Function at 0x140011d10
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b8]
sub rsp, 0x4b8
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x400]
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0x408]
mov dword [rsp + 0x40], eax
mov r13d, dword [rbp + 0x410]
mov r14, qword [rbp + 0x418]
mov r15, qword [rbp + 0x420]
mov rsi, qword [rbp + 0x428]
test r14, r14
jne 0x140011da4
test rsi, rsi
je 0x140011d9a
lea rdx, str.dumpFileName_is_null_n
mov rcx, rsi
call fcn.14000e10e
mov eax, 0x80070057
jmp 0x1400120d3
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rdi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0x190]
mov r8, r14
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea edx, [rdi + 0x5c]
lea rcx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
je 0x140011e16
cmp word [rbp + 0x190], 0x5c
jne 0x140011e11
cmp word [rbp + 0x192], 0x5c
jne 0x140011e11
add rax, 2
mov word [rax], di
jmp 0x140011e19
mov rbx, rdi
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, rbx
lea rdx, str.Disk_space__s__Free_Bytes_Available__zd___Total_Number_Of_Bytes__zd___Total_Number_Of_Free_Bytes__zd__n
lea rcx, [rbp - 0x80]
call fcn.14000e104
cmp eax, 0xffffffff
je 0x140011e8d
lea rcx, [rbp - 0x80]
call fcn.14000e023
test rsi, rsi
je 0x140011e8d
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.14000e10e
mov r9d, r13d
mov r8, r14
lea rdx, str.Writing_dump_file:__s__type:0x_08x__n
lea rcx, [rbp - 0x80]
call fcn.14000e104
cmp eax, 0xffffffff
je 0x140011ec2
lea rcx, [rbp - 0x80]
call fcn.14000e023
test rsi, rsi
je 0x140011ec2
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.14000e10e
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
cmove rbx, rdi
mov qword [rsp + 0x60], rbx
test rbx, rbx
jne 0x140011f2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x14001208d
mov r9d, eax
mov r8, r14
lea rdx, str.Failed_to_create__s_Error:_0x_08x_n
mov rcx, rsi
call fcn.14000e10e
jmp 0x14001208d
test rsi, rsi
je 0x140011f42
mov r8, r14
lea rdx, str.Created__s_n
mov rcx, rsi
call fcn.14000e10e
mov r12, rdi
test r15, r15
je 0x140011f6a
mov dword [rsp + 0x5c], edi
mov eax, dword [r15 + 0x19f8]
mov dword [rsp + 0x50], eax
lea rax, [r15 + 0x210]
mov qword [rsp + 0x54], rax
lea r12, [rsp + 0x50]
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
jne 0x140011fa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140011f9c
mov r8d, eax
lea rdx, str.Failed_to_load_dbghelp.dll_Error:_0x_08x_n
mov rcx, rsi
call fcn.14000e10e
mov edi, 0x80070006
jmp 0x1400120c3
test rsi, rsi
je 0x140011fba
lea rdx, str.Loaded_dbghelp.dll_n
mov rcx, rsi
call fcn.14000e10e
lea rdx, str.MiniDumpWriteDump
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x140011fef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x14001208d
lea rdx, str.Failed_to_find_MiniDumpWriteDump_in_dbghelp.dll_Error:_0x_08x_n
jmp 0x140012082
test rsi, rsi
je 0x140012003
lea rdx, str.Found_MiniDumpWriteDump_in_dbghelp.dll_n
mov rcx, rsi
call fcn.14000e10e
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8, rbx
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call r15
test eax, eax
jne 0x14001204d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x1400120c3
mov r8d, eax
lea rdx, str.Failed_MiniDumpWriteDump_hresultError:_0x_08x_n
mov rcx, rsi
call fcn.14000e10e
jmp 0x1400120c3
test rsi, rsi
je 0x140012061
lea rdx, str.MiniDumpWriteDump_completed__n
mov rcx, rsi
call fcn.14000e10e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14001209c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rsi, rsi
je 0x14001208d
lea rdx, str.Failed_flush_file_buffers_Error:_0x_08x_n
mov r8d, edi
mov rcx, rsi
call fcn.14000e10e
test edi, edi
jle 0x1400120c3
movzx edi, di
or edi, 0x80070000
jmp 0x1400120c3
test rsi, rsi
je 0x1400120c3
lea rdx, str.Flushed_file_buffers_n
mov rcx, rsi
call fcn.14000e10e
mov r8, r14
lea rdx, str.Dump_completed_successfully:__s_n
mov rcx, rsi
call fcn.14000e10e
nop
test rbx, rbx
je 0x1400120d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14000e1b3
add rsp, 0x4b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret