Function at 0x140060acc
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, r8
mov bl, dl
mov rsi, rcx
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
mov r15d, 0x200
cmp rcx, r13
je 0x140060b26
test dword [rcx + 0x1c], r15d
je 0x140060b26
cmp byte [rcx + 0x19], 4
jb 0x140060b26
mov rcx, qword [rcx + 0x10]
lea edx, [r15 - 0x40]
lea r8, [0x1400068c8]
call fcn.14001dd24
xor r12d, r12d
mov rcx, rdi
mov byte [rbp + 0x48], r12b
mov qword [rbp - 0x20], r12
call fcn.14015f5f8
test bl, bl
je 0x140060b5d
or dword [rdi + 0x58], 3
lea rcx, [rbp - 0x20]
call fcn.1400b0e54
mov ebx, eax
test eax, eax
js 0x140061044
mov rsi, qword [rbp - 0x20]
jmp 0x140060c6f
lea rdx, [rbp + 0x38]
mov rcx, rsi
mov byte [rbp + 0x38], r12b
call fcn.140130cc0
test eax, eax
jns 0x140060ba5
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140060ba5
test dword [rcx + 0x1c], r15d
je 0x140060ba5
cmp byte [rcx + 0x19], 3
jb 0x140060ba5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1c1
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
cmp byte [rbp + 0x38], r12b
je 0x140060bb0
bts dword [rdi + 0x58], 8
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2], r12w
jne 0x140060bb4
mov r8, rdi
mov rcx, rsi
call fcn.1400ac484
mov ebx, eax
test eax, eax
jns 0x140060bec
lea r8, [0x140003304]
lea rcx, [0x140005730]
mov edx, 0x2334
call fcn.1400a8be8
jmp 0x140060f6e
mov rdx, qword [rdi]
lea rcx, [0x14017f680]
cmp rdx, qword [rcx]
jne 0x140060c0a
mov rdx, qword [rdi + 8]
cmp rdx, qword [rcx + 8]
jne 0x140060c0a
mov eax, r12d
jmp 0x140060c0f
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
jne 0x140060c18
bts dword [rdi + 0x58], 0xa
lea rdx, [rdi + 0x10]
mov rcx, rsi
call fcn.140151d50
mov ebx, eax
test eax, eax
jns 0x140060c55
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140061040
test dword [rcx + 0x1c], r15d
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1c2
jmp 0x140060caa
mov rcx, qword [rdi + 0x10]
lea rdx, [rdi + 0x18]
xor r8d, r8d
call fcn.1400a99e4
mov ebx, eax
test eax, eax
js 0x140061044
lea rdx, [rdi + 0x50]
mov rcx, rsi
call fcn.14015349c
mov ebx, eax
test eax, eax
jns 0x140060cb3
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140061040
test dword [rcx + 0x1c], r15d
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1c3
mov dword [rsp + 0x20], eax
jmp 0x140060f5b
lea r8, [rdi + 0x38]
mov dl, 1
mov rcx, rsi
call fcn.140153ce4
test eax, eax
jns 0x140060cf9
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140060cf9
test byte [rcx + 0x1c], 1
je 0x140060cf9
cmp byte [rcx + 0x19], 3
jb 0x140060cf9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1c4
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov r13d, dword [rdi + 0x38]
lea rdx, [rdi + 0x20]
mov rcx, rsi
shr r13d, 0xb
and r13b, 1
call fcn.140153a9c
mov ebx, eax
test eax, eax
jns 0x140060d4f
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140061040
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1c5
jmp 0x140060f57
mov rcx, qword [rdi + 0x20]
lea rdx, [rdi + 0x28]
xor r8d, r8d
call fcn.1400a99e4
mov ebx, eax
test eax, eax
js 0x140061044
lea r15, [rdi + 0x30]
mov rcx, rsi
mov rdx, r15
call fcn.140152fbc
mov ebx, eax
test eax, eax
jns 0x140060dc9
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140061040
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1c6
mov r9d, ebx
call fcn.14001de24
jmp 0x140060f6e
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.140152890
mov ebx, eax
test eax, eax
jns 0x140060ded
cmp eax, 0x80780076
jne 0x140060e91
mov qword [r15], r12
mov byte [rdi + 0x56], r12b
mov al, byte [rbp + 0x48]
lea r12, [rdi + 0x40]
mov rcx, rsi
mov rdx, r12
mov byte [rdi + 0x56], al
call fcn.140152b50
mov ebx, eax
test eax, eax
jns 0x140060e52
cmp eax, 0x80070005
jne 0x140060f6e
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140060e4d
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140060e4d
cmp byte [rcx + 0x19], 3
jb 0x140060e4d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1c8
mov r9, rsi
call fcn.14001ec40
and qword [r12], 0
cmp qword [r15], 0
je 0x140060f0a
test r13b, r13b
jne 0x140060f0a
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x48]
xor r12d, r12d
mov rcx, rsi
mov qword [rdi + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x140060ec6
mov rcx, rsi
call fcn.140154be4
mov ebx, eax
jmp 0x140060ed1
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140061040
test byte [rcx + 0x1c], 1
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1c7
jmp 0x140060f57
mov rax, qword [rbp + 0x48]
mov ebx, r12d
mov qword [rdi + 0x48], rax
test ebx, ebx
jns 0x140060f12
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140061040
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1c9
jmp 0x140060f57
mov rax, qword [r12]
mov qword [rdi + 0x48], rax
lea rdx, [rdi + 0x57]
mov rcx, rsi
call fcn.1400ad628
mov ebx, eax
test eax, eax
jns 0x140060f7a
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140061040
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140061040
cmp byte [rcx + 0x19], 3
jb 0x140061040
mov edx, 0x1ca
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov r9, rsi
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
jmp 0x140061040
lea r8, [rdi + 0x5c]
lea rdx, [rdi + 0x60]
mov rcx, rsi
mov word [rdi + 0x54], 0
call fcn.1400aca28
mov ebx, eax
test eax, eax
jns 0x140060fe6
cmp eax, 0x80070005
jne 0x140060f6e
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x140060fd7
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140060fd7
cmp byte [rcx + 0x19], 3
jb 0x140060fd7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1cb
mov r9, rsi
call fcn.14001ec40
and qword [rdi + 0x60], 0
xor r12d, r12d
mov word [rdi + 0x5c], r12w
jmp 0x140060ff0
xor r12d, r12d
lea r13, [0x14017d3a8]
lea rdx, [rdi + 0x78]
mov rcx, rsi
call fcn.1401361e8
mov ebx, eax
test eax, eax
jns 0x14006104c
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x14006103d
test byte [rcx + 0x1c], 1
je 0x14006103d
cmp byte [rcx + 0x19], 3
jb 0x14006103d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1cc
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
mov ebx, r12d
test ebx, ebx
jns 0x140061053
mov rcx, rdi
call fcn.14015f5f8
mov rcx, qword [0x14017d3a8]
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x14006106c
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14006109c
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x14006109c
cmp byte [rcx + 0x19], 4
jb 0x14006109c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400068c8]
mov edx, 0x1cd
call fcn.14001dd24
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret