Function at 0x5aa7b0
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov eax, dword [0x006932a0]
add eax, 1
cmp dword [0x006932a0], eax
jne 0x5aa7fe
mov ecx, dword [0x00693538]
mov edx, dword [0x006931b0]
mov r8d, dword [0x00693290]
mov r9d, dword [0x006932f4]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006934b8]
add eax, dword [0x00693504]
mov ecx, dword [0x00693550]
add ecx, dword [0x00693914]
cmp eax, ecx
jle 0x5aa826
mov eax, dword [0x00693914]
mov dword [0x006934b8], eax
mov eax, dword [0x00693434]
mov dword [0x00693400], eax
mov eax, dword [0x00693278]
add eax, 1
cmp dword [0x00693278], eax
jne 0x5aa85b
mov ecx, dword [0x00693284]
mov edx, dword [0x006933ac]
mov r8d, dword [0x006933f8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693988]
mov dword [0x0069393c], eax
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5aa883
mov ecx, dword [0x006932a0]
call sub.kernel32.dll_SetConsoleKeyShortcuts
call fcn.005a8cb0
call fcn.005a9580
cmp eax, dword [0x0069397c]
jle 0x5aa89f
mov dword [0x0069397c], 0xf
mov eax, dword [0x006931f4]
add eax, 1
cmp dword [0x006931f4], eax
jne 0x5aa8cf
mov ecx, dword [0x006934ec]
mov edx, dword [0x00693800]
mov r8d, dword [0x00693948]
mov r9d, dword [0x006931cc]
call sub.advapi32.dll_CryptDuplicateKey
mov byte [rbp + 0x6f], 0
nop
mov eax, dword [0x00693988]
mov dword [0x0069393c], eax
mov eax, dword [0x00693528]
cmp eax, dword [0x006935f4]
je 0x5aa8fa
mov eax, dword [0x00693528]
mov dword [0x006935f4], eax
lea rcx, [rbp + 0x70]
xor edx, edx
xor r8, r8
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call qword [0x006a8ea8]
test eax, eax
je 0x5ab39a
mov eax, dword [0x006931e0]
mov dword [0x00693974], eax
nop
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8d, eax
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x78]
mov qword [rsp + 0x28], rax
call qword [0x006a8ed8]
test eax, eax
je 0x5ab2cb
mov eax, dword [0x006931e0]
mov dword [0x00693974], eax
mov eax, dword [0x0069350c]
cmp eax, dword [0x0069353c]
je 0x5aa99c
mov eax, dword [0x0069350c]
mov dword [0x0069353c], eax
mov eax, dword [0x00693418]
mov dword [0x006933e4], eax
call fcn.005aa780
cmp eax, dword [0x006931bc]
jle 0x5aa9bf
mov dword [0x006931bc], 0x17
mov eax, dword [0x00693418]
add eax, dword [0x006934bc]
mov ecx, dword [0x00693504]
add ecx, dword [0x00693550]
cmp eax, ecx
jle 0x5aa9e0
call fcn.004096f0
call fcn.005a8970
nop
lea rcx, [rbp + 0x80]
xor edx, edx
xor r8, r8
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call qword [0x006a8ea8]
test eax, eax
je 0x5ab204
nop
mov rcx, qword [rbp + 0x80]
mov edx, 0x6610
mov r8d, 1
lea r9, [rbp + 0x88]
call qword [0x006a8ee0]
test eax, eax
je 0x5ab0ef
nop
mov rcx, qword [rbp + 0x88]
xor edx, edx
mov r8d, 8
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
call qword [0x006a8ee8]
test eax, eax
je 0x5ab022
mov ecx, pe_nt_image_headers64
call fcn.00409030
mov qword [rbp + 0x90], rax
nop
mov rcx, qword [rbp + 0x88]
xor edx, edx
mov r8d, 8
xor r9, r9
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
call qword [0x006a8ee8]
test eax, eax
je 0x5ab015
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [rbp + 0x98], rax
nop
mov rax, qword [rbp + 0xd8]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0xd8]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov eax, dword [0x006934b8]
add eax, dword [0x00693500]
mov ecx, dword [0x00693534]
add ecx, dword [0x006937fc]
cmp eax, ecx
jle 0x5aab22
mov eax, dword [0x006937fc]
mov dword [0x006934b8], eax
mov ecx, 0x100080
call fcn.00409030
mov qword [rbp + 0xa8], rax
nop
mov dword [rbp + 0x54], 0
jmp 0x5aad4f
cmp qword [rbp + 0x58], 0x100000
jle 0x5aab54
mov dword [rbp + 0x64], 0x100000
jmp 0x5aab5a
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x64], eax
mov rbx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rax]
mov rdx, rbx
mov r8d, dword [rbp + 0x64]
call fcn.004fab00
mov eax, dword [rbp + 0x64]
mov dword [rbp + 0x60], eax
mov eax, dword [0x006934b8]
add eax, dword [0x00693500]
mov ecx, dword [0x00693534]
add ecx, dword [0x006937fc]
cmp eax, ecx
jle 0x5aaba5
mov eax, dword [0x006937fc]
mov dword [0x006934b8], eax
mov eax, dword [0x0069350c]
cmp eax, dword [0x00693558]
je 0x5aabbf
mov eax, dword [0x0069350c]
mov dword [0x00693558], eax
mov eax, dword [0x006931c8]
add eax, 1
cmp dword [0x006931c8], eax
jne 0x5aabef
mov ecx, dword [0x006934e8]
mov edx, dword [0x00693910]
mov r8d, dword [0x00693974]
mov r9d, dword [0x006931dc]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x0069343c]
add eax, dword [0x006934e0]
mov ecx, dword [0x00693510]
add ecx, dword [0x0069355c]
cmp eax, ecx
jle 0x5aac17
mov eax, dword [0x0069355c]
mov dword [0x0069343c], eax
mov eax, dword [0x006931c4]
mov dword [0x0069395c], eax
mov eax, dword [0x006934bc]
add eax, dword [0x006934ec]
mov ecx, dword [0x00693538]
add ecx, dword [0x00693800]
cmp eax, ecx
jle 0x5aac4b
mov eax, dword [0x00693800]
mov dword [0x006934bc], eax
call fcn.005a8cb0
mov eax, dword [0x00693208]
add eax, 1
cmp dword [0x00693208], eax
jne 0x5aac8a
mov ecx, dword [0x00693290]
mov edx, dword [0x0069339c]
mov r8d, dword [0x00693400]
mov r9d, dword [0x0069344c]
mov eax, dword [0x00693508]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [rbp + 0x60]
sub qword [rbp + 0x58], rax
mov eax, dword [0x0069392c]
mov dword [0x00693568], eax
mov eax, dword [0x0069392c]
mov dword [0x00693568], eax
mov eax, dword [0x00693510]
cmp eax, dword [0x00693540]
je 0x5aacc3
mov eax, dword [0x00693510]
mov dword [0x00693540], eax
mov rcx, qword [rbp + 0x88]
xor edx, edx
or r8d, 0xffffffff
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
call qword [0x006a8ef0]
test eax, eax
je 0x5aad5a
cmp dword [rbp + 0x54], 0
jne 0x5aad06
mov eax, dword [rbp + 0x64]
sub eax, dword [rbp + 0x60]
mov dword [rbp + 0x54], eax
mov rcx, qword [rbp + 0x88]
xor edx, edx
or r8d, 0xffffffff
xor r9, r9
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x30], eax
call qword [0x006a8ef0]
test eax, eax
je 0x5aad5a
mov rcx, qword [rbp + 0x98]
mov rdx, rbx
mov r8d, dword [rbp + 0x64]
call fcn.004fbd70
cmp qword [rbp + 0x58], 0
jg 0x5aab41
nop
cmp qword [rbp + 0x58], 0
jne 0x5aae56
mov eax, dword [rbp + 0x68]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x78]
xor edx, edx
or r8d, 0xffffffff
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
call qword [0x006a8ef0]
test eax, eax
je 0x5aadfe
mov rcx, qword [rbp + 0x78]
xor edx, edx
or r8d, 0xffffffff
xor r9, r9
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x30], eax
call qword [0x006a8ef0]
test eax, eax
je 0x5aadfe
mov rcx, qword [rbp + 0x98]
lea rdx, [rbp + 0x54]
mov r8d, 4
call fcn.004fbd70
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x90]
mov r8d, dword [rbp + 0x64]
call fcn.004fbd70
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rax]
call fcn.004fd260
mov rcx, qword [rbp + 0x98]
xor edx, edx
xor r8, r8
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0xd8]
mov rcx, qword [rcx]
mov rdx, qword [rbp + 0x98]
mov r8, rax
call fcn.004fbf30
mov byte [rbp + 0x6f], 1
nop
mov rcx, qword [rbp + 0xa8]
call fcn.00409060
call fcn.005a8cb0
mov eax, dword [0x00693294]
add eax, 1
cmp dword [0x00693294], eax
jne 0x5aae91
mov ecx, dword [0x006933c0]
mov edx, dword [0x00693514]
mov r8d, dword [0x006935f8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005a9580
cmp eax, dword [0x00693980]
jle 0x5aaea8
mov dword [0x00693980], 0x10
mov eax, dword [0x006933f0]
mov dword [0x006933a4], eax
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5aaedd
mov ecx, dword [0x006931e0]
mov edx, dword [0x006932bc]
mov r8d, dword [0x00693308]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006933f0]
mov dword [0x006933a4], eax
mov eax, dword [0x00693534]
cmp eax, dword [0x006937f8]
je 0x5aaf03
mov eax, dword [0x00693534]
mov dword [0x006937f8], eax
mov eax, dword [0x00693504]
add eax, dword [0x00693534]
mov ecx, dword [0x0069342c]
add ecx, dword [0x006934b8]
cmp ecx, eax
jle 0x5aaf2b
mov ecx, dword [0x00693534]
mov dword [0x0069342c], ecx
mov ecx, dword [0x0069342c]
add ecx, dword [0x006934b8]
cmp ecx, eax
jle 0x5aaf47
mov eax, dword [0x00693534]
mov dword [0x0069342c], eax
mov eax, dword [0x00693534]
cmp eax, dword [0x006937fc]
je 0x5aaf61
mov eax, dword [0x00693534]
mov dword [0x006937fc], eax
mov eax, dword [0x006931b0]
mov dword [0x00693944], eax
nop
mov rcx, qword [rbp + 0x98]
call fcn.0040b500
call fcn.005a9580
mov eax, dword [0x006931b0]
mov dword [0x00693944], eax
mov eax, dword [0x00693534]
cmp eax, dword [0x00693564]
je 0x5aafa5
mov eax, dword [0x00693534]
mov dword [0x00693564], eax
call fcn.005a9670
cmp eax, dword [0x006931c0]
jle 0x5aafbc
mov dword [0x006931c0], 0x11
mov eax, dword [0x00693208]
add eax, 1
cmp dword [0x00693208], eax
jne 0x5aafd8
mov ecx, dword [0x006933ac]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006931f4]
add eax, 1
cmp dword [0x006931f4], eax
jne 0x5aaff4
mov ecx, dword [0x006932fc]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00693420]
add eax, dword [0x006934c0]
mov ecx, dword [0x0069350c]
add ecx, dword [0x00693558]
cmp eax, ecx
jle 0x5ab015
call fcn.004096f0
nop
mov rcx, qword [rbp + 0x90]
call fcn.00409060
nop
mov eax, dword [0x006931fc]
add eax, 1
cmp dword [0x006931fc], eax
jne 0x5ab05d
mov ecx, dword [0x00693440]
mov edx, dword [0x00693970]
mov r8d, dword [0x006931f4]
mov r9d, dword [0x006932b8]
mov eax, dword [0x006933b0]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00693988]
add eax, dword [0x006931f4]
mov ecx, dword [0x00693288]
add ecx, dword [0x006932d4]
cmp eax, ecx
jle 0x5ab083
mov dword [0x00693988], 0x17d
mov eax, dword [0x00693930]
mov dword [0x006935ec], eax
mov eax, dword [0x00693930]
mov dword [0x006935ec], eax
mov eax, dword [0x0069350c]
cmp eax, dword [0x0069353c]
je 0x5ab0b5
mov eax, dword [0x0069350c]
mov dword [0x0069353c], eax
mov eax, dword [0x00693400]
mov dword [0x006933d0], eax
mov eax, dword [0x0069340c]
add eax, dword [0x00693454]
mov ecx, dword [0x006934e0]
add ecx, dword [0x0069352c]
cmp eax, ecx
jle 0x5ab0e2
call fcn.004096f0
mov rcx, qword [rbp + 0x88]
call qword [0x006a8ef8]
nop
mov eax, dword [0x00693964]
add eax, dword [0x006931b8]
mov ecx, dword [0x00693200]
add ecx, dword [0x006932ac]
cmp eax, ecx
jle 0x5ab116
mov dword [0x00693964], 9
mov eax, dword [0x0069340c]
add eax, dword [0x0069343c]
mov ecx, dword [0x006934e0]
add ecx, dword [0x00693514]
cmp eax, ecx
jle 0x5ab137
call fcn.004096f0
mov eax, dword [0x00693298]
add eax, 1
cmp dword [0x00693298], eax
jne 0x5ab153
mov ecx, dword [0x0069340c]
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x0069340c]
add eax, dword [0x0069343c]
mov ecx, dword [0x006934e0]
add ecx, dword [0x00693514]
cmp eax, ecx
jle 0x5ab174
call fcn.004096f0
mov eax, dword [0x0069352c]
cmp eax, dword [0x006935f8]
je 0x5ab18e
mov eax, dword [0x0069352c]
mov dword [0x006935f8], eax
mov dword [0x006931b4], 0x2f8
mov eax, dword [0x006931b4]
sub eax, 0x19e
mov dword [0x00693200], eax
mov eax, dword [0x00693448]
add eax, dword [0x006934d4]
mov ecx, dword [0x0069351c]
add ecx, dword [0x00693568]
cmp eax, ecx
jle 0x5ab1d2
mov eax, dword [0x00693568]
mov dword [0x00693448], eax
call fcn.005a9670
cmp eax, dword [0x006931c0]
jle 0x5ab1e9
mov dword [0x006931c0], 0x12
mov eax, dword [0x00693440]
mov dword [0x006933f8], eax
mov rcx, qword [rbp + 0x80]
xor edx, edx
call qword [0x006a8ed0]
nop
mov eax, dword [0x00693298]
add eax, 1
cmp dword [0x00693298], eax
jne 0x5ab235
mov ecx, dword [0x006934d4]
mov edx, dword [0x00693914]
mov r8d, dword [0x00693978]
mov r9d, dword [0x006931fc]
call sub.advapi32.dll_CryptDuplicateKey
mov dword [0x006931f4], 0x328
mov eax, dword [0x006931f4]
sub eax, 0x1b5
mov dword [0x006932a0], eax
mov dword [0x006931f4], 0x328
mov eax, dword [0x006931f4]
sub eax, 0x1b5
mov dword [0x006932a0], eax
mov eax, dword [0x00693560]
cmp eax, dword [0x00693924]
je 0x5ab287
mov eax, dword [0x00693560]
mov dword [0x00693924], eax
call fcn.005a9580
mov eax, dword [0x006931e8]
add eax, 1
cmp dword [0x006931e8], eax
jne 0x5ab2bc
mov ecx, dword [0x00693404]
mov edx, dword [0x00693934]
mov r8d, dword [0x006931d0]
mov r9d, dword [0x0069327c]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005a8cb0
mov rcx, qword [rbp + 0x78]
call qword [0x006a8ef8]
nop
mov rcx, qword [rbp + 0x70]
xor edx, edx
call qword [0x006a8ed0]
mov eax, dword [0x006931dc]
mov dword [0x00693970], eax
jmp 0x5ab39a
mov eax, dword [0x006934b4]
add eax, dword [0x00693500]
mov ecx, dword [0x00693530]
add ecx, dword [0x006937f8]
cmp eax, ecx
jle 0x5ab3c2
mov eax, dword [0x006937f8]
mov dword [0x006934b4], eax
mov eax, dword [0x00693958]
mov dword [0x0069390c], eax
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0xb8]
pop rbx
pop rbp
ret