Function at 0x616320
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
call fcn.005e9180
mov eax, dword [0x00693414]
add eax, 1
cmp dword [0x00693414], eax
jne 0x61638a
mov eax, dword [0x006965d4]
test eax, eax
jge 0x616359
call fcn.0040afc0
mov ecx, dword [0x00698974]
test ecx, ecx
jge 0x616368
call fcn.0040afc0
mov edx, dword [0x006933c0]
test edx, edx
jge 0x616377
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005ff550
cmp eax, dword [0x006931c4]
jle 0x6163a1
mov dword [0x006931c4], 0x33
mov eax, dword [0x006958fc]
add eax, dword [0x00695d88]
mov ecx, dword [0x006962c4]
add ecx, dword [0x006968a4]
cmp eax, ecx
jle 0x6163c2
call fcn.004096f0
mov eax, dword [0x006933c0]
add eax, 1
cmp dword [0x006933c0], eax
jne 0x6163e9
mov eax, dword [0x006933a4]
test eax, eax
jge 0x6163e2
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
nop
mov eax, dword [0x00693984]
sub eax, dword [0x00693558]
mov dword [0x00693558], eax
mov dword [0x00693278], 0x313
mov eax, dword [0x00693278]
sub eax, 0x1ab
mov dword [0x00693418], eax
mov eax, dword [0x00695d90]
add eax, dword [0x00696324]
mov ecx, dword [0x006968a8]
add ecx, dword [0x00696e8c]
cmp eax, ecx
jle 0x616440
mov eax, dword [0x00696e8c]
mov dword [0x00695d90], eax
mov eax, dword [0x00693200]
add eax, dword [0x006933a4]
mov ecx, dword [0x0069350c]
add ecx, dword [0x00693934]
cmp eax, ecx
jle 0x616466
mov dword [0x00693200], 0x26
mov eax, dword [0x006933cc]
add eax, 1
cmp dword [0x006933cc], eax
jne 0x6164ce
mov eax, dword [0x0069394c]
test eax, eax
jge 0x616486
call fcn.0040afc0
mov ecx, dword [0x00695914]
test ecx, ecx
jge 0x616495
call fcn.0040afc0
mov edx, dword [0x00696170]
test edx, edx
jge 0x6164a4
call fcn.0040afc0
mov r8d, dword [0x00696ac0]
test r8d, r8d
jge 0x6164b5
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
cmp eax, 0x40
jae 0x616505
cmp eax, 0x3f
jbe 0x6164e3
call fcn.0040afc0
mov rcx, qword [rbp + 0x48]
movzx rax, al
mov rdx, qword [rbp + 0x40]
mov qword [rcx + rax*8 + 8], rdx
mov rax, qword [rbp + 0x48]
add dword [rax], 1
jmp 0x616505
mov eax, dword [0x00693200]
add eax, dword [0x006933a4]
mov ecx, dword [0x0069350c]
add ecx, dword [0x00693934]
cmp eax, ecx
jle 0x61652b
mov dword [0x00693200], 0x26
mov eax, dword [0x006965cc]
cmp eax, dword [0x00696ccc]
je 0x616545
mov eax, dword [0x006965cc]
mov dword [0x00696ccc], eax
mov eax, dword [0x0069355c]
add eax, 1
cmp dword [0x0069355c], eax
jne 0x616596
mov eax, dword [0x0069390c]
test eax, eax
jge 0x616565
call fcn.0040afc0
mov ecx, dword [0x00695808]
test ecx, ecx
jge 0x616574
call fcn.0040afc0
mov edx, dword [0x00695930]
test edx, edx
jge 0x616583
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696188]
add eax, dword [0x00696598]
mov ecx, dword [0x00696c98]
add ecx, dword [0x006974a8]
cmp eax, ecx
jle 0x6165be
mov eax, dword [0x006974a8]
mov dword [0x00696188], eax
mov eax, dword [0x006931c8]
mov dword [0x00697e80], eax
call fcn.005e8520
mov eax, dword [0x00693430]
add eax, 1
cmp dword [0x00693430], eax
jne 0x616620
mov eax, dword [0x006931d0]
test eax, eax
jge 0x6165ef
call fcn.0040afc0
mov ecx, dword [0x00693428]
test ecx, ecx
jge 0x6165fe
call fcn.0040afc0
mov edx, dword [0x00693960]
test edx, edx
jge 0x61660d
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069611c]
mov dword [0x0069591c], eax
mov eax, dword [0x00696118]
add eax, dword [0x00696580]
mov ecx, dword [0x00696ac0]
add ecx, dword [0x00697490]
cmp eax, ecx
jle 0x616654
mov eax, dword [0x00697490]
mov dword [0x00696118], eax
lea rsp, [rbp + 0x30]
pop rbp
ret