Function at 0x14003f2ec
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rbp, r8
mov r15, rdx
mov r13, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f343
test byte [rcx + 0x1c], 1
je 0x14003f343
cmp byte [rcx + 0x19], 4
jb 0x14003f343
mov rcx, qword [rcx + 0x10]
lea r8, [0x140003c28]
mov edx, 0x238
call fcn.14001dd24
xor ebx, ebx
mov edi, ebx
mov r14d, ebx
mov dword [rsp + 0x30], ebx
mov esi, ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0xb0], ebx
cmp dword [r13 + reloc.ADVAPI32.dll_TraceEvent], ebx
ja 0x14003f37d
lea r8, [0x140004888]
lea rcx, [0x140003c50]
mov edx, 0x3464
call fcn.1400a8be8
test r15, r15
jne 0x14003f39a
lea r8, [0x1400033a0]
lea rcx, [0x140003c50]
mov edx, 0x3465
call fcn.1400a8be8
mov qword [r15], rbx
mov dword [rbp], ebx
mov ecx, dword [r13 + reloc.ADVAPI32.dll_TraceEvent]
test ecx, ecx
je 0x14003f3d0
mov rax, qword [r13 + 0xd8]
mov edx, ecx
add rax, 0x14
cmp dword [rax], 0xc
je 0x14003f3c0
inc r14d
add rax, 0x170
dec rdx
jne 0x14003f3b8
mov dword [rsp + 0x30], r14d
mov ebp, r14d
imul rbp, rbp, 0x78
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r12, rax
test rax, rax
jne 0x14003f3f2
mov edi, 0x8007000e
jmp 0x14003f692
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rsp + 0xc8], ebx
cmp dword [r13 + reloc.ADVAPI32.dll_TraceEvent], ebx
jbe 0x14003f613
mov r14, rbx
mov qword [rsp + 0x40], r12
mov r15, qword [r13 + 0xd8]
test rsi, rsi
je 0x14003f435
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x38], rbx
mov edx, dword [r14 + r15 + 0x54]
lea rcx, [r15 + 0x44]
lea r8, [rsp + 0x38]
add rcx, r14
xor r9d, r9d
call fcn.1400ac7e4
mov edi, eax
test eax, eax
js 0x14003f789
cmp dword [r14 + r15 + 0x14], 0xc
mov rsi, qword [rsp + 0x38]
jne 0x14003f4ad
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f5e2
test byte [rcx + 0x1c], 1
je 0x14003f5e2
cmp byte [rcx + 0x19], 4
jb 0x14003f5e2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140003c28]
mov edx, 0x23a
mov r9, rsi
call fcn.14001ec40
jmp 0x14003f5e2
movups xmm0, xmmword [r14 + r15 + 0x44]
mov rax, qword [rsp + 0x40]
inc dword [rsp + 0xb0]
mov rbp, rax
add rax, 0x78
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x18]
movdqu xmmword [rbp], xmm0
movups xmm1, xmmword [r14 + r15 + 0x138]
movdqu xmmword [rbp + 0x50], xmm1
mov eax, dword [r14 + r15 + 0x54]
mov dword [rbp + 0x10], eax
mov eax, dword [r14 + r15 + 0x40]
mov dword [rbp + 0x40], eax
mov rcx, qword [r14 + r15 + 0x58]
call fcn.1400a99e4
mov edi, eax
test eax, eax
js 0x14003f646
mov rcx, qword [r14 + r15 + 0x60]
lea rdx, [rbp + 0x20]
xor r8d, r8d
call fcn.1400a99e4
mov edi, eax
test eax, eax
js 0x14003f646
mov byte [rbp + 0x28], bl
mov al, byte [r14 + r15 + 0x68]
lea r8, [rbp + 0x14]
mov dl, 1
mov rcx, rsi
mov byte [rbp + 0x29], al
call fcn.140153ce4
mov edi, eax
test eax, eax
js 0x14003f757
lea rdx, [rbp + 0x30]
mov rcx, rsi
call fcn.140152b50
mov edi, eax
test eax, eax
js 0x14003f725
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov qword [rbp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x14003f589
mov rcx, rsi
call fcn.140154be4
mov edi, eax
jmp 0x14003f594
mov rax, qword [rsp + 0x48]
mov edi, ebx
mov qword [rbp + 0x38], rax
test edi, edi
js 0x14003f6d9
mov rdx, qword [r14 + r15 + 0x70]
movzx ecx, word [r14 + r15 + 0x6a]
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x44]
call fcn.1400ac8f8
mov edi, eax
test eax, eax
js 0x14003f646
mov rax, qword [r14 + r15 + 0xe8]
mov qword [rbp + 0x60], rax
mov rax, qword [r14 + r15 + 0xf0]
mov qword [rbp + 0x68], rax
mov rax, qword [r14 + r15 + 0xf8]
mov qword [rbp + 0x70], rax
mov eax, dword [rsp + 0xc8]
add r14, 0x170
inc eax
mov dword [rsp + 0xc8], eax
cmp eax, dword [r13 + reloc.ADVAPI32.dll_TraceEvent]
jb 0x14003f41b
mov r14d, dword [rsp + 0x30]
mov r15, qword [rsp + 0xb8]
cmp r14d, dword [rsp + 0xb0]
je 0x14003f635
lea r8, [0x140004898]
lea rcx, [0x140003c50]
mov edx, 0x34d3
call fcn.1400a8be8
mov rax, qword [rsp + 0xc0]
mov qword [r15], r12
mov r12, rbx
mov dword [rax], r14d
mov rcx, qword [0x14017d3a8]
test rsi, rsi
je 0x14003f662
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test r12, r12
je 0x14003f699
cmp dword [r13 + reloc.ADVAPI32.dll_TraceEvent], ebx
jbe 0x14003f689
mov ecx, ebx
imul rcx, rcx, 0x78
add rcx, r12
call fcn.14012268c
inc ebx
cmp ebx, dword [r13 + reloc.ADVAPI32.dll_TraceEvent]
jb 0x14003f670
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f6c6
test byte [rcx + 0x1c], 1
je 0x14003f6c6
cmp byte [rcx + 0x19], 4
jb 0x14003f6c6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140003c28]
mov edx, 0x23e
call fcn.14001dd24
mov eax, edi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f64d
test byte [rcx + 0x1c], 1
je 0x14003f64d
cmp byte [rcx + 0x19], 2
jb 0x14003f64d
mov edx, 0x23d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140003c28]
mov r9, rsi
mov dword [rsp + 0x20], edi
call fcn.14001ecbc
jmp 0x14003f646
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f64d
test byte [rcx + 0x1c], 1
je 0x14003f64d
cmp byte [rcx + 0x19], 2
jb 0x14003f64d
mov edx, 0x23c
jmp 0x14003f709
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f64d
test byte [rcx + 0x1c], 1
je 0x14003f64d
cmp byte [rcx + 0x19], 2
jb 0x14003f64d
mov edx, 0x23b
jmp 0x14003f709
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003f7ca
test byte [rcx + 0x1c], 1
je 0x14003f7ca
cmp byte [rcx + 0x19], 2
jb 0x14003f7ca
mov rcx, qword [rcx + 0x10]
lea r8, [0x140003c28]
mov edx, 0x239
mov r9d, edi
call fcn.14001de24
mov rsi, qword [rsp + 0x38]
jmp 0x14003f646
mov rsi, qword [rsp + 0x38]
jmp 0x14003f64d