Function at 0x4027a7
Capabilities:
Get common file path
Get disk size

Disassembly:
push rbp
push rdi
sub rsp, 0xa78
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x97c], 0x706d74
mov dword [rbp + 0x978], 0x676f6c
mov dword [rbp + 0x974], 0x646967
mov dword [rbp + 0x970], 0x6b6863
mov dword [rbp + 0x96c], 0x646c6f
mov dword [rbp + 0x968], 0x6b6162
mov dword [rbp + 0x9ec], 0
mov dword [rbp + 0x9e8], 0
mov dword [rbp + 0x9e4], 0
mov dword [rbp + 0x9e0], 0
mov dword [rbp + 0x9dc], 0
mov dword [rbp + 0x9d8], 0
mov dword [rbp + 0x9d4], 0
lea rax, [rbp + 0x860]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
lea rax, [rbp + 0x860]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x860]
add rax, rdx
movabs rdi, 0x637465666572505c
mov qword [rax], rdi
mov word [rax + 8], 0x68
lea rax, [rbp + 0x750]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
lea rax, [rbp + 0x750]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x750]
add rax, rdx
mov dword [rax], 0x6d65545c
mov word [rax + 4], 0x70
lea rax, [rbp + 0x640]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x643], 0
lea rax, [rbp + 0x530]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x533], 0
lea rax, [rbp + 0x420]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x423], 0
lea rax, [rbp + 0x310]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x313], 0
lea rax, [rbp + 0x200]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x203], 0
lea rax, [rbp + 0xf0]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
lea rax, [rbp - 0x20]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp - 0x1e], 0
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x24]
lea rax, [rbp - 0x20]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
call rax
mov eax, dword [rbp - 0x2c]
mov edx, eax
mov eax, dword [rbp - 0x28]
mov eax, eax
imul rax, rdx
mov edx, dword [rbp - 0x24]
mov edx, edx
imul rax, rdx
mov qword [rbp + 0x9c8], rax
lea rax, [rbp + 0x990]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
lea rcx, [0x004d73fb]
call fcn.0043ea70
lea rax, [rbp + 0x860]
mov rcx, rax
call fcn.004021b7
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9ec], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d740d]
call fcn.0043ea70
lea rdx, [rbp + 0x97c]
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.0040251f
lea rax, [rbp + 0x750]
mov rcx, rax
call fcn.004021b7
mov eax, dword [0x0050504c]
add dword [rbp + 0x9e8], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d741e]
call fcn.0043ea70
lea rdx, [rbp + 0x978]
lea rax, [rbp + 0x530]
mov rcx, rax
call fcn.0040251f
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9e4], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d742f]
call fcn.0043ea70
lea rdx, [rbp + 0x974]
lea rax, [rbp + 0x420]
mov rcx, rax
call fcn.0040251f
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9e0], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d7440]
call fcn.0043ea70
lea rdx, [rbp + 0x970]
lea rax, [rbp + 0x310]
mov rcx, rax
call fcn.0040251f
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9dc], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d7451]
call fcn.0043ea70
lea rdx, [rbp + 0x96c]
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.0040251f
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9d8], eax
mov dword [0x0050504c], 0
lea rcx, [0x004d7462]
call fcn.0043ea70
lea rdx, [rbp + 0x968]
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.0040251f
mov eax, dword [0x0050504c]
mov dword [rbp + 0x9d4], eax
mov dword [0x0050504c], 0
lea rax, [rbp + 0x980]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x24]
lea rax, [rbp - 0x20]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
call rax
mov eax, dword [rbp - 0x2c]
mov edx, eax
mov eax, dword [rbp - 0x28]
mov eax, eax
imul rax, rdx
mov edx, dword [rbp - 0x24]
mov edx, edx
imul rax, rdx
mov qword [rbp + 0x9c0], rax
mov rax, qword [rbp + 0x9c0]
sub rax, qword [rbp + 0x9c8]
mov qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
shr rax, 0x1e
mov dword [rbp + 0x9b4], eax
mov eax, dword [rbp + 0x9b4]
shl rax, 0x1e
sub qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
shr rax, 0x14
mov dword [rbp + 0x9b0], eax
mov eax, dword [rbp + 0x9b0]
shl rax, 0x14
sub qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
shr rax, 0xa
mov dword [rbp + 0x9ac], eax
mov eax, dword [rbp + 0x9ac]
shl eax, 0xa
mov eax, eax
sub qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
mov dword [rbp + 0x9a8], eax
lea rcx, [0x004d7473]
call fcn.0043ea70
mov eax, dword [rbp + 0x9ec]
mov edx, eax
lea rcx, [0x004d747a]
call fcn.0043ea70
mov eax, dword [rbp + 0x9e8]
mov edx, eax
lea rcx, [0x004d748e]
call fcn.0043ea70
mov eax, dword [rbp + 0x9e4]
mov edx, eax
lea rcx, [0x004d74a0]
call fcn.0043ea70
mov eax, dword [rbp + 0x9e0]
mov edx, eax
lea rcx, [0x004d74b2]
call fcn.0043ea70
mov eax, dword [rbp + 0x9dc]
mov edx, eax
lea rcx, [0x004d74c4]
call fcn.0043ea70
mov eax, dword [rbp + 0x9d8]
mov edx, eax
lea rcx, [0x004d74d6]
call fcn.0043ea70
mov eax, dword [rbp + 0x9d4]
mov edx, eax
lea rcx, [0x004d74e8]
call fcn.0043ea70
cmp dword [rbp + 0x9b4], 0
jne 0x402d45
cmp dword [rbp + 0x9b0], 0
jne 0x402d45
cmp dword [rbp + 0x9ac], 0
jne 0x402d45
cmp dword [rbp + 0x9a8], 0
jne 0x402d45
lea rcx, [0x004d74fa]
call fcn.0043ea70
jmp 0x402e0e
lea rcx, [0x004d750c]
call fcn.0043ea70
cmp dword [rbp + 0x9b4], 0
je 0x402d6e
mov eax, dword [rbp + 0x9b4]
mov edx, eax
lea rcx, str.___d_GB
call fcn.0043ea70
cmp dword [rbp + 0x9b0], 0
je 0x402d8b
mov eax, dword [rbp + 0x9b0]
mov edx, eax
lea rcx, str.___d_MB
call fcn.0043ea70
cmp dword [rbp + 0x9ac], 0
je 0x402da8
mov eax, dword [rbp + 0x9ac]
mov edx, eax
lea rcx, str.___d_KB
call fcn.0043ea70
cmp dword [rbp + 0x9a8], 0
je 0x402dc5
mov eax, dword [rbp + 0x9a8]
mov edx, eax
lea rcx, str.___d_B
call fcn.0043ea70
lea rcx, [0x004d7530]
call fcn.0043ea70
mov rax, qword [rbp + 0x990]
mov rdx, qword [rbp + 0x998]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x980]
mov rdx, qword [rbp + 0x988]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004023c9
nop
add rsp, 0xa78
pop rdi
pop rbp
ret