Function at 0x516850
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xa8], rbp
mov qword [rbp + 0x160], rcx
nop
mov rcx, qword [rbp + 0x160]
call fcn.00410080
nop
lea rcx, [rbp + 0xd0]
mov edx, 0x40
xor r8, r8
call fcn.0040ba20
lea rcx, [rbp + 0xc8]
mov edx, 0x104
call fcn.004120a0
mov rcx, qword [rbp + 0xc8]
call fcn.00411e10
mov rcx, rax
mov edx, 0x104
call sub.kernel32.dll_GetWindowsDirectoryW
lea rcx, [rbp + 0xc8]
mov edx, eax
call fcn.004120a0
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0xc8]
mov r8d, 1
mov r9d, 3
call fcn.00412480
cmp qword [rbp + 0xc8], 0
jne 0x516956
lea rcx, [rbp + 0xc8]
lea rdx, [0x00516c50]
call fcn.00410750
mov rcx, qword [rbp + 0xc8]
call fcn.00411e10
mov rcx, rax
xor rdx, rdx
lea r8, [rbp + 0xc0]
lea r9, [rbp + 0xb8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
jne 0x51698a
mov qword [rbp + 0xb8], 0
lea rcx, [0x00516c58]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00516c72]
call fcn.0041f960
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
je 0x5169cf
mov dword [rbp + 0xd0], 0x40
lea rcx, [rbp + 0xd0]
call qword [rbp + 0x148]
jmp 0x516a1d
mov dword [rbp + 0x110], 0x38
lea rcx, [rbp + 0x110]
call sub.kernel32.dll_GlobalMemoryStatus
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x98]
mov rax, qword [rbp + 0x100]
lea rax, [rax + 0x80000]
mov r8d, 0x100000
xor edx, edx
div r8
mov rdx, rax
mov r8d, 1
mov r9b, 0x30
call fcn.004257f0
lea rcx, [rbp + 0x90]
mov rax, qword [rbp + 0xf8]
lea rax, [rax + 0x80000]
mov r8d, 0x100000
xor edx, edx
div r8
mov rdx, rax
mov r8d, 1
mov r9b, 0x30
call fcn.004257f0
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0xf0]
lea rax, [rax + 0x80000]
mov r8d, 0x100000
xor edx, edx
div r8
mov rdx, rax
mov r8d, 1
mov r9b, 0x30
call fcn.004257f0
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 0xe8]
lea rax, [rax + 0x80000]
mov r8d, 0x100000
xor edx, edx
div r8
mov rdx, rax
mov r8d, 1
mov r9b, 0x30
call fcn.004257f0
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xb8]
call fcn.00426860
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xc0]
call fcn.00426860
lea rcx, [rbp + 0xa0]
mov edx, 0xb
mov r8, qword [rbp + 0x98]
lea r9, [0x00516ca8]
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [0x00516cb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [0x00516ca8]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [0x00516ce0]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [0x00516ca8]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x60], rax
call fcn.004111f0
mov rcx, qword [rbp + 0x160]
mov rdx, qword [rbp + 0xa0]
call fcn.00411f60
jmp 0x516bbf
nop
lea rcx, [rbp + 0x70]
mov edx, 7
call fcn.00410190
lea rcx, [rbp + 0xc8]
call fcn.00410080
mov rax, qword [rbp + 0x160]
lea rsp, [rbp + 0x150]
pop rbp
ret