Function at 0x5d2d20
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], rbp
mov dword [rbp + 0xb0], ecx
nop
mov eax, dword [0x0069618c]
mov dword [0x00695d70], eax
call fcn.005cdc30
mov eax, dword [0x0069428c]
add eax, dword [0x0069581c]
mov ecx, dword [0x006958e0]
add ecx, dword [0x00695bc0]
cmp eax, ecx
jle 0x5d2da5
mov eax, dword [0x00695bc0]
mov dword [0x0069428c], eax
mov eax, dword [0x00694128]
add eax, dword [0x006957fc]
mov ecx, dword [0x0069586c]
add ecx, dword [0x00695930]
cmp eax, ecx
jle 0x5d2dc6
call fcn.004096f0
call fcn.005d2cb0
cmp eax, dword [0x00693208]
jle 0x5d2ddd
mov dword [0x00693208], 0x41
mov eax, dword [0x0069584c]
add eax, dword [0x006958dc]
mov ecx, dword [0x00695bbc]
add ecx, dword [0x00696120]
cmp eax, ecx
jle 0x5d2e05
mov eax, dword [0x00696120]
mov dword [0x0069584c], eax
mov eax, dword [0x00696150]
mov dword [0x00695bec], eax
call fcn.005cf210
cmp eax, dword [0x006931b0]
jle 0x5d2e28
mov dword [0x006931b0], 0x1d
nop
mov eax, dword [0x006940ec]
add eax, dword [0x006942d8]
mov ecx, dword [0x00695868]
add ecx, dword [0x006958f4]
cmp eax, ecx
jle 0x5d2e4a
call fcn.004096f0
mov eax, dword [0x00695c14]
mov dword [0x00695934], eax
mov eax, dword [0x00695c14]
mov dword [0x00695934], eax
mov eax, dword [0x00695868]
cmp eax, dword [0x0069592c]
je 0x5d2e7c
mov eax, dword [0x00695868]
mov dword [0x0069592c], eax
mov eax, dword [0x006933c4]
add eax, 1
cmp dword [0x006933c4], eax
jne 0x5d2eac
mov ecx, dword [0x006933e4]
mov edx, dword [0x0069351c]
mov r8d, dword [0x006940b8]
mov r9d, dword [0x006942dc]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00695804]
add eax, dword [0x00695874]
mov ecx, dword [0x00695938]
add ecx, dword [0x00695c18]
cmp eax, ecx
jle 0x5d2ed4
mov eax, dword [0x00695c18]
mov dword [0x00695804], eax
mov eax, dword [0x00696180]
mov dword [0x00695c1c], eax
mov eax, dword [0x006933e0]
add eax, 1
cmp dword [0x006933e0], eax
jne 0x5d2f09
mov ecx, dword [0x006932e4]
mov edx, dword [0x006934e4]
mov r8d, dword [0x00693974]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00694290]
add eax, dword [0x00694304]
mov ecx, dword [0x00695894]
add ecx, dword [0x00695b90]
cmp eax, ecx
jle 0x5d2f31
mov eax, dword [0x00695b90]
mov dword [0x00694290], eax
mov eax, dword [0x006932b8]
mov dword [0x006931b0], eax
mov eax, 0x21
lea rcx, [0x006a8980]
mov qword [rbp + 0x90], rcx
mov rcx, qword [rbp + 0x90]
cmp dword [rcx], 0
jne 0x5d305c
mov rax, qword [rbp + 0x90]
mov ecx, dword [rbp + 0xb0]
mov dword [rax], ecx
mov dword [0x006a8a04], 0xffffffff
lea rcx, [rbp + 0x70]
lea rdx, [0x006924a5]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x60]
lea rdx, [0x006924cf]
mov r8d, 6
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x38]
lea rdx, [0x006a8721]
mov r8d, 1
mov r9d, 5
call fcn.0040f4b0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x38]
call fcn.0040ff20
lea rcx, [rbp + 0x80]
mov edx, 4
mov r8, qword [rbp + 0x78]
mov r9, qword [rbp + 0x68]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [0x005d324c]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov rcx, qword [rbp + 0x80]
lea rdx, [0x006a8980]
mov r8d, 0x88
call fcn.005d0a10
test al, al
je 0x5d306f
mov rcx, qword [0x006a8ac0]
call fcn.005d1f60
jmp 0x5d306f
add qword [rbp + 0x90], 4
sub eax, 1
test eax, eax
jne 0x5d2f51
nop
jmp 0x5d30ee
mov eax, dword [0x006933b4]
add eax, 1
cmp dword [0x006933b4], eax
jne 0x5d3117
mov ecx, dword [0x00693944]
mov edx, dword [0x006958cc]
mov r8d, dword [0x00695c1c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006932a8]
add eax, 1
cmp dword [0x006932a8], eax
jne 0x5d3147
mov ecx, dword [0x0069587c]
mov edx, dword [0x006931f0]
mov r8d, dword [0x006933f8]
mov r9d, dword [0x006934f8]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005cc790
mov eax, dword [0x00694128]
add eax, dword [0x00695800]
mov ecx, dword [0x006958c4]
add ecx, dword [0x00695ba4]
cmp eax, ecx
jle 0x5d316d
call fcn.004096f0
mov dword [0x00693288], 0x313
mov eax, dword [0x00693288]
sub eax, 0x1ab
mov dword [0x006933c0], eax
mov eax, dword [0x0069328c]
add eax, 1
cmp dword [0x0069328c], eax
jne 0x5d31b2
mov ecx, dword [0x00694134]
mov edx, dword [0x006958cc]
mov r8d, dword [0x00695be4]
call sub.kernel32.dll_GetDiskFreeSpaceExW
nop
lea rcx, [rbp + 0x30]
call fcn.0040e9c0
lea rcx, [rbp + 0x60]
call fcn.0040e970
lea rcx, [rbp + 0x68]
call fcn.0040e9c0
lea rcx, [rbp + 0x70]
call fcn.0040e970
lea rcx, [rbp + 0x78]
mov edx, 2
call fcn.0040ea60
lea rsp, [rbp + 0xa0]
pop rbp
ret