Function at 0x5ddfa0
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0xba8
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xb80], 0
mov qword [rbp + 0x88], rbp
mov qword [rbp + 0xbc0], rcx
mov qword [rbp + 0xbc8], rdx
nop
mov eax, dword [0x0069582c]
add eax, dword [0x006958cc]
mov ecx, dword [0x00695bc8]
add ecx, dword [0x00696148]
cmp eax, ecx
jle 0x5de058
mov eax, dword [0x00696148]
mov dword [0x0069582c], eax
mov eax, dword [0x006931e0]
mov dword [0x006965ac], eax
mov byte [rbp + 0xb8f], 0
nop
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [rbp + 0xb98], rax
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [rbp + 0xb90], rax
nop
mov eax, dword [0x006931e0]
mov dword [0x006965ac], eax
mov eax, dword [0x006962e8]
cmp eax, dword [0x006965f4]
je 0x5de0bd
mov eax, dword [0x006962e8]
mov dword [0x006965f4], eax
call fcn.005cce40
call fcn.005ceba0
lea rcx, [rbp + 0x80]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x78]
lea rdx, [0x006a8829]
call fcn.0040ff20
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x78]
call fcn.00410070
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x80]
call fcn.004108b0
mov rcx, qword [rbp + 0x70]
mov dl, 1
call fcn.0042f710
test al, al
je 0x5de171
lea rcx, [rbp + 0x68]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x60]
lea rdx, [0x006a8829]
call fcn.0040ff20
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00410070
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x68]
call fcn.004108b0
mov rcx, qword [rbp + 0xb98]
mov rdx, qword [rbp + 0x58]
call fcn.004fd2e0
mov qword [rbp + 0xb70], 0
mov rcx, qword [rbp + 0xb98]
mov rax, qword [rbp + 0xb98]
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0xb78], rax
mov eax, dword [0x00696304]
mov dword [0x0069612c], eax
call fcn.005d78a0
cmp eax, dword [0x00693204]
jle 0x5de1b9
mov dword [0x00693204], 0x47
call fcn.005cff60
mov rcx, qword [rbp + 0xb98]
mov rax, qword [rbp + 0xb98]
mov rax, qword [rax]
call qword [rax]
lea rcx, [rbp + 0xb80]
mov rdx, qword [rbp + 0xb98]
mov rdx, qword [rdx + 8]
mov r8d, eax
call fcn.005a9750
jmp 0x5de34a
mov rbx, qword [rbp + 0xb98]
mov rcx, rbx
mov rdx, qword [rbp + 0xb70]
xor r8, r8
mov rax, qword [rbx]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0xb98]
lea rdx, [rbp + 0xad]
mov r8d, 0xac3
call fcn.004fab00
mov eax, dword [0x00695850]
add eax, dword [0x006958f0]
mov ecx, dword [0x00695bec]
add ecx, dword [0x0069616c]
cmp eax, ecx
jle 0x5de24c
mov eax, dword [0x0069616c]
mov dword [0x00695850], eax
mov eax, dword [0x006965a4]
mov dword [0x00696184], eax
mov eax, dword [0x006965a4]
mov dword [0x00696184], eax
mov eax, dword [0x00695be0]
cmp eax, dword [0x00696120]
je 0x5de27e
mov eax, dword [0x00695be0]
mov dword [0x00696120], eax
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0xb06]
call fcn.004109a0
lea rcx, [rbp + 0xbc0]
mov rdx, qword [rbp + 0x50]
xor r8, r8
call fcn.005da9a0
test al, al
je 0x5de311
mov rcx, rbx
mov rdx, qword [rbp + 0xb70]
xor r8, r8
mov rax, qword [rbx]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0xb90]
mov rdx, qword [rbp + 0xb98]
mov rax, qword [rbp + 0xb4f]
lea r8, [rax + 0xac3]
call fcn.004fbf30
mov rcx, qword [rbp + 0xb90]
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0xb90]
mov rdx, qword [rbp + 0xa0]
xor r8, r8
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax + 0x50]
mov rax, qword [rbp + 0xb4f]
mov rcx, qword [rbp + 0xb78]
mov rdx, rax
neg rdx
lea rcx, [rcx + rdx - 0xac3]
mov qword [rbp + 0xb78], rcx
mov rcx, qword [rbp + 0xb70]
lea rax, [rcx + rax + 0xac3]
mov qword [rbp + 0xb70], rax
cmp qword [rbp + 0xb78], 0
jg 0x5de1f0
mov rcx, qword [rbp + 0xbc8]
mov rax, qword [rbp + 0xbc8]
mov rax, qword [rax]
call qword [rax]
test rax, rax
jle 0x5de3ea
mov rcx, qword [rbp + 0xbc8]
xor edx, edx
xor r8, r8
mov rax, qword [rbp + 0xbc8]
mov rax, qword [rax]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0xb90]
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xb90]
mov rdx, qword [rbp + 0x98]
xor r8, r8
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0xbc8]
mov rax, qword [rbp + 0xbc8]
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0xb90]
mov rdx, qword [rbp + 0xbc8]
mov r8, rax
call fcn.004fbf30
mov rcx, qword [rbp + 0xb90]
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax]
test rax, rax
jle 0x5de549
mov rcx, qword [rbp + 0xb90]
mov rax, qword [rbp + 0xb90]
mov rax, qword [rax]
call qword [rax]
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0xb90]
mov rdx, qword [rdx + 8]
mov r8d, eax
call fcn.005a9750
mov rcx, qword [rbp + 0xb80]
mov rdx, qword [rbp + 0x48]
call fcn.0040fb90
test eax, eax
je 0x5de540
call fcn.005d9cb0
cmp eax, dword [0x006931e0]
jle 0x5de45f
mov dword [0x006931e0], 0x3e
mov eax, dword [0x006942b8]
add eax, dword [0x00695864]
mov ecx, dword [0x00695904]
add ecx, dword [0x00695c00]
cmp eax, ecx
jle 0x5de480
call fcn.004096f0
mov eax, dword [0x006942b8]
add eax, dword [0x00695864]
mov ecx, dword [0x00695904]
add ecx, dword [0x00695c00]
cmp eax, ecx
jle 0x5de4a1
call fcn.004096f0
mov eax, dword [0x00695c04]
cmp eax, dword [0x00696188]
je 0x5de4bb
mov eax, dword [0x00695c04]
mov dword [0x00696188], eax
mov eax, dword [0x006968b0]
add eax, dword [0x006932bc]
mov ecx, dword [0x00693410]
add ecx, dword [0x00693530]
cmp eax, ecx
jle 0x5de4e1
mov dword [0x006968b0], 0x128
mov eax, dword [0x006931c4]
mov dword [0x00696590], eax
lea rcx, [rbp + 0x40]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x38]
lea rdx, [0x006a8829]
call fcn.0040ff20
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.00410070
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0xb90]
call fcn.005d2300
mov byte [rbp + 0xb8f], al
cmp byte [rbp + 0xb8f], 0
jmp 0x5de59a
mov byte [rbp + 0xb8f], 1
jmp 0x5de59a
lea rcx, [rbp + 0x30]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x28]
lea rdx, [0x006a8829]
call fcn.0040ff20
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.00410070
mov rcx, qword [rbp + 0x30]
call fcn.00410050
mov rcx, rax
call qword [0x006a8cf0]
test eax, eax
setne al
mov byte [rbp + 0xb8f], al
nop
mov eax, dword [0x00695824]
mov dword [0x00694130], eax
mov eax, dword [0x00695884]
add eax, dword [0x00695924]
mov ecx, dword [0x00695c20]
add ecx, dword [0x00696160]
cmp eax, ecx
jle 0x5de5cf
mov eax, dword [0x00696160]
mov dword [0x00695884], eax
mov eax, dword [0x006965f4]
add eax, dword [0x00693288]
mov ecx, dword [0x006933dc]
add ecx, dword [0x006934fc]
cmp eax, ecx
jle 0x5de5f5
mov dword [0x006965f4], 0x2e
call fcn.005d6e40
cmp eax, dword [0x006931e0]
jle 0x5de60c
mov dword [0x006931e0], 0x2d
call fcn.005d3250
mov eax, dword [0x006932b4]
add eax, 1
cmp dword [0x006932b4], eax
jne 0x5de63a
mov ecx, dword [0x006965f4]
mov edx, dword [0x006933dc]
mov r8d, dword [0x0069353c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov rcx, qword [rbp + 0xb98]
call fcn.0040b500
mov rcx, qword [rbp + 0xb90]
call fcn.0040b500
jmp 0x5de724
mov eax, dword [0x00694290]
mov dword [0x00693978], eax
mov dword [0x00693288], 0x308
mov eax, dword [0x00693288]
sub eax, 0x1a6
mov dword [0x006933dc], eax
mov eax, dword [0x00695918]
add eax, dword [0x00695c14]
mov ecx, dword [0x00696194]
add ecx, dword [0x006965b4]
cmp eax, ecx
jle 0x5de774
mov eax, dword [0x006965b4]
mov dword [0x00695918], eax
mov eax, dword [0x006965bc]
mov dword [0x00696198], eax
mov eax, dword [0x006965bc]
mov dword [0x00696198], eax
mov eax, dword [0x00695bd8]
cmp eax, dword [0x00696158]
je 0x5de7a6
mov eax, dword [0x00695bd8]
mov dword [0x00696158], eax
mov eax, dword [0x006933ec]
add eax, 1
cmp dword [0x006933ec], eax
jne 0x5de7d6
mov ecx, dword [0x00695b88]
mov edx, dword [0x006962e0]
mov r8d, dword [0x006965ec]
mov r9d, dword [0x00693304]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005d3730
cmp eax, dword [0x006968b4]
jle 0x5de7ed
mov dword [0x006968b4], 0x2d
mov eax, dword [0x006932bc]
add eax, 1
cmp dword [0x006932bc], eax
jne 0x5de81d
mov ecx, dword [0x00695860]
mov edx, dword [0x00695d84]
mov r8d, dword [0x00696314]
mov r9d, dword [0x006931d4]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x0069581c]
add eax, dword [0x006958fc]
mov ecx, dword [0x00695bf8]
add ecx, dword [0x0069617c]
cmp eax, ecx
jle 0x5de845
mov eax, dword [0x0069617c]
mov dword [0x0069581c], eax
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.0040ea60
lea rcx, [rbp + 0x48]
call fcn.0040e970
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040ea00
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040ea60
lea rcx, [rbp + 0x70]
call fcn.0040e920
lea rcx, [rbp + 0x78]
mov edx, 2
call fcn.0040ea60
lea rcx, [rbp + 0xb80]
call fcn.0040e970
movzx rax, byte [rbp + 0xb8f]
lea rsp, [rbp + 0xba8]
pop rbx
pop rbp
ret