Function at 0x5ca850
Capabilities:
Get disk size

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov dword [0x006931f0], 0x30c
mov eax, dword [0x006931f0]
sub eax, 0x1a8
mov dword [0x00693294], eax
mov eax, dword [0x00693540]
mov dword [0x006934d8], eax
call fcn.005c7c30
cmp eax, dword [0x006942e8]
jle 0x5ca89e
mov dword [0x006942e8], 0x12
mov eax, dword [0x006942ac]
mov dword [0x00694104], eax
mov eax, dword [0x0069327c]
add eax, 1
cmp dword [0x0069327c], eax
jne 0x5ca8d3
mov ecx, dword [0x006932c0]
mov edx, dword [0x006933fc]
mov r8d, dword [0x006934bc]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test rsi, rsi
jne 0x5ca8f1
mov rcx, qword [0x00423278]
mov dl, 1
xor r8, r8
call fcn.00437e80
mov rcx, rax
call fcn.0040da20
lea rdi, [rsi - 9]
test rdi, rdi
jne 0x5ca913
mov rcx, qword [0x00423278]
mov dl, 1
xor r8, r8
call fcn.00437e80
mov rcx, rax
call fcn.0040da20
mov r13, qword [rdi + 1]
mov rcx, rbx
mov rdx, r13
call fcn.005c9ea0
test al, al
jne 0x5ca93f
mov rcx, qword [0x00423278]
mov dl, 1
xor r8, r8
call fcn.00437e80
mov rcx, rax
call fcn.0040da20
movzx rax, byte [rdi]
lea rcx, [r13 + 0x10]
sub byte [rcx], 1
movzx rax, al
sub eax, 1
movsxd rax, eax
mov qword [r13 + rax*8 + 0x2a], 0
lea rax, [rax + rax*2]
lea rsi, [r13 + rax*2 + 0x6b]
mov eax, dword [0x006932d4]
add eax, 1
cmp dword [0x006932d4], eax
jne 0x5ca9a0
mov ecx, dword [0x0069411c]
mov edx, dword [0x006932c0]
mov r8d, dword [0x006933d8]
mov r9d, dword [0x00693440]
mov eax, dword [0x00693544]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
call fcn.005c1c20
cmp eax, dword [0x00694304]
jle 0x5ca9b7
mov dword [0x00694304], 0x19
mov eax, dword [0x006942ec]
mov dword [0x00694284], eax
mov eax, dword [0x006942bc]
add eax, dword [0x006931c8]
mov ecx, dword [0x0069320c]
add ecx, dword [0x006932b4]
cmp eax, ecx
jle 0x5ca9e9
mov dword [0x006942bc], 0x6c
movzx rax, byte [0x006a941a]
test al, 1
je 0x5caa06
mov rcx, rsi
mov edx, 6
call fcn.005c69a0
jmp 0x5caa1b
mov rcx, rsi
mov edx, 6
mov r8d, 0x90
call fcn.0040a9a0
mov eax, dword [0x006932b4]
add eax, 1
cmp dword [0x006932b4], eax
jne 0x5caa55
mov ecx, dword [0x00693304]
mov edx, dword [0x00693500]
mov r8d, dword [0x00693900]
mov r9d, dword [0x00693948]
mov eax, dword [0x006940dc]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
movzx rsi, byte [r13 + 0x10]
test esi, esi
jne 0x5caa69
mov rcx, rbx
mov rdx, r13
call fcn.005ca430
mov rcx, rdi
call fcn.00409060
call fcn.005c0210
mov eax, dword [0x00693300]
add eax, 1
cmp dword [0x00693300], eax
jne 0x5caab0
mov ecx, dword [0x00693414]
mov edx, dword [0x0069391c]
mov r8d, dword [0x006940d4]
mov r9d, dword [0x006942a4]
mov eax, dword [0x006931d0]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006931fc]
add eax, 1
cmp dword [0x006931fc], eax
jne 0x5caae0
mov ecx, dword [0x006935f0]
mov edx, dword [0x006940e4]
mov r8d, dword [0x006942b4]
mov r9d, dword [0x006931c0]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006942ac]
mov dword [0x00694104], eax
mov eax, dword [0x00693904]
cmp eax, dword [0x0069396c]
je 0x5cab06
mov eax, dword [0x00693904]
mov dword [0x0069396c], eax
mov eax, dword [0x006932a0]
mov dword [0x006931dc], eax
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret