Function at 0x14007fa50
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rdi, rdx
movsxd rsi, r8d
mov r12d, r9d
mov rbx, rcx
lea r9, [rsp + 0x40]
xor r13d, r13d
xor r8d, r8d
mov edx, 0x104b
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14007fc24
lea r8, [rbx + 0xa0]
lea rax, [rbp + 0x20]
mov edx, 0x104
sub r8, rax
lea rcx, [rbp + 0x20]
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14007faf4
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14007faf4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14007fad0
jmp 0x14007faf9
test rdx, rdx
jne 0x14007fafd
sub rcx, 2
mov word [rcx], r13w
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
movsxd rcx, dword [rsp + 0x68]
mov rax, qword [rbx + 0x58]
imul rcx, rcx, 0x250
test byte [rcx + rax], 0x10
je 0x14007fb80
lea rdx, [0x140101e1c]
lea rax, [rbp - 0x20]
mov r8d, 0x20
sub rdx, rax
lea rcx, [rbp - 0x20]
nop dword [rax]
lea rax, [r8 + 0x7fffffde]
test rax, rax
je 0x14007fb6e
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14007fb6e
mov word [rcx], ax
add rcx, 2
dec r8
jne 0x14007fb40
sub rcx, 2
mov word [rcx], r13w
jmp 0x14007fc03
test r8, r8
jne 0x14007fb77
sub rcx, 2
mov word [rcx], r13w
jmp 0x14007fc03
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
movsxd r8, dword [rsp + 0x68]
mov r9, qword [rbx + 0x58]
imul r8, r8, 0x250
mov r11d, dword [rsp + 0x38]
mov ecx, dword [r8 + r9 + 0x20]
imul r11d, dword [rsp + 0x30]
test ecx, ecx
je 0x14007fbd1
xor edx, edx
mov eax, ecx
div r11d
test edx, edx
je 0x14007fbd1
sub r11d, edx
add ecx, r11d
mov eax, dword [r8 + r9 + 0x1c]
mov r9d, dword [rbx + 0x2e8]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rbx + 0x2ec]
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp - 0x20]
mov r8d, 0x20
mov dword [rsp + 0x20], eax
call fcn.140097d30
lea rax, [rbp - 0x20]
lea r9, [rbp - 0x70]
mov r8, rsi
mov edx, 0x1074
mov rcx, rdi
mov dword [rbp - 0x68], r12d
mov qword [rbp - 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbx + 0x2f0]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x348
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400829c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov rdi, rcx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x140082a24
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x120]
test eax, eax
je 0x140082a14
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x78]
call fcn.140092a30
test eax, eax
je 0x140082a19
mov ebx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret