Function at 0x5ff090
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], rbp
nop
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8a90], rax
nop
mov eax, dword [0x0069340c]
add eax, 1
cmp dword [0x0069340c], eax
jne 0x5ff11b
mov eax, dword [0x006962c8]
test eax, eax
jge 0x5ff0d3
call fcn.0040afc0
mov ecx, dword [0x00697490]
test ecx, ecx
jge 0x5ff0e2
call fcn.0040afc0
mov edx, dword [0x006932b4]
test edx, edx
jge 0x5ff0f1
call fcn.0040afc0
mov r8d, dword [0x006934e4]
test r8d, r8d
jge 0x5ff102
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006958a0]
add eax, dword [0x00695be8]
mov ecx, dword [0x00696148]
add ecx, dword [0x00696598]
cmp eax, ecx
jle 0x5ff13c
call fcn.004096f0
mov eax, dword [0x006961a0]
cmp eax, dword [0x006965a0]
je 0x5ff156
mov eax, dword [0x006961a0]
mov dword [0x006965a0], eax
mov eax, dword [0x006932f4]
add eax, 1
cmp dword [0x006932f4], eax
jne 0x5ff1be
mov eax, dword [0x00693934]
test eax, eax
jge 0x5ff176
call fcn.0040afc0
mov ecx, dword [0x00695858]
test ecx, ecx
jge 0x5ff185
call fcn.0040afc0
mov edx, dword [0x00695bf0]
test edx, edx
jge 0x5ff194
call fcn.0040afc0
mov r8d, dword [0x006961a4]
test r8d, r8d
jge 0x5ff1a5
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov byte [0x006a8a88], 0
call fcn.005fda90
mov eax, dword [0x006931ec]
mov dword [0x00697478], eax
mov eax, dword [0x00693454]
add eax, 1
cmp dword [0x00693454], eax
jne 0x5ff227
mov eax, dword [0x006935f8]
test eax, eax
jge 0x5ff1f6
call fcn.0040afc0
mov ecx, dword [0x006965b0]
test ecx, ecx
jge 0x5ff205
call fcn.0040afc0
mov edx, dword [0x0069743c]
test edx, edx
jge 0x5ff214
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006931ec]
mov dword [0x00697478], eax
mov eax, dword [0x006968b0]
cmp eax, dword [0x00697464]
je 0x5ff24d
mov eax, dword [0x006968b0]
mov dword [0x00697464], eax
mov eax, dword [0x00693928]
add eax, 1
cmp dword [0x00693928], eax
jne 0x5ff2b5
mov eax, dword [0x00696a9c]
test eax, eax
jge 0x5ff26d
call fcn.0040afc0
mov ecx, dword [0x006978d8]
test ecx, ecx
jge 0x5ff27c
call fcn.0040afc0
mov edx, dword [0x006933ac]
test edx, edx
jge 0x5ff28b
call fcn.0040afc0
mov r8d, dword [0x0069354c]
test r8d, r8d
jge 0x5ff29c
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005f3a60
cmp eax, dword [0x00693208]
jle 0x5ff2cc
mov dword [0x00693208], 0x69
mov byte [0x006a8a88], 1
mov eax, dword [0x00695be8]
add eax, dword [0x0069619c]
mov ecx, dword [0x00696a6c]
add ecx, dword [0x00696e90]
cmp eax, ecx
jle 0x5ff2fb
mov eax, dword [0x00696e90]
mov dword [0x00695be8], eax
mov dword [0x006932d8], 0x2fd
mov eax, dword [0x006932d8]
sub eax, 0x1a0
mov dword [0x006934b4], eax
call fcn.005f20b0
cmp eax, dword [0x00693298]
jle 0x5ff32e
mov dword [0x00693298], 0x61
xor ecx, ecx
xor edx, edx
lea r8, [0x005fc6c0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x28], rax
call qword [0x006a8d38]
call fcn.005fda90
test al, al
jne 0x5ff369
mov ecx, 0x64
call sub.kernel32.dll_Sleep_2
jmp 0x5ff353
nop
nop
mov rcx, qword [0x006a8a90]
call fcn.0040b500
mov eax, dword [0x006974b0]
mov dword [0x00696cb8], eax
mov eax, dword [0x00693210]
add eax, dword [0x006933f4]
mov ecx, dword [0x00693544]
add ecx, dword [0x006940bc]
cmp eax, ecx
jle 0x5ff3b3
mov dword [0x00693210], 0x117
jmp 0x5ff3b3
lea rsp, [rbp + 0x50]
pop rbp
ret