Function at 0x5d3a00
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x400
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], rbp
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x418], rdx
mov qword [rbp + 0x420], r8
mov dword [rbp + 0x428], r9d
lea rcx, [rbp + 0x430]
call fcn.0040eaf0
nop
call fcn.005cc640
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5d3a83
mov ecx, dword [0x00695bc0]
mov edx, dword [0x00693298]
mov r8d, dword [0x00693408]
mov r9d, dword [0x00693508]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006932d0]
add eax, 1
cmp dword [0x006932d0], eax
jne 0x5d3ab3
mov ecx, dword [0x00693924]
mov edx, dword [0x00695bc0]
mov r8d, dword [0x00696124]
mov r9d, dword [0x00693200]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005cff60
cmp eax, dword [0x006961ac]
jle 0x5d3aca
mov dword [0x006961ac], 0x29
mov eax, dword [0x0069616c]
add eax, dword [0x00693274]
mov ecx, dword [0x006933ac]
add ecx, dword [0x0069341c]
cmp eax, ecx
jle 0x5d3af0
mov dword [0x0069616c], 0x26
mov rcx, qword [rbp + 0x410]
call fcn.0040e9c0
nop
lea rcx, [rbp + 0x160]
mov edx, 0x2a0
xor r8, r8
call fcn.0040a9a0
call fcn.005ccda0
mov eax, dword [0x0069619c]
mov dword [0x0069612c], eax
mov rax, qword [rbp + 0x420]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
lea rcx, [rbp + 0x140]
mov rdx, qword [rbp + 0x420]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8d, eax
call fcn.005a9750
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x140]
mov r8d, 0xff
call fcn.0040f680
lea rcx, [rbp + 0x198]
lea rdx, [rbp + 0x40]
mov r8b, 0x20
call fcn.0040f3e0
mov dword [0x006931b8], 0x2f4
mov eax, dword [0x006931b8]
sub eax, 0x19c
mov dword [0x006932c0], eax
mov dword [0x006931b8], 0x2f4
mov eax, dword [0x006931b8]
sub eax, 0x19c
mov dword [0x006932c0], eax
mov eax, dword [0x00695908]
cmp eax, dword [0x00695c20]
je 0x5d3bce
mov eax, dword [0x00695908]
mov dword [0x00695c20], eax
call fcn.005cb8b0
lea rcx, [rbp + 0x177]
lea rdx, [0x006a8700]
mov r8b, 0x20
call fcn.0040f3e0
mov eax, dword [0x00696120]
mov dword [0x00695bf4], eax
mov eax, dword [0x00693404]
add eax, 1
cmp dword [0x00693404], eax
jne 0x5d3c25
mov ecx, dword [0x00695904]
mov edx, dword [0x006932bc]
mov r8d, dword [0x00693430]
mov r9d, dword [0x00693568]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006958dc]
add eax, dword [0x00695bbc]
mov ecx, dword [0x006942c0]
add ecx, dword [0x00695850]
cmp ecx, eax
jle 0x5d3c4d
mov ecx, dword [0x00695bbc]
mov dword [0x006942c0], ecx
mov dword [0x00693288], 0x313
mov ecx, dword [0x00693288]
sub ecx, 0x1ab
mov dword [0x006932f8], ecx
mov ecx, dword [0x00694284]
add ecx, dword [0x00695818]
cmp ecx, eax
jle 0x5d3c85
mov eax, dword [0x00695bbc]
mov dword [0x00694284], eax
mov dword [0x006931c0], 0x2f9
mov eax, dword [0x006931c0]
sub eax, 0x19f
mov dword [0x006932c8], eax
mov dword [0x006931c0], 0x2f9
mov eax, dword [0x006931c0]
sub eax, 0x19f
mov dword [0x006932c8], eax
mov eax, dword [0x00695924]
cmp eax, dword [0x00695bcc]
je 0x5d3cd7
mov eax, dword [0x00695924]
mov dword [0x00695bcc], eax
mov eax, dword [0x00696184]
mov dword [0x00695c20], eax
mov eax, dword [0x006a88b0]
mov dword [rbp + 0x16c], eax
mov eax, dword [0x00696184]
mov dword [0x00695c20], eax
mov eax, dword [0x00695810]
cmp eax, dword [0x006958d4]
je 0x5d3d15
mov eax, dword [0x00695810]
mov dword [0x006958d4], eax
mov eax, dword [0x006932c0]
add eax, 1
cmp dword [0x006932c0], eax
jne 0x5d3d4f
mov ecx, dword [0x006940e8]
mov edx, dword [0x0069589c]
mov r8d, dword [0x00695bd0]
mov r9d, dword [0x0069616c]
mov eax, dword [0x00693210]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006931c4]
mov dword [0x0069611c], eax
mov eax, dword [0x0069411c]
add eax, dword [0x006957f0]
mov ecx, dword [0x00695898]
add ecx, dword [0x00695924]
cmp eax, ecx
jle 0x5d3d7c
call fcn.004096f0
call fcn.005cdc30
call fcn.005d1e00
cmp eax, dword [0x006931f4]
jle 0x5d3d98
mov dword [0x006931f4], 0x3c
call fcn.005d11a0
cmp eax, dword [0x006931c4]
jle 0x5d3daf
mov dword [0x006931c4], 0x30
mov dword [0x006931ec], 0x2f2
mov eax, dword [0x006931ec]
sub eax, 0x19b
mov dword [0x006932f4], eax
mov dword [0x006931ec], 0x2f2
mov eax, dword [0x006931ec]
sub eax, 0x19b
mov dword [0x006932f4], eax
mov eax, dword [0x00695924]
cmp eax, dword [0x00695c04]
je 0x5d3e01
mov eax, dword [0x00695924]
mov dword [0x00695c04], eax
mov eax, dword [rbp + 0x428]
mov dword [rbp + 0x3c4], eax
mov eax, dword [0x00695d88]
mov dword [0x00695b98], eax
mov dword [rbp + 0x3c8], 2
mov eax, dword [0x006933ac]
add eax, 1
cmp dword [0x006933ac], eax
jne 0x5d3e53
mov ecx, dword [0x006958dc]
mov edx, dword [0x00693294]
mov r8d, dword [0x0069343c]
mov r9d, dword [0x006935f8]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x0069411c]
mov dword [0x006940ac], eax
call fcn.005d2100
cmp eax, dword [0x006931f8]
jle 0x5d3e76
mov dword [0x006931f8], 0x3d
mov dword [0x006931cc], 0x300
mov eax, dword [0x006931cc]
sub eax, 0x193
mov dword [0x006932d4], eax
mov eax, dword [0x006931d0]
mov dword [0x0069612c], eax
mov eax, dword [0x00695828]
add eax, dword [0x00695898]
mov ecx, dword [0x00695b94]
add ecx, dword [0x00695d84]
cmp eax, ecx
jle 0x5d3ec6
mov eax, dword [0x00695d84]
mov dword [0x00695828], eax
call fcn.005ceba0
mov dword [rbp + 0x3cc], 1
mov eax, dword [0x006933e8]
add eax, 1
cmp dword [0x006933e8], eax
jne 0x5d3f0f
mov ecx, dword [0x00695854]
mov edx, dword [0x00696198]
mov r8d, dword [0x006932d4]
mov r9d, dword [0x006934d4]
mov eax, dword [0x006937f8]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006933e4]
add eax, 1
cmp dword [0x006933e4], eax
jne 0x5d3f49
mov ecx, dword [0x006942fc]
mov edx, dword [0x00695b88]
mov r8d, dword [0x00696124]
mov r9d, dword [0x00693200]
mov eax, dword [0x006933d4]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
call fcn.005a66a0
movsd qword [rbp + 0x3d0], xmm0
mov eax, dword [0x0069395c]
mov dword [0x00693538], eax
mov eax, dword [0x00694290]
add eax, dword [0x00695820]
mov ecx, dword [0x006958e4]
add ecx, dword [0x00695bc4]
cmp eax, ecx
jle 0x5d3f8a
mov eax, dword [0x00695bc4]
mov dword [0x00694290], eax
mov eax, dword [0x00693274]
mov dword [0x00696170], eax
call fcn.005cc790
mov eax, dword [0x006942b4]
mov dword [0x006940c8], eax
mov eax, dword [0x006942b0]
add eax, dword [0x00695840]
mov ecx, dword [0x00695904]
add ecx, dword [0x00695be4]
cmp eax, ecx
jle 0x5d3fcf
mov eax, dword [0x00695be4]
mov dword [0x006942b0], eax
mov eax, dword [0x006933bc]
add eax, 1
cmp dword [0x006933bc], eax
jne 0x5d3feb
mov ecx, dword [0x00693278]
call sub.kernel32.dll_SetConsoleKeyShortcuts
call fcn.005a6320
mov dword [rbp + 0x3e0], eax
mov dword [0x00693274], 0x309
mov eax, dword [0x00693274]
sub eax, 0x1a6
mov dword [0x006933ac], eax
mov eax, dword [0x00693304]
add eax, 1
cmp dword [0x00693304], eax
jne 0x5d404c
mov ecx, dword [0x00695830]
mov edx, dword [0x00695bd8]
mov r8d, dword [0x00696174]
mov r9d, dword [0x006933b0]
mov eax, dword [0x006934e8]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00693200]
mov dword [0x0069615c], eax
mov eax, dword [0x006931b8]
add eax, dword [0x006932c0]
mov ecx, dword [0x006933f8]
add ecx, dword [0x006934f8]
cmp eax, ecx
jle 0x5d407e
mov dword [0x006931b8], 0x7a
mov eax, dword [0x006932cc]
add eax, 1
cmp dword [0x006932cc], eax
jne 0x5d40a7
mov ecx, dword [0x006932d4]
mov edx, dword [0x00693544]
mov r8d, dword [0x006940a8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005cdc30
mov eax, dword [0x00696190]
mov dword [0x00695d74], eax
call fcn.005d11a0
cmp eax, dword [0x006931c0]
jle 0x5d40cf
mov dword [0x006931c0], 0x2f
mov eax, dword [0x006942cc]
add eax, dword [0x0069585c]
mov ecx, dword [0x00695924]
add ecx, dword [0x00695c04]
cmp eax, ecx
jle 0x5d40f7
mov eax, dword [0x00695c04]
mov dword [0x006942cc], eax
mov dword [rbp + 0x168], 0xffffffff
mov dword [0x006932a8], 0x326
mov eax, dword [0x006932a8]
sub eax, 0x1b4
mov dword [0x006933e0], eax
mov eax, dword [0x006933ec]
add eax, 1
cmp dword [0x006933ec], eax
jne 0x5d4139
mov ecx, dword [0x00693508]
call sub.kernel32.dll_SetConsoleKeyShortcuts
call fcn.005cf210
cmp eax, dword [0x00696188]
jle 0x5d4150
mov dword [0x00696188], 0x21
mov eax, dword [0x006931c4]
mov dword [0x00696120], eax
mov eax, dword [0x006931c4]
mov dword [0x00696120], eax
mov eax, dword [0x006958d0]
cmp eax, dword [0x00695bb0]
je 0x5d4182
mov eax, dword [0x006958d0]
mov dword [0x00695bb0], eax
mov dword [0x0069327c], 0x30c
mov eax, dword [0x0069327c]
sub eax, 0x1a8
mov dword [0x006933b4], eax
mov eax, dword [0x006942b0]
mov dword [0x006940c4], eax
mov eax, dword [0x006931cc]
mov dword [0x00696124], eax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x430]
call fcn.004108b0
lea rcx, [rbp + 0x1ba]
mov rdx, qword [rbp + 0x38]
call fcn.00430440
call fcn.005d08d0
cmp eax, dword [0x006931b8]
jle 0x5d41ed
mov dword [0x006931b8], 0x2e
mov rcx, qword [rbp + 0x420]
call fcn.005acef0
test al, al
je 0x5d465d
lea rcx, [0x006a8a98]
mov rdx, qword [rbp + 0x420]
call fcn.005aa7b0
test al, al
je 0x5d465d
mov rax, qword [rbp + 0x420]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x3f8], rax
mov rax, qword [rbp + 0x3f8]
lea rax, [rax + 0x2a0]
mov qword [rbp + 0x160], rax
mov eax, dword [0x006931cc]
mov dword [0x00696124], eax
mov eax, dword [0x006958e8]
cmp eax, dword [0x00695bcc]
je 0x5d4270
mov eax, dword [0x006958e8]
mov dword [0x00695bcc], eax
mov eax, dword [0x0069616c]
mov dword [0x00695c08], eax
call fcn.005a2d10
cmp eax, dword [0x006932b4]
jle 0x5d4293
mov dword [0x006932b4], 0x54
mov eax, dword [0x00693290]
add eax, 1
cmp dword [0x00693290], eax
jne 0x5d42bc
mov ecx, dword [0x00694114]
mov edx, dword [0x00695890]
mov r8d, dword [0x00695b8c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005d2cb0
cmp eax, dword [0x00693284]
jle 0x5d42d3
mov dword [0x00693284], 0x48
mov eax, dword [0x0069616c]
mov dword [0x00695c08], eax
mov eax, dword [0x0069584c]
cmp eax, dword [0x00695910]
je 0x5d42f9
mov eax, dword [0x0069584c]
mov dword [0x00695910], eax
mov rax, qword [rbp + 0x420]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov eax, dword [0x006931e0]
mov dword [0x0069613c], eax
call fcn.005d1e00
cmp eax, dword [0x006931f4]
jle 0x5d4334
mov dword [0x006931f4], 0x3c
mov eax, dword [0x006931e0]
mov dword [0x0069613c], eax
mov eax, dword [0x00695850]
cmp eax, dword [0x00695914]
je 0x5d435a
mov eax, dword [0x00695850]
mov dword [0x00695914], eax
mov eax, dword [0x00695808]
add eax, dword [0x006958cc]
mov ecx, dword [0x00695bac]
add ecx, dword [0x00695d9c]
cmp eax, ecx
jle 0x5d4382
mov eax, dword [0x00695d9c]
mov dword [0x00695808], eax
call fcn.005d1e00
cmp eax, dword [0x006931ec]
jle 0x5d4399
mov dword [0x006931ec], 0x3a
mov rax, qword [rbp + 0x418]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x418]
mov rax, qword [rax]
mov rcx, rax
mov rdx, qword [rbp + 0x158]
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x50]
mov eax, dword [0x006940bc]
mov dword [0x00693940], eax
mov eax, dword [0x00693420]
add eax, dword [0x00693520]
mov ecx, dword [0x006931e0]
add ecx, dword [0x006932e8]
cmp ecx, eax
jle 0x5d4401
mov dword [0x006931e0], 0x25
mov ecx, dword [0x006931e0]
add ecx, dword [0x006932e8]
cmp ecx, eax
jle 0x5d441b
mov dword [0x006931e0], 0x25
mov eax, dword [0x00695910]
cmp eax, dword [0x00695bf0]
je 0x5d4435
mov eax, dword [0x00695910]
mov dword [0x00695bf0], eax
mov eax, dword [0x0069614c]
mov dword [0x00695be8], eax
call fcn.005cdc30
mov rax, qword [rbp + 0x418]
mov rcx, qword [rax]
lea rdx, [rbp + 0x160]
mov r8d, 0x2a0
call fcn.004fbd70
mov eax, dword [0x0069396c]
mov dword [0x00693800], eax
mov eax, dword [0x00693424]
add eax, 1
cmp dword [0x00693424], eax
jne 0x5d449f
mov ecx, dword [0x006931d0]
mov edx, dword [0x00693510]
mov r8d, dword [0x006940ac]
mov r9d, dword [0x006957f4]
call sub.advapi32.dll_CryptDuplicateKey
mov dword [0x006931fc], 0x2fc
mov eax, dword [0x006931fc]
sub eax, 0x1a0
mov dword [0x00693308], eax
mov eax, dword [0x006942b4]
mov dword [0x006940c8], eax
mov dword [0x00693204], 0x300
mov eax, dword [0x00693204]
sub eax, 0x1a2
mov dword [0x0069339c], eax
mov rax, qword [rbp + 0x420]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x418]
mov rcx, qword [rcx]
mov rdx, qword [rbp + 0x420]
mov rdx, qword [rdx]
mov r8, rax
call fcn.004fbf30
mov dword [0x00693204], 0x300
mov eax, dword [0x00693204]
sub eax, 0x1a2
mov dword [0x0069339c], eax
mov eax, dword [0x00695854]
cmp eax, dword [0x00695918]
je 0x5d4547
mov eax, dword [0x00695854]
mov dword [0x00695918], eax
call fcn.005d1e00
cmp eax, dword [0x006931ec]
jle 0x5d455e
mov dword [0x006931ec], 0x3a
mov eax, dword [0x00695810]
add eax, dword [0x006958d4]
mov ecx, dword [0x00695944]
add ecx, dword [0x00695d6c]
cmp eax, ecx
jle 0x5d4586
mov eax, dword [0x00695d6c]
mov dword [0x00695810], eax
mov eax, dword [0x006933c8]
add eax, 1
cmp dword [0x006933c8], eax
jne 0x5d45c0
mov ecx, dword [0x00693458]
mov edx, dword [0x00693940]
mov r8d, dword [0x00694130]
mov r9d, dword [0x0069583c]
mov eax, dword [0x00695900]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00696178]
mov dword [0x00695c14], eax
mov dword [0x00693290], 0x318
mov eax, dword [0x00693290]
sub eax, 0x1ae
mov dword [0x006933c8], eax
mov eax, dword [0x0069412c]
add eax, dword [0x00695800]
mov ecx, dword [0x006958c4]
add ecx, dword [0x00695ba4]
cmp eax, ecx
jle 0x5d4609
call fcn.004096f0
mov eax, dword [0x006940ec]
mov dword [0x00693938], eax
mov eax, dword [0x006940ec]
mov dword [0x00693938], eax
mov eax, dword [0x00695908]
cmp eax, dword [0x00695be8]
je 0x5d463b
mov eax, dword [0x00695908]
mov dword [0x00695be8], eax
mov rcx, qword [rbp + 0x410]
lea rdx, [rbp + 0x198]
call fcn.0040ff20
jmp 0x5d465d
mov eax, dword [0x00693290]
mov dword [0x0069618c], eax
mov eax, dword [0x0069339c]
add eax, 1
cmp dword [0x0069339c], eax
jne 0x5d4699
mov ecx, dword [0x0069355c]
mov edx, dword [0x006958c8]
mov r8d, dword [0x00695be0]
mov r9d, dword [0x0069617c]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006932c4]
add eax, 1
cmp dword [0x006932c4], eax
jne 0x5d46b5
mov ecx, dword [0x00695c20]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov dword [0x006931f0], 0x2f4
mov eax, dword [0x006931f0]
sub eax, 0x19c
mov dword [0x006932f8], eax
mov eax, dword [0x006931dc]
mov dword [0x00696138], eax
nop
lea rcx, [rbp + 0x38]
call fcn.0040e920
lea rcx, [rbp + 0x140]
call fcn.0040e970
lea rcx, [rbp + 0x430]
call fcn.0040e9c0
mov rax, qword [rbp + 0x410]
lea rsp, [rbp + 0x400]
pop rbp
ret