Function at 0x5cf330
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x1a0
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x1b0], rcx
mov rcx, qword [rbp + 0x1b0]
call fcn.0040ead0
nop
mov eax, dword [0x006933c4]
add eax, 1
cmp dword [0x006933c4], eax
jne 0x5cf3a4
mov ecx, dword [0x00693298]
mov edx, dword [0x0069391c]
mov r8d, dword [0x00694120]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006940a4]
mov dword [0x00693904], eax
mov eax, dword [0x0069412c]
add eax, dword [0x006957f0]
mov ecx, dword [0x00695884]
add ecx, dword [0x00695904]
cmp eax, ecx
jle 0x5cf3d8
mov eax, dword [0x00695904]
mov dword [0x0069412c], eax
call fcn.005cacc0
mov eax, dword [0x00693938]
add eax, dword [0x006940d8]
mov ecx, dword [0x006942b0]
add ecx, dword [0x006957fc]
cmp eax, ecx
jle 0x5cf3fe
call fcn.004096f0
mov eax, dword [0x006931b4]
mov dword [0x00695b98], eax
mov eax, dword [0x006933b4]
add eax, 1
cmp dword [0x006933b4], eax
jne 0x5cf444
mov ecx, dword [0x00695b8c]
mov edx, dword [0x0069329c]
mov r8d, dword [0x006933f4]
mov r9d, dword [0x00693510]
mov eax, dword [0x00693950]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x00695c18]
add eax, dword [0x00693294]
mov ecx, dword [0x006933b8]
add ecx, dword [0x0069344c]
cmp eax, ecx
jle 0x5cf46a
mov dword [0x00695c18], 0x9b
mov byte [rbp + 0x19f], 0
cmp qword [rbp + 0x1b0], 0
je 0x5cf7db
nop
mov eax, dword [0x00695bb0]
mov dword [0x006958e0], eax
mov eax, dword [0x0069410c]
add eax, dword [0x006942e8]
mov ecx, dword [0x00695864]
add ecx, dword [0x006958e0]
cmp eax, ecx
jle 0x5cf4b4
mov eax, dword [0x006958e0]
mov dword [0x0069410c], eax
mov eax, dword [0x00693210]
mov dword [0x00695bc0], eax
mov eax, dword [0x0069429c]
add eax, dword [0x00695818]
mov ecx, dword [0x006958c8]
add ecx, dword [0x00695b94]
cmp eax, ecx
jle 0x5cf4e8
mov eax, dword [0x00695b94]
mov dword [0x0069429c], eax
mov eax, dword [0x006933a0]
add eax, 1
cmp dword [0x006933a0], eax
jne 0x5cf518
mov ecx, dword [0x00695bf4]
mov edx, dword [0x006933f8]
mov r8d, dword [0x00693518]
mov r9d, dword [0x00693958]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005c89f0
mov ecx, 2
xor edx, edx
call qword [0x006a8be8]
mov dword [rbp + 0x198], eax
mov eax, dword [0x006933f4]
add eax, 1
cmp dword [0x006933f4], eax
jne 0x5cf561
mov ecx, dword [0x006942f4]
mov edx, dword [0x006931dc]
mov r8d, dword [0x00693300]
mov r9d, dword [0x00693458]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006932cc]
add eax, 1
cmp dword [0x006932cc], eax
jne 0x5cf58a
mov ecx, dword [0x00695b8c]
mov edx, dword [0x006932d0]
mov r8d, dword [0x006934e4]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [rbp + 0x198]
cmp rax, 0xffffffffffffffff
je 0x5cf725
mov dword [rbp + 0x68], 0x130
mov ecx, dword [rbp + 0x198]
lea rdx, [rbp + 0x68]
call qword [0x006a8ca8]
test eax, eax
je 0x5cf651
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
call fcn.00410800
cmp qword [rbp + 0x50], 0
je 0x5cf638
cmp dword [rbp + 0x70], 0
je 0x5cf638
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
call fcn.00410800
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.0042d7c0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x1b0]
call fcn.00410880
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0042d7c0
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
call fcn.00410d80
test eax, eax
jne 0x5cf638
mov byte [rbp + 0x19f], 1
jmp 0x5cf650
mov ecx, dword [rbp + 0x198]
lea rdx, [rbp + 0x68]
call qword [0x006a8cb0]
test eax, eax
jne 0x5cf5b9
nop
mov ecx, dword [rbp + 0x198]
call qword [0x006a8bc0]
jmp 0x5cf725
mov eax, dword [0x006940f8]
add eax, dword [0x006942d0]
mov ecx, dword [0x0069584c]
add ecx, dword [0x00695900]
cmp eax, ecx
jle 0x5cf74d
mov eax, dword [0x00695900]
mov dword [0x006940f8], eax
mov eax, dword [0x00693968]
add eax, dword [0x00694108]
mov ecx, dword [0x006942e4]
add ecx, dword [0x00695860]
cmp eax, ecx
jle 0x5cf76e
call fcn.004096f0
mov eax, dword [0x006933e4]
add eax, 1
cmp dword [0x006933e4], eax
jne 0x5cf79e
mov ecx, dword [0x00695b94]
mov edx, dword [0x006932a8]
mov r8d, dword [0x006933fc]
mov r9d, dword [0x0069351c]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006933d0]
add eax, 1
cmp dword [0x006933d0], eax
jne 0x5cf7ce
mov ecx, dword [0x006942c8]
mov edx, dword [0x006958f4]
mov r8d, dword [0x00695bf4]
mov r9d, dword [0x006932a4]
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00694134]
mov dword [0x0069409c], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 5
call fcn.0040ea00
lea rcx, [rbp + 0x1b0]
call fcn.0040e970
movzx rax, byte [rbp + 0x19f]
lea rsp, [rbp + 0x1a0]
pop rbp
ret