Function at 0x140136ae0
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rdx
mov rsi, rcx
xor r12d, r12d
test rdx, rdx
jg 0x140136b45
lea r8, [0x140004160]
mov edx, 0x10d6
lea rcx, [0x1400138f0]
call fcn.1400a8be8
lea rax, [0x14017d3a8]
mov r13d, 1
mov rcx, qword [0x14017d3a8]
cmp rcx, rax
je 0x140136b7f
test byte [rcx + 0x1c], r13b
je 0x140136b7f
cmp byte [rcx + 0x19], 4
jb 0x140136b7f
mov edx, 0x96
lea r8, [0x140013878]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov dword [rbp - 0x70], r12d
mov r14d, r12d
movups xmm0, xmmword [0x14000ab48]
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 0xa
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x20]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
call qword [sym.imp.VSSAPI.DLL_CreateVssBackupComponentsInternal]
mov ebx, eax
test eax, eax
jns 0x140136c2c
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x97
mov r9d, eax
lea r8, [0x140013878]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
jmp 0x14013714d
lea rdi, [0x140005580]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140136c56
lea r8, [0x140005578]
mov edx, 0x9a
mov rcx, rdi
call fcn.1400a8be8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x28]
mov ebx, eax
test eax, eax
jns 0x140136c99
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x98
jmp 0x140136c14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140136cbc
lea r8, [0x140005578]
mov edx, 0x9a
mov rcx, rdi
call fcn.1400a8be8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
or edx, reloc.ADVAPI32.dll_TraceEvent
call qword [rax + 0x118]
mov ebx, eax
test eax, eax
jns 0x140136d03
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x99
jmp 0x140136c14
movups xmm0, xmmword [0x14000ab48]
movdqu xmmword [rbp - 0x60], xmm0
mov rbx, qword [rsp + 0x30]
test rbx, rbx
jne 0x140136d32
lea r8, [0x140005578]
mov edx, 0x9a
mov rcx, rdi
call fcn.1400a8be8
mov rbx, qword [rsp + 0x30]
cmp qword [rsp + 0x38], r12
je 0x140136d4d
lea r8, [0x14000559c]
mov edx, 0x95
mov rcx, rdi
call fcn.1400a8be8
mov rax, qword [rbx]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov r8d, r13d
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [rax + 0x158]
mov ebx, eax
test eax, eax
jns 0x140136dab
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x9a
jmp 0x140136c14
lea rcx, [rbp - 0x18]
call qword [sym.imp.VSSAPI.DLL_VssFreeSnapshotPropertiesInternal]
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x140136de9
lea r8, [0x140005578]
mov edx, 0x9a
mov rcx, rdi
call fcn.1400a8be8
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x20]
mov edx, r13d
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
js 0x14013711d
cmp eax, r13d
je 0x140136f70
mov rdx, rsi
mov rcx, qword [rbp + 0x18]
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140136dab
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
movups xmm0, xmmword [rbp - 0x18]
movdqu xmmword [rsp + 0x78], xmm0
mov r9, qword [rbp + 0x58]
mov qword [rbp - 0x78], r9
mov edx, dword [rsp + 0x58]
test edx, edx
jne 0x140136e53
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
jmp 0x140136ed0
mov rbx, qword [rsp + 0x48]
mov r8d, r12d
test edx, edx
je 0x140136e94
mov eax, r12d
test rbx, rbx
setne al
test eax, eax
je 0x140136f4d
mov rcx, rbx
mov rbx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x50], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x48], rax
cmp qword [rcx + 0x20], r9
jg 0x140136e94
add r8d, r13d
cmp r8d, edx
jb 0x140136e5f
lea rcx, [rsp + 0x48]
cmp r8d, edx
lea rdx, [rsp + 0x78]
jne 0x140136ecb
xor r9d, r9d
mov r8, qword [rsp + 0x50]
call fcn.1401374e0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140136ebf
mov qword [rcx], rax
jmp 0x140136ec4
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
jmp 0x140136f45
test rbx, rbx
jne 0x140136ef9
xor r8d, r8d
mov r9, qword [rsp + 0x48]
call fcn.1401374e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140136eed
mov qword [rcx + 8], rax
jmp 0x140136ef2
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
jmp 0x140136f45
mov r9, rbx
mov r8, qword [rbx + 8]
call fcn.1401374e0
mov rdi, rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140136f16
mov qword [rax], rdi
jmp 0x140136f3a
cmp rbx, qword [rsp + 0x48]
je 0x140136f35
lea r8, [0x140013e60]
mov edx, 0x6a8
lea rcx, [0x140003bf0]
call fcn.1400a8be8
mov qword [rsp + 0x48], rdi
mov qword [rbx + 8], rdi
lea rdi, [0x140005580]
add r14d, r13d
jmp 0x140136dab
lea r8, [0x140001998]
mov edx, 0x51d
lea rcx, [0x140003bf0]
call fcn.1400a8be8
mov ecx, 0x80004005
call fcn.14001ad98
int3
cmp dword [rsp + 0x40], r12d
je 0x140136f8f
lea r8, [0x140013de0]
mov edx, 0x111b
lea rcx, [0x1400138f0]
call fcn.1400a8be8
cmp r14d, dword [rsp + 0x58]
je 0x140136fae
lea r8, [0x140013e28]
mov edx, 0x114a
lea rcx, [0x1400138f0]
call fcn.1400a8be8
mov rdi, qword [rsp + 0x48]
mov rsi, r12
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x140136fd9
xor ecx, ecx
call fcn.140154be4
mov ebx, eax
jmp 0x140136fe0
mov rsi, qword [rbp - 0x68]
mov ebx, r12d
test ebx, ebx
js 0x140137146
cmp rsi, r15
jae 0x140137146
cmp r14d, r13d
jbe 0x1401370e9
mov eax, r12d
test rdi, rdi
setne al
test eax, eax
je 0x1401370c6
mov rcx, rdi
mov rdi, qword [rdi]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x78], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x80], rax
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x78], rax
movups xmm0, xmmword [rsp + 0x78]
movdqu xmmword [rbp - 0x50], xmm0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14013705b
lea r8, [0x140005578]
mov edx, 0x9a
lea rcx, [0x140005580]
call fcn.1400a8be8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, r13d
mov r8d, 3
lea rdx, [rbp - 0x50]
call qword [rax + 0x138]
mov ebx, eax
test eax, eax
js 0x140137091
dec r14d
jmp 0x140136fb3
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x9d
jmp 0x140136c14
lea r8, [0x140001998]
mov edx, 0x51d
lea rcx, [0x140003bf0]
call fcn.1400a8be8
mov ecx, 0x80004005
call fcn.14001ad98
int3
mov ebx, 0x8078015e
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x9c
mov r9d, 0x8078015e
jmp 0x140136c17
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14013714d
test byte [rcx + 0x1c], r13b
je 0x14013714d
cmp byte [rcx + 0x19], 2
jb 0x14013714d
mov edx, 0x9b
jmp 0x140136c14
lea rdi, [0x14017d3a8]
lea rcx, [rbp - 0x18]
call qword [sym.imp.VSSAPI.DLL_VssFreeSnapshotPropertiesInternal]
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x140137196
test byte [rcx + 0x1c], r13b
je 0x140137196
cmp byte [rcx + 0x19], 4
jb 0x140137196
mov edx, 0x9e
lea r8, [0x140013878]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
nop
lea rcx, [rsp + 0x48]
call fcn.1401373fc
cmp qword [rsp + 0x58], r12
je 0x1401371c0
lea r8, [0x1400052a0]
mov edx, 0x588
lea rcx, [0x140003bf0]
call fcn.1400a8be8
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1401371d1
mov rax, qword [rcx]
call qword [rax + CoRevokeClassObject]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401371e1
mov rax, qword [rcx]
call qword [rax + CoRevokeClassObject]
mov eax, ebx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret