Function at 0x14003c1d8
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x7a8]
sub rsp, 0x890
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
lea r14d, [rsi + 1]
mov r9d, r14d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140018038
test eax, eax
je 0x14003c3ca
lea rcx, [rsp + 0x38]
call fcn.1400221c0
nop
mov r8d, dword [0x14019fd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 7
jne 0x14003c2a5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x14019fd80]
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], esi
je 0x14003c3a8
mov ecx, r8d
imul ecx, r8d
and ecx, 0x8000000f
jge 0x14003c2cb
sub ecx, r14d
or ecx, 0xfffffff0
add ecx, r14d
cmp ecx, 0xb
jne 0x14003c2da
sub r8d, r14d
mov dword [0x14019fd80], r8d
mov edx, dword [rax - 0x10]
lea ecx, [rdx - 1]
test ecx, ecx
js 0x14003c39d
cmp ecx, edx
jg 0x14003c39d
movsxd rcx, ecx
cmp word [rax + rcx*2], 0x5c
je 0x14003c30e
mov r8d, r14d
lea rdx, [0x140130a20]
lea rcx, [rsp + 0x38]
call fcn.14000df38
lea r8, str.GoogleChromeApplicationchrome.exe
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140017478
nop
lea rcx, [rsp + 0x58]
call fcn.140022490
test al, al
je 0x14003c382
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14000291c
mov dword [rsp + 0x30], r14d
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003c35f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003c486
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x14003c486
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003c3a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003c3a8
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x14012e2f8]
mov rcx, rdi
call fcn.140001cb0
mov dword [rsp + 0x30], r14d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
jmp 0x14003c475
mov word [rbp - 0x80], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x7e]
call fcn.1400be450
mov dword [rsp + 0x68], 0x400
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x80]
lea rdx, [0x14012e2f8]
lea rcx, [rsp + 0x40]
call fcn.140018118
test eax, eax
jne 0x14003c446
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x14003c427
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140001e74
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003c45b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14000291c
mov dword [rsp + 0x30], r14d
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003c486
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003c49b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov rax, rdi
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret