Function at 0x646240
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov dword [rbp + 0x88], edx
nop
mov eax, dword [0x0069896c]
add eax, dword [0x00698ea0]
mov ecx, dword [0x00696ca0]
add ecx, dword [0x006974c4]
cmp ecx, eax
jle 0x6462a2
mov ecx, dword [0x00698ea0]
mov dword [0x00696ca0], ecx
mov ecx, dword [0x00696ca0]
add ecx, dword [0x006974c4]
cmp ecx, eax
jle 0x6462be
mov eax, dword [0x00698ea0]
mov dword [0x00696ca0], eax
mov eax, dword [0x006989a8]
cmp eax, dword [0x00698fb4]
je 0x6462d8
mov eax, dword [0x006989a8]
mov dword [0x00698fb4], eax
mov eax, dword [0x00699d5c]
mov dword [0x006995e4], eax
call fcn.00619970
mov eax, dword [0x00697440]
mov dword [0x00696594], eax
mov byte [rbp + 0x67], 0
call fcn.0061e9e0
nop
lea rcx, [rbp + 0x38]
lea rdx, [0x006926b7]
mov r8d, 0xc
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.005a8ac0
mov rcx, qword [rbp + 0x40]
call fcn.00410050
mov rcx, rax
call qword [0x006a8b68]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jbe 0x6465d3
mov eax, dword [0x0069aaf4]
add eax, dword [0x006933b4]
mov ecx, dword [0x00693938]
add ecx, dword [0x00695824]
cmp eax, ecx
jle 0x646374
mov dword [0x0069aaf4], 0x24
nop
lea rcx, [rbp + 0x28]
lea rdx, [0x00692698]
mov r8d, 0x1e
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
xor r8, r8
call fcn.005a8ac0
mov rcx, qword [rbp + 0x30]
call fcn.00410050
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call fcn.0041b9e0
mov qword [rbp + 0x58], rax
test rax, rax
je 0x646431
mov eax, dword [0x0069aaf4]
add eax, dword [0x006933b4]
mov ecx, dword [0x00693938]
add ecx, dword [0x00695824]
cmp eax, ecx
jle 0x6463e7
mov dword [0x0069aaf4], 0x24
mov eax, dword [0x00698fbc]
cmp eax, dword [0x00699514]
je 0x646401
mov eax, dword [0x00698fbc]
mov dword [0x00699514], eax
mov eax, dword [0x00696194]
mov dword [0x00695bb8], eax
mov eax, dword [0x0069a960]
mov dword [0x00699d8c], eax
mov rcx, qword [rbp + 0x80]
mov edx, dword [rbp + 0x88]
call qword [rbp + 0x58]
test eax, eax
setne al
mov byte [rbp + 0x67], al
nop
mov eax, dword [0x0069a960]
mov dword [0x00699d8c], eax
mov eax, dword [0x00698b18]
cmp eax, dword [0x006994d0]
je 0x646458
mov eax, dword [0x00698b18]
mov dword [0x006994d0], eax
mov eax, dword [0x0069355c]
add eax, 1
cmp dword [0x0069355c], eax
jne 0x6464c0
mov eax, dword [0x00697444]
test eax, eax
jge 0x646478
call fcn.0040afc0
mov ecx, dword [0x006990c4]
test ecx, ecx
jge 0x646487
call fcn.0040afc0
mov edx, dword [0x00699d4c]
test edx, edx
jge 0x646496
call fcn.0040afc0
mov r8d, dword [0x0069aaac]
test r8d, r8d
jge 0x6464a7
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x0069a984]
add eax, dword [0x006931b8]
mov ecx, dword [0x006933cc]
add ecx, dword [0x00693950]
cmp eax, ecx
jle 0x6464e6
mov dword [0x0069a984], 0xe4
mov eax, dword [0x00693414]
mov dword [0x0069a9c8], eax
mov eax, dword [0x006940e8]
add eax, 1
cmp dword [0x006940e8], eax
jne 0x646543
mov eax, dword [0x00699c2c]
test eax, eax
jge 0x646512
call fcn.0040afc0
mov ecx, dword [0x0069aa68]
test ecx, ecx
jge 0x646521
call fcn.0040afc0
mov edx, dword [0x0069393c]
test edx, edx
jge 0x646530
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069747c]
add eax, dword [0x006989b4]
mov ecx, dword [0x00699394]
add ecx, dword [0x00699890]
cmp eax, ecx
jle 0x64656b
mov eax, dword [0x00699890]
mov dword [0x0069747c], eax
mov eax, dword [0x006933e8]
add eax, 1
cmp dword [0x006933e8], eax
jne 0x646592
mov eax, dword [0x00693980]
test eax, eax
jge 0x64658b
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x0069a698]
add eax, dword [0x0069aac4]
mov ecx, dword [0x006932f0]
add ecx, dword [0x006934fc]
cmp eax, ecx
jle 0x6465b8
mov dword [0x0069a698], 0xf2
cmp qword [rbp + 0x68], 0
jbe 0x6465d3
mov rcx, qword [rbp + 0x68]
call qword [0x006a8e08]
jmp 0x6465d3
mov eax, dword [0x0069a968]
mov dword [0x00699d94], eax
nop
lea rcx, [rbp + 0x28]
call fcn.0040e970
lea rcx, [rbp + 0x30]
call fcn.0040e9c0
lea rcx, [rbp + 0x38]
call fcn.0040e970
lea rcx, [rbp + 0x40]
call fcn.0040e9c0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret