Function at 0x649420
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0xc8
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], rbp
nop
nop
mov eax, dword [0x006933f4]
add eax, 1
cmp dword [0x006933f4], eax
jne 0x649523
mov eax, dword [0x006965ac]
test eax, eax
jge 0x6494f2
call fcn.0040afc0
mov ecx, dword [0x006994f8]
test ecx, ecx
jge 0x649501
call fcn.0040afc0
mov edx, dword [0x00699d64]
test edx, edx
jge 0x649510
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069393c]
add eax, 1
cmp dword [0x0069393c], eax
jne 0x6495a1
mov eax, dword [0x006942c0]
test eax, eax
jge 0x649543
call fcn.0040afc0
mov ecx, dword [0x00698960]
test ecx, ecx
jge 0x649552
call fcn.0040afc0
mov edx, dword [0x006994c8]
test edx, edx
jge 0x649561
call fcn.0040afc0
mov r8d, dword [0x00699a74]
test r8d, r8d
jge 0x649572
call fcn.0040afc0
mov r9d, dword [0x0069a508]
test r9d, r9d
jge 0x649583
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov dword [0x00693414], 0x33d
mov eax, dword [0x00693414]
sub eax, 0x1b0
mov dword [0x00693908], eax
call fcn.00623820
call fcn.00639780
cmp eax, dword [0x006931b4]
jle 0x6495d9
mov dword [0x006931b4], 0x6f
mov eax, dword [0x0069a024]
mov dword [0x00699890], eax
mov eax, dword [0x0069a024]
mov dword [0x00699890], eax
mov eax, dword [0x00698b10]
cmp eax, dword [0x006994c4]
je 0x64960b
mov eax, dword [0x00698b10]
mov dword [0x006994c4], eax
lea rcx, [rbp + 0x98]
lea rdx, [0x0069265a]
mov r8d, 0x16
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x88]
lea rdx, [0x00692671]
mov r8d, 5
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x88]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x90]
call fcn.00410070
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0xa0]
call fcn.004108b0
mov rcx, 0xffffffff80000001
mov rdx, qword [rbp + 0x80]
lea r8, [rbp + 0xb8]
call fcn.005e7190
test al, al
je 0x649a57
mov eax, dword [0x006932dc]
add eax, 1
cmp dword [0x006932dc], eax
jne 0x649729
mov eax, dword [0x006932d4]
test eax, eax
jge 0x6496e1
call fcn.0040afc0
mov ecx, dword [0x00695918]
test ecx, ecx
jge 0x6496f0
call fcn.0040afc0
mov edx, dword [0x00696cc8]
test edx, edx
jge 0x6496ff
call fcn.0040afc0
mov r8d, dword [0x00698100]
test r8d, r8d
jge 0x649710
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00696ccc]
mov dword [0x006962d8], eax
mov eax, dword [0x00693298]
mov dword [0x0069a97c], eax
mov eax, dword [0x00693298]
mov dword [0x0069a97c], eax
mov eax, dword [0x006990c0]
cmp eax, dword [0x006995d0]
je 0x649767
mov eax, dword [0x006990c0]
mov dword [0x006995d0], eax
lea rcx, [rbp + 0x70]
lea rdx, [0x0069265a]
mov r8d, 0x16
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x60]
lea rdx, [0x00692677]
mov r8d, 0xb
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x68]
call fcn.00410070
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x78]
call fcn.004108b0
mov rcx, 0xffffffff80000001
mov rdx, qword [rbp + 0x58]
lea r8, [rbp + 0xb0]
call fcn.005e7190
test al, al
je 0x649a57
call fcn.00619970
mov eax, dword [0x006933d8]
add eax, 1
cmp dword [0x006933d8], eax
jne 0x649852
mov eax, dword [0x00695c0c]
test eax, eax
jge 0x649821
call fcn.0040afc0
mov ecx, dword [0x00698124]
test ecx, ecx
jge 0x649830
call fcn.0040afc0
mov edx, dword [0x00698fcc]
test edx, edx
jge 0x64983f
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00698b2c]
add eax, dword [0x006990c4]
mov ecx, dword [0x0069985c]
add ecx, dword [0x00699de0]
cmp eax, ecx
jle 0x64987a
mov eax, dword [0x00699de0]
mov dword [0x00698b2c], eax
mov eax, dword [0x00696a78]
mov dword [0x00696134], eax
call fcn.00635140
cmp eax, dword [0x0069a9b8]
jle 0x64989d
mov dword [0x0069a9b8], 0x32
mov ebx, dword [0x006940e0]
add ebx, dword [0x006958dc]
mov eax, dword [0x0069ac30]
add eax, dword [0x00693538]
cmp eax, ebx
jle 0x6498c3
mov dword [0x0069ac30], 0xd1
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
call fcn.00410d80
test eax, eax
je 0x649a57
mov eax, dword [0x0069ac30]
add eax, dword [0x00693538]
cmp eax, ebx
jle 0x6498f8
mov dword [0x0069ac30], 0xd1
mov eax, dword [0x006994c4]
cmp eax, dword [0x00699a70]
je 0x649912
mov eax, dword [0x006994c4]
mov dword [0x00699a70], eax
mov eax, dword [0x0069aab8]
add eax, dword [0x006932d8]
mov ecx, dword [0x006935f8]
add ecx, dword [0x00694120]
cmp eax, ecx
jle 0x649938
mov dword [0x0069aab8], 0x28
mov dword [0x0069328c], 0x308
mov eax, dword [0x0069328c]
sub eax, 0x1a6
mov dword [0x00693440], eax
lea rcx, [rbp + 0x48]
lea rdx, [0x0069265a]
mov r8d, 0x16
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x38]
lea rdx, [0x00692677]
mov r8d, 0xb
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
call fcn.00410070
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
call fcn.004108b0
mov rcx, 0xffffffff80000001
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0xb8]
call fcn.005e7a20
test al, al
je 0x649a57
mov ecx, 0x57
xor edx, edx
xor r8, r8
mov r9d, 3
call qword [0x006a90c0]
jmp 0x649a57
mov eax, dword [0x0069a96c]
add eax, dword [0x00693288]
mov ecx, dword [0x00693524]
add ecx, dword [0x006940cc]
cmp eax, ecx
jle 0x649a7d
mov dword [0x0069a96c], 0xe4
mov dword [0x00693294], 0x30a
mov eax, dword [0x00693294]
sub eax, 0x197
mov dword [0x00693530], eax
nop
lea rcx, [rbp + 0x30]
call fcn.0040e920
lea rcx, [rbp + 0x38]
call fcn.0040e970
lea rcx, [rbp + 0x40]
call fcn.0040e9c0
lea rcx, [rbp + 0x48]
call fcn.0040e970
lea rcx, [rbp + 0x50]
call fcn.0040e9c0
lea rcx, [rbp + 0x58]
call fcn.0040e920
lea rcx, [rbp + 0x60]
call fcn.0040e970
lea rcx, [rbp + 0x68]
call fcn.0040e9c0
lea rcx, [rbp + 0x70]
call fcn.0040e970
lea rcx, [rbp + 0x78]
call fcn.0040e9c0
lea rcx, [rbp + 0x80]
call fcn.0040e920
lea rcx, [rbp + 0x88]
call fcn.0040e970
lea rcx, [rbp + 0x90]
call fcn.0040e9c0
lea rcx, [rbp + 0x98]
call fcn.0040e970
lea rcx, [rbp + 0xa0]
call fcn.0040e9c0
lea rcx, [rbp + 0xb0]
mov edx, 2
call fcn.0040ea00
lea rsp, [rbp + 0xc8]
pop rbx
pop rbp
ret