r8d, eax
call fcn.00410df0
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
call fcn.00410aa0
call fcn.005e9bb0
mov eax, dword [0x0069327c]
mov dword [0x00697458], eax
mov eax, dword [0x0069327c]
mov dword [0x00697458], eax
mov eax, dword [0x006965d4]
cmp eax, dword [0x00696cbc]
je 0x5fd7f0
mov eax, dword [0x006965d4]
mov dword [0x00696cbc], eax
mov eax, dword [0x006931fc]
mov dword [0x00697488], eax
mov eax, dword [0x006931fc]
mov dword [0x00697488], eax
mov eax, dword [0x006962f4]
cmp eax, dword [0x006968b8]
je 0x5fd822
mov eax, dword [0x006962f4]
mov dword [0x006968b8], eax
mov eax, dword [0x006937f8]
add eax, 1
cmp dword [0x006937f8], eax
jne 0x5fd873
mov eax, dword [0x006965ec]
test eax, eax
jge 0x5fd842
call fcn.0040afc0
mov ecx, dword [0x006974c8]
test ecx, ecx
jge 0x5fd851
call fcn.0040afc0
mov edx, dword [0x006933cc]
test edx, edx
jge 0x5fd860
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005ea0b0
cmp eax, dword [0x006978f4]
jle 0x5fd88a
mov dword [0x006978f4], 0x37
mov eax, dword [0x0069393c]
add eax, 1
cmp dword [0x0069393c], eax
jne 0x5fd8db
mov eax, dword [0x006958c4]
test eax, eax
jge 0x5fd8aa
call fcn.0040afc0
mov ecx, dword [0x006961a0]
test ecx, ecx
jge 0x5fd8b9
call fcn.0040afc0
mov edx, dword [0x00696a74]
test edx, edx
jge 0x5fd8c8
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006933f0]
add eax, 1
cmp dword [0x006933f0], eax
jne 0x5fd94d
mov eax, dword [0x006968c0]
test eax, eax
jge 0x5fd8fb
call fcn.0040afc0
mov ecx, dword [0x006931e4]
test ecx, ecx
jge 0x5fd90a
call fcn.0040afc0
mov edx, dword [0x00693418]
test edx, edx
jge 0x5fd919
call fcn.0040afc0
mov r8d, dword [0x00693930]
test r8d, r8d
jge 0x5fd92a
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
jmp 0x5fd94d
nop
lea rcx, [rbp + 0x30]
call fcn.0040e920
lea rcx, [rbp + 0x68]
mov edx, 2
call fcn.0040ea00
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret