Function at 0x5d1210
Capabilities:
Get disk size

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x90], rcx
nop
mov eax, dword [0x006933e4]
add eax, 1
cmp dword [0x006933e4], eax
jne 0x5d128c
mov ecx, dword [0x00694294]
mov edx, dword [0x00695b8c]
mov r8d, dword [0x0069320c]
mov r9d, dword [0x006933c4]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006931c8]
mov dword [0x00695bac], eax
mov eax, dword [0x006942e8]
cmp eax, dword [0x00695864]
je 0x5d12b2
mov eax, dword [0x006942e8]
mov dword [0x00695864], eax
mov eax, dword [0x006931d0]
add eax, dword [0x006932c4]
mov ecx, dword [0x006933e8]
add ecx, dword [0x006934d4]
cmp eax, ecx
jle 0x5d12d8
mov dword [0x006931d0], 0x3a
mov eax, dword [0x00695b8c]
mov dword [0x006958f0], eax
mov byte [rbp + 0x7f], 0
nop
call fcn.005cc790
cmp eax, dword [0x006931b0]
jle 0x5d1300
mov dword [0x006931b0], 0x19
mov eax, dword [0x0069412c]
add eax, dword [0x00694304]
mov ecx, dword [0x006958cc]
add ecx, dword [0x00695930]
cmp eax, ecx
jle 0x5d1328
mov eax, dword [0x00695930]
mov dword [0x0069412c], eax
call fcn.005cdc30
cmp eax, dword [0x006931e0]
jle 0x5d133f
mov dword [0x006931e0], 0x32
mov eax, dword [0x00693960]
mov dword [0x00693554], eax
mov rax, qword [rbp + 0x90]
mov dword [rax + 0x432], 0xffffffff
lea rcx, [rbp + 0x50]
lea rdx, [0x006924a5]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x40]
lea rdx, [0x006924cf]
mov r8d, 6
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x30]
lea rdx, [0x006a8721]
call fcn.0040ff20
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
mov r8d, 1
mov r9d, 5
call fcn.00410530
lea rcx, [rbp + 0x60]
mov edx, 4
mov r8, qword [rbp + 0x58]
mov r9, qword [rbp + 0x48]
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea rax, [0x005d15e0]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 0x436
call fcn.005d0a10
test al, al
je 0x5d1501
mov eax, dword [0x00693960]
mov dword [0x00693554], eax
mov eax, dword [0x00695870]
cmp eax, dword [0x00695920]
je 0x5d1454
mov eax, dword [0x00695870]
mov dword [0x00695920], eax
mov eax, dword [0x00694120]
add eax, dword [0x006942f8]
mov ecx, dword [0x00695874]
add ecx, dword [0x00695924]
cmp eax, ecx
jle 0x5d147c
mov eax, dword [0x00695924]
mov dword [0x00694120], eax
call fcn.005cad30
mov eax, dword [0x006932f4]
add eax, 1
cmp dword [0x006932f4], eax
jne 0x5d14aa
mov ecx, dword [0x0069582c]
mov edx, dword [0x00695ba8]
mov r8d, dword [0x006931f4]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006940c4]
add eax, dword [0x0069429c]
mov ecx, dword [0x00695818]
add ecx, dword [0x006958c8]
cmp eax, ecx
jle 0x5d14cb
call fcn.004096f0
mov eax, dword [0x006931bc]
mov dword [0x00695ba0], eax
mov eax, dword [0x006931bc]
mov dword [0x00695ba0], eax
mov eax, dword [0x006942f4]
cmp eax, dword [0x00695874]
je 0x5d14fd
mov eax, dword [0x006942f4]
mov dword [0x00695874], eax
mov byte [rbp + 0x7f], 1
call fcn.005cff60
cmp eax, dword [0x0069320c]
jle 0x5d1522
mov dword [0x0069320c], 0x3d
jmp 0x5d1522
mov eax, dword [0x00695b90]
mov dword [0x006958c4], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040ea60
lea rcx, [rbp + 0x40]
call fcn.0040e970
lea rcx, [rbp + 0x48]
call fcn.0040e9c0
lea rcx, [rbp + 0x50]
call fcn.0040e970
lea rcx, [rbp + 0x58]
mov edx, 2
call fcn.0040ea60
movzx rax, byte [rbp + 0x7f]
lea rsp, [rbp + 0x80]
pop rbp
ret