Function at 0x140034300
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.14002b620
mov rcx, rax
lea r9, [rsp + 0x40]
lea r8d, [r12 + 0x18]
mov rdx, rbx
call fcn.140041d40
test eax, eax
je 0x140034650
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0x19]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140034645
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140034645
mov edx, dword [rsp + 0x34]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov r8d, dword [0x1401c6d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
or rbp, 0xffffffffffffffff
cmp ecx, 0x10
jne 0x14003442c
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400cbef8
mov rcx, rax
call fcn.1400cd9ec
mov r8d, dword [0x1401c6d80]
test rbx, rbx
je 0x14003460d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
mov r8, rbx
mov edx, 0x19
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400345fd
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx ecx, byte [rax]
dec cl
movzx edx, cl
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
cmp ecx, 0x2000
jae 0x14003449d
mov dword [rsi], 1
lea rdx, str.Low_Integrity
mov rcx, rdi
call fcn.140003450
jmp 0x1400346a6
cmp ecx, 0x3000
jae 0x1400345e3
mov dword [rsi], 2
mov ecx, dword [0x1401c6d80]
imul ecx, ecx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 2
jne 0x1400344dd
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea r15, str.Mediu
test r15, 0xffffffffffff0000
jne 0x140034532
movzx esi, r15w
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x14003459f
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400026e0
mov rbx, qword [rsp + 0x38]
jmp 0x14003459f
mov r14d, dword [rbx - 0x10]
mov rsi, r15
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 5
or eax, ecx
jge 0x140034565
mov edx, 5
lea rcx, [rsp + 0x38]
call fcn.1400024e0
mov rbx, qword [rsp + 0x38]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xa
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
ja 0x140034585
lea r8, [rbx + rsi*2]
call fcn.1400cd0d4
jmp 0x14003458d
mov r8, r15
call fcn.1400cd294
cmp dword [rbx - 0xc], 5
jl 0x1400345d8
mov dword [rbx - 0x10], 5
mov word [rbx + 0xa], r12w
lea r8, str.m_Integrity
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001b610
mov dword [rsp + 0x30], 1
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400346ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400346ae
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rsi], 3
lea rdx, str.High_Integrity
mov rcx, rdi
call fcn.140003450
jmp 0x1400346a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8d, dword [0x1401c6d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 1
jne 0x140034645
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x14014c12c]
test rdx, 0xffffffffffff0000
jne 0x140034697
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x1400346a6
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.1400026e0
jmp 0x1400346a6
mov r8d, 1
mov rcx, rdi
call fcn.1400023f0
nop
mov dword [rsp + 0x30], 1
mov rax, rdi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400cc8b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret