Function at 0x63a360
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
nop
mov eax, dword [0x00699c38]
mov dword [0x006995cc], eax
call fcn.00618050
mov eax, dword [0x006968b8]
add eax, dword [0x006974a8]
mov ecx, dword [0x006989b0]
add ecx, dword [0x00698fa0]
cmp eax, ecx
jle 0x63a3bb
mov eax, dword [0x00698fa0]
mov dword [0x006968b8], eax
mov eax, dword [0x00693454]
add eax, 1
cmp dword [0x00693454], eax
jne 0x63a423
mov eax, dword [0x00698b28]
test eax, eax
jge 0x63a3db
call fcn.0040afc0
mov ecx, dword [0x00699610]
test ecx, ecx
jge 0x63a3ea
call fcn.0040afc0
mov edx, dword [0x006935ec]
test edx, edx
jge 0x63a3f9
call fcn.0040afc0
mov r8d, dword [0x006942b8]
test r8d, r8d
jge 0x63a40a
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
call fcn.00606430
mov eax, dword [0x006968b8]
add eax, dword [0x006974a8]
mov ecx, dword [0x006989b0]
add ecx, dword [0x00698fa0]
cmp eax, ecx
jle 0x63a450
mov eax, dword [0x00698fa0]
mov dword [0x006968b8], eax
mov eax, dword [0x00698f8c]
cmp eax, dword [0x00699544]
je 0x63a46a
mov eax, dword [0x00698f8c]
mov dword [0x00699544], eax
mov eax, dword [0x00699dac]
mov dword [0x00699858], eax
lea rcx, [rbp + 0x30]
lea rdx, [0x0069271f]
mov r8d, 0xc
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
xor r8, r8
call fcn.005a8ac0
mov rcx, qword [rbp + 0x38]
call fcn.00410050
mov rcx, rax
call qword [0x006a8b70]
mov rbx, rax
lea rcx, [rbp + 0x28]
lea rdx, [0x0069272c]
mov r8d, 0x15
mov r9d, 0x2d
call fcn.00597b20
mov rcx, qword [rbp + 0x28]
call fcn.0040fbe0
mov rcx, rbx
mov rdx, rax
call qword [0x006a8c48]
mov rcx, rax
lea rdx, [0x00639f70]
mov r8b, 2
call fcn.005cab20
mov qword [0x006aaa70], rax
test rax, rax
je 0x63a55b
mov eax, dword [0x00693934]
add eax, 1
cmp dword [0x00693934], eax
jne 0x63a55b
mov eax, dword [0x006940b8]
test eax, eax
jge 0x63a52a
call fcn.0040afc0
mov ecx, dword [0x00696a8c]
test ecx, ecx
jge 0x63a539
call fcn.0040afc0
mov edx, dword [0x006980d8]
test edx, edx
jge 0x63a548
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696898]
add eax, dword [0x00697488]
mov ecx, dword [0x00698990]
add ecx, dword [0x006990a8]
cmp eax, ecx
jle 0x63a57c
call fcn.004096f0
mov eax, dword [0x00696898]
add eax, dword [0x00697488]
mov ecx, dword [0x00698990]
add ecx, dword [0x006990a8]
cmp eax, ecx
jle 0x63a59d
call fcn.004096f0
mov eax, dword [0x00698d38]
cmp eax, dword [0x006994c0]
je 0x63a5b7
mov eax, dword [0x00698d38]
mov dword [0x006994c0], eax
mov dword [0x006932e4], 0x302
mov eax, dword [0x006932e4]
sub eax, 0x1a3
mov dword [0x00693550], eax
mov eax, dword [0x00699be8]
mov dword [0x0069951c], eax
mov eax, dword [0x00693564]
add eax, 1
cmp dword [0x00693564], eax
jne 0x63a647
mov eax, dword [0x00698f88]
test eax, eax
jge 0x63a5ff
call fcn.0040afc0
mov ecx, dword [0x00699898]
test ecx, ecx
jge 0x63a60e
call fcn.0040afc0
mov edx, dword [0x00693290]
test edx, edx
jge 0x63a61d
call fcn.0040afc0
mov r8d, dword [0x006937fc]
test r8d, r8d
jge 0x63a62e
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00696e80]
add eax, dword [0x006978fc]
mov ecx, dword [0x00698e34]
add ecx, dword [0x006990b8]
cmp eax, ecx
jle 0x63a66f
mov eax, dword [0x006990b8]
mov dword [0x00696e80], eax
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040ea30
lea rcx, [rbp + 0x38]
call fcn.0040e9c0
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret