Function at 0x1800562d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1800cd230]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rsi, qword [rbp + 0x3c0]
mov r13, r9
xor r9d, r9d
imul r14d, ecx, 0x9ba
mov r12, r8
mov qword [rbp - 0x80], rdx
mov r10, rdx
mov dword [rsp + 0x58], ecx
mov edi, ecx
mov qword [rbp - 0x70], rsi
mov ebx, ecx
lea r11d, [r9 + 0x64]
cmp ecx, r14d
ja 0x180056670
mov esi, dword [rsp + 0x78]
lea ecx, [r9 + 0x47]
imul r15d, edi, 0xa6
lea edx, [rcx + 0x10]
mov edi, dword [rsp + 0x78]
lea eax, [rcx - 0x19]
lea r8d, [r9 + 0x6f]
cmp ebx, 0x32ae
ja 0x180056533
je 0x180056524
cmp ebx, 0x78
ja 0x180056424
je 0x1800563dc
cmp ebx, 0x1a
je 0x1800563b6
cmp ebx, 0x46
je 0x1800563a8
cmp ebx, 0x6c
jne 0x18005665c
lea r8d, [rbx - 0x6b]
mov byte [rbp + 0xb8], 0
lea rdx, [0x1800c201c]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180056469
mov edi, 8
sub edi, dword [r10 + 4]
jmp 0x18005665c
movzx eax, word [0x1800bb434]
mov word [rbp + 0xa8], cx
mov word [rbp + 0xa9], ax
mov eax, 0x2e
mov word [rbp + 0xab], dx
jmp 0x18005665c
mov rax, qword [rbp - 0x70]
mov edx, dword [rax]
mov ecx, edx
test edx, edx
jns 0x1800563eb
lea ecx, [rdx + 1]
mov eax, edx
sar ecx, 1
imul eax, dword [r10]
add ecx, ecx
imul eax, dword [r10 + 4]
inc eax
add eax, ecx
mov dword [r12], eax
lea eax, [rcx + 1]
imul edx, dword [r10]
imul edx, dword [r10 + 4]
add eax, edx
mov dword [r13], eax
mov eax, 0x2e
lea ecx, [rax + 0x19]
lea edx, [rax + 0x29]
jmp 0x18005665c
cmp ebx, 0x10f6
je 0x18005649f
cmp ebx, 0x21d2
je 0x180056489
cmp ebx, 0x2daa
jne 0x18005665c
cmp edi, 8
jge 0x18005665c
mov dword [rsp + 0x68], r9d
lea r8, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov rdx, r10
mov ecx, 0x53
call fcn.18003c160
mov r10, qword [rbp - 0x80]
xor r9d, r9d
mov r8d, 0x6f
lea edx, [r8 - 0x18]
lea ecx, [rdx - 0x10]
lea eax, [rdx - 0x29]
lea r11d, [r8 - 0xb]
jmp 0x18005665c
mov r9d, 0x75
mov word [rbp + 0xd0], r9w
xor r9d, r9d
jmp 0x18005665c
movzx eax, word [0x1800c200c]
lea rcx, [rbp + 0xa8]
mov word [rbp + 0xac], ax
dec rcx
movzx eax, byte [0x1800c200e]
mov byte [rbp + 0xae], al
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800564c4
movzx eax, word [0x1800bcbd8]
mov word [rcx], ax
lea rcx, [rbp + 0xa8]
movzx eax, word [0x1800c2010]
dec rcx
mov word [rbp + 0xaf], r8w
mov word [rbp + 0xb0], ax
movzx eax, byte [0x1800c2012]
mov byte [rbp + 0xb2], al
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180056505
mov eax, dword [0x1800c2014]
mov dword [rcx], eax
mov eax, 0x2e
lea ecx, [rax + 0x19]
jmp 0x18005665c
mov dword [rbp + 0xd2], 0x650073
jmp 0x18005665c
cmp ebx, 0x6542
ja 0x1800565ee
je 0x180056598
cmp ebx, 0x438a
je 0x180056578
cmp ebx, 0x4674
je 0x18005656c
cmp ebx, 0x5466
jne 0x18005665c
mov dword [rbp + 0xdc], 0x64002e
jmp 0x18005665c
mov byte [rbp + 0xb9], 0x6e
jmp 0x18005665c
mov r9d, 0x72
mov dword [rbp + 0xd8], 0x320033
mov word [rbp + 0xd6], r9w
xor r9d, r9d
jmp 0x18005665c
mov word [rbp + 0xe4], r9w
lea rcx, [rbp + 0xd0]
lea r9, [rbp + 0xa8]
mov dword [rbp + 0xe0], 0x6c006c
xor r8d, r8d
mov edx, 0xef
call fcn.180042280
mov r10, qword [rbp - 0x80]
mov rcx, qword [r10 + 0x18]
test rcx, rcx
je 0x1800565e3
lea rdx, [rbp + 0x20]
call rax
mov esi, dword [rbp + 0x2c]
sub esi, dword [rbp + 0x24]
jmp 0x180056469
xor r9d, r9d
mov esi, r9d
jmp 0x180056470
cmp ebx, 0x761e
je 0x180056658
cmp ebx, 0x8c7c
je 0x180056612
cmp ebx, 0xd284
jne 0x18005665c
mov dword [rbp + 0xc1], 0x5c3a6e6f
jmp 0x18005665c
mov eax, dword [0x1800c2057]
lea rdx, [0x1800c207c]
mov dword [rbp + 0xba], eax
lea rcx, [rbp + 0xbf]
movzx eax, byte [0x1800c205b]
mov r8d, 2
mov byte [rbp + 0xbe], al
mov byte [rbp + 0xbf], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xc1], 0
jmp 0x180056469
mov dword [rsp + 0x5c], esi
add ebx, r15d
cmp ebx, r14d
jbe 0x180056354
mov rsi, qword [rbp - 0x70]
mov edi, dword [rsp + 0x58]
imul eax, edi, 0x46e
mov ebx, edi
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x78], eax
cmp edi, eax
ja case.0x180056841.0
mov r12d, dword [rsp + 0x54]
lea rdx, [0x180000000]
movzx r14d, byte [rsp + 0x51]
mov ecx, 0x61
mov r13, qword [rbp - 0x58]
lea r15d, [rcx - 0x3d]
lea r8d, [rcx + 4]
lea r11d, [rcx - 0x22]
nop
cmp ebx, 0xcd74
ja 0x1800567e1
je 0x1800567c8
cmp ebx, 0x44c4
ja 0x180056746
je 0x180056737
cmp ebx, 0x1a
je case.0x180056841.0
cmp ebx, 0x6c
je 0x180056721
cmp ebx, 0x2298
jne 0x180056b9d
mov eax, 0x6e
mov dword [rbp + 0xf0], 0x550024
mov word [rbp + 0xf4], ax
mov eax, 0x64
mov word [rbp + 0xfe], ax
mov dword [rbp + 0xf6], 0x61006e
mov dword [rbp + 0xfa], 0x65006d
jmp 0x180056b9d
mov dword [rbp + 0xc5], 0x7325203a
mov byte [rbp + 0xc9], 0
jmp 0x180056b9d
mov dword [rbp + 0x100], 0x6c0043
jmp 0x180056b9d
cmp ebx, 0x66f0
je 0x1800567a0
cmp ebx, 0x891c
je 0x180056771
cmp ebx, 0xab48
jne 0x180056b9d
mov dword [rbp + 0x11e], 0x5c003a
jmp 0x180056b9d
mov eax, 0x37
mov dword [rbp + 0x112], 0x630061
mov word [rbp + 0x110], ax
mov dword [rbp + 0x116], 0x370063
mov dword [rbp + 0x11a], 0x300064
jmp 0x180056b9d
mov word [rbp + 0x104], cx
mov dword [rbp + 0x106], 0x730073
mov word [rbp + 0x10a], r15w
mov dword [rbp + 0x10c], 0x780030
jmp 0x180056b9d
mov dword [rbp + 0x122], 0x240037
mov dword [rbp + 0x126], 0x350033
jmp 0x180056b9d
cmp ebx, 0x15624
ja 0x180056fcd
je 0x180056c2c
cmp ebx, 0xefa0
je 0x180056c1b
cmp ebx, 0x111cc
je 0x180056bd4
cmp ebx, 0x133f8
jne 0x180056b9d
mov r15, qword [rbp - 0x60]
cmp r15, 0xffffffffffffffff
jne 0x1800568af
mov edi, 7
mov dword [rsp + 0x54], edi
nop
cmp edi, 7
ja case.default.0x180056841
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x5704c]
add rcx, rdx
jmp rcx
mov eax, 0x7a
mov word [rbp + 9], ax
mov word [rbp + 0xa], r8w
mov dword [rbp + 0xb], 0x702064
jmp case.default.0x180056841
xor edx, edx
mov byte [rsp + 0x50], 1
xor r8d, r8d
mov qword [rbp - 0x50], 0xffffffffffffffff
mov dword [rbp - 0x64], 0x104
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x68], eax
mov r11d, 0x3f
lea rdx, [0x180000000]
mov r8d, 0x65
dec edi
mov r9d, 0
mov dword [rsp + 0x54], edi
lea eax, [rdi + 0xa]
cmp eax, 9
ja 0x180056830
mov ebx, dword [rsp + 0x60]
mov edi, dword [rsp + 0x58]
xor eax, eax
xor edx, edx
mov rcx, r15
mov dword [rbp - 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8, qword [rsi + 0x10]
mov r12d, eax
mov dword [rsp + 0x54], r12d
mov ecx, eax
cmp r12, r8
ja 0x180056b41
mov qword [rsi + 0x10], rcx
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800568e7
mov rdx, qword [rsi]
mov byte [rdx + r12], 0
jmp 0x180056b83
mov dword [rbp + 5], 0x696e676f
jmp case.default.0x180056841
mov eax, 0x75
mov word [rbp], ax
mov eax, 0x6e
mov word [rbp + 1], ax
mov eax, 0x72
mov word [rbp + 2], ax
mov word [rbp + 3], r8w
mov word [rbp + 4], r11w
jmp case.default.0x180056841
mov eax, 0x75
mov word [rbp + 0xe], ax
mov eax, 0x72
mov word [rbp + 0xf], ax
mov dword [rbp + 0x10], 0x736f70
mov word [rbp + 0x13], r8w
jmp case.default.0x180056841
mov byte [rsp + 0x5c], 0
jmp case.default.0x180056841
movzx eax, byte [rsp + 0x50]
lea rdx, [rbp + 0x130]
cmp dword [rbp - 0x68], 0
lea rcx, [rbp]
mov r8d, dword [rbp - 0x64]
mov r12d, r9d
cmovne r12d, eax
xor r9d, r9d
mov byte [rsp + 0x50], r12b
call qword [sym.imp.dbghelp.dll_UnDecorateSymbolName]
test r12b, r12b
je 0x180056880
mov ebx, 0x18
xor esi, esi
mov r14d, 0x7265
lea edi, [rbx + 0x3b]
lea r15d, [rbx + 0x3e]
lea r12d, [rbx + 0x4d]
lea r13d, [rbx + 0x49]
cmp ebx, 0x1d58
ja 0x180056a8d
je 0x180056a6d
cmp ebx, 0x18
je 0x180056a4a
cmp ebx, 0x768
je 0x180056a2a
cmp ebx, 0xeb8
je 0x180056a01
mov r11d, 0x3f
cmp ebx, 0x1608
jne 0x180056b09
mov eax, 0x4c
mov dword [rbp + 0x9f], 0x6b7272
mov word [rbp + 0x20], ax
mov eax, 0x6e69
mov word [rbp + 0x21], ax
jmp 0x180056b09
mov eax, 0x32
mov word [rbp + 0x9c], ax
mov eax, 0x35
mov word [rbp + 0x9d], ax
mov eax, 0x36
mov word [rbp + 0x9e], ax
jmp 0x180056b03
mov dword [rbp + 0x95], 0x534552
mov word [rbp + 0x98], di
mov dword [rbp + 0x99], 0x5a5350
jmp 0x180056b03
mov word [rbp + 0x90], r15w
mov eax, 0x50
mov dword [rbp + 0x91], 0x4d4f43
mov word [rbp + 0x94], ax
jmp 0x180056b03
mov r11d, 0x3f
mov eax, 0x48
mov word [rbp + 0x23], r11w
mov word [rbp + 0x24], ax
mov word [rbp + 0x25], r12w
mov word [rbp + 0x26], r13w
jmp 0x180056b09
cmp ebx, 0x24a8
je 0x180056af1
cmp ebx, 0x2bf8
je 0x180056ab1
cmp ebx, 0x3348
jne 0x180056b03
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x180056b03
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x240]
mov qword [rsp + 0x48], rsi
lea r8, [rbp + 0x20]
mov qword [rsp + 0x40], rsi
lea rdx, [rbp + 0x90]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.dbghelp.dll_SymFindFileInPath]
jmp 0x180056b03
mov eax, 0x64
mov byte [rbp + 0x2a], sil
mov word [rbp + 0x27], ax
mov word [rbp + 0x28], r14w
mov r11d, 0x3f
add ebx, 0x750
cmp ebx, 0x3a80
jbe 0x1800569a3
movzx r12d, byte [rsp + 0x50]
mov edi, dword [rsp + 0x54]
movzx r14d, byte [rsp + 0x51]
mov r13, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x70]
mov r15, qword [rbp - 0x60]
mov byte [rsp + 0x50], r12b
jmp 0x180056886
mov rdx, qword [rsi + 0x18]
mov rdi, rcx
mov rax, rdx
sub rdi, r8
sub rax, r8
cmp rdi, rax
ja 0x180056bbc
mov qword [rsi + 0x10], rcx
mov rax, rsi
cmp rdx, 0x10
jb 0x180056b66
mov rax, qword [rsi]
lea rbx, [rax + r8]
xor edx, edx
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
mov ebx, dword [rsp + 0x60]
mov edi, dword [rsp + 0x58]
mov r15d, 0x24
mov ecx, 0x61
lea rdx, [0x180000000]
lea r8d, [rcx + 4]
lea r11d, [rcx - 0x22]
imul eax, edi, 0x51
add ebx, eax
mov dword [rsp + 0x60], ebx
cmp ebx, dword [rsp + 0x78]
ja case.0x180056841.0
mov r10, qword [rbp - 0x80]
xor r9d, r9d
jmp 0x1800566b0
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.180005a10
jmp 0x180056b7f
cmp qword [r10 + 0x18], 8
mov rcx, r10
mov dword [rbp + 0x12c], 0x24
jb 0x180056beb
mov rcx, qword [r10]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x60], rax
jmp 0x180056b89
mov eax, 0x33
mov word [rbp + 0x12a], ax
jmp 0x180056b9d
xor edx, edx
mov rcx, rsi
call fcn.180006f30
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x78]
mov rdx, rax
mov r8d, r12d
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, dword [rbp - 0x78]
je 0x180056b83
mov r15d, 0x116
mov dword [rsp + 0x70], r15d
mov eax, r15d
sub eax, 0x116
je 0x180056f5d
sub eax, 1
je 0x180056f2a
sub eax, 1
je 0x180056c9a
cmp eax, 1
je case.0x180056841.0
jmp 0x180056fb3
lea rax, [rbp + 0x90]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180056cb0
cmp dword [rsp + 0x68], 0
jne 0x180056d7c
movzx r12d, byte [rsp + 0x52]
mov edi, 0xea
nop
mov eax, edi
sub eax, 0xea
je 0x180056d51
sub eax, 1
je 0x180056d3a
cmp eax, 1
jne 0x180056d5b
test r12b, r12b
je 0x180056d35
mov ebx, 0x2d
nop dword [rax]
cmp ebx, 0x2d
je 0x180056d08
cmp ebx, 0xd5c
jne 0x180056d27
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x180056d27
xorps xmm0, xmm0
lea rdx, [rbp]
movups xmmword [rbp], xmm0
mov rcx, r13
mov dword [rbp], 0x20
movups xmmword [rbp + 0x10], xmm0
call qword [sym.imp.dbghelp.dll_SymGetSymPrev64]
add ebx, 0xd2f
cmp ebx, 0x1a5e
jbe 0x180056cf0
xor r14b, r14b
jmp 0x180056d5b
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne 0x180056d5b
xor r12b, r12b
jmp 0x180056d5b
mov r12b, 1
mov r13, 0xffffffffffffffff
inc edi
cmp edi, 0xed
jb 0x180056cd0
mov byte [rsp + 0x52], r12b
mov r12d, dword [rsp + 0x54]
mov qword [rbp - 0x58], r13
mov byte [rsp + 0x51], r14b
test r14b, r14b
je 0x180056f0d
mov ebx, 8
lea edi, [rbx + 1]
lea r12d, [rbx + 0x4e]
lea r13d, [rbx + 0x57]
lea r14d, [rbx + 0x3a]
lea r15d, [rbx + 0x46]
nop dword [rax]
cmp ebx, 8
ja case.0x180056dbc.2
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x5706c]
add rcx, rdx
jmp rcx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp case.0x180056dbc.2
mov word [rbp + 0xb], r12w
mov word [rbp + 0xc], r13w
jmp case.0x180056dbc.2
mov r8d, 2
lea rdx, [0x1800c209c]
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x15], 0x49
jmp case.0x180056dbc.2
mov r8d, 4
mov byte [rbp], 0
lea rdx, str.IGIL
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x180056dbc.2
mov r8d, 0xa
mov dword [rbp + 0xd], 0x463456
lea rdx, [rbp + 0x10]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov word [rbp + 0x12], r13w
mov word [rbp + 0x13], r12w
jmp case.0x180056dbc.2
mov rdx, qword [rbp - 0x38]
lea r9, [rbp + 0x30]
mov rcx, qword [rbp - 0x48]
lea r8, [rbp - 0x40]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x30], 0x58
mov dword [rbp + 0x80], 0x7d0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
call qword [sym.imp.dbghelp.dll_SymFromAddr]
lea rcx, [rbp]
mov dword [rsp + 0x68], eax
call qword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
jmp case.0x180056dbc.2
mov r8d, 0xa
mov byte [rbp + 0x16], 0
lea rdx, [rbp + 0x16]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0xa
lea rdx, [rbp + 0x17]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
jmp case.0x180056dbc.2
mov eax, dword [str.ITCO]
mov word [rbp + 4], r13w
mov word [rbp + 5], r14w
mov dword [rbp + 6], eax
mov word [rbp + 0xa], r15w
dec ebx
sub rdi, 1
jne 0x180056da0
movzx r14d, byte [rsp + 0x51]
mov r15d, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x54]
mov r13, qword [rbp - 0x58]
mov edx, esi
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
mov rsi, qword [rbp - 0x70]
mov byte [rsp + 0x5c], 0
jmp 0x180056fb3
xor eax, eax
mov qword [rbp - 0x48], 0xffffffffffffffff
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180056f45
mov rax, qword [rsi]
xor edx, edx
mov byte [rax], 0
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rsp + 0x68], eax
jmp 0x180056fb3
mov eax, dword [0x1800c2090]
lea rdx, [0x1800c2098]
movsd xmm0, qword [str.hexagon_ledf2]
lea rcx, [rbp + 0xa0]
mov dword [rbp + 0x9b], eax
mov r8d, 2
movzx eax, word [0x1800c2094]
mov dword [rbp + 0x90], 0x5f5f25
mov word [rbp + 0x9f], ax
movsd qword [rbp + 0x93], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r14b, 1
mov byte [rsp + 0x51], r14b
inc r15d
mov dword [rsp + 0x70], r15d
cmp r15d, 0x11a
jb 0x180056c70
jmp 0x180056b7b
cmp ebx, 0x17850
je 0x180057014
cmp ebx, 0x19a7c
jne 0x180056b9d
mov byte [rsp + 0x5c], 1
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1800a7b10
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
jmp 0x180056b89