Function at 0x61ed40
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov dword [rbp + 0x80], r8d
nop
mov eax, dword [0x00696194]
add eax, dword [0x006968a4]
mov ecx, dword [0x0069743c]
add ecx, dword [0x006980e8]
cmp eax, ecx
jle 0x61ed95
mov eax, dword [0x006980e8]
mov dword [0x00696194], eax
mov eax, dword [0x00696e6c]
cmp eax, dword [0x00697e6c]
je 0x61edaf
mov eax, dword [0x00696e6c]
mov dword [0x00697e6c], eax
mov rcx, qword [rbp + 0x70]
call fcn.0040e970
nop
mov ebx, dword [rbp + 0x80]
test ebx, ebx
jge 0x61edc8
call fcn.0040afc0
mov rcx, qword [rbp + 0x78]
mov edx, ebx
mov r8d, 1
xor r9, r9
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x20], rax
call qword [0x006a9260]
test al, al
je 0x61f079
mov eax, dword [0x006932fc]
add eax, 1
cmp dword [0x006932fc], eax
jne 0x61ee57
mov eax, dword [0x006978f0]
test eax, eax
jge 0x61ee0f
call fcn.0040afc0
mov ecx, dword [0x00693428]
test ecx, ecx
jge 0x61ee1e
call fcn.0040afc0
mov edx, dword [0x006940f4]
test edx, edx
jge 0x61ee2d
call fcn.0040afc0
mov r8d, dword [0x006958cc]
test r8d, r8d
jge 0x61ee3e
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00696aac]
add eax, dword [0x0069749c]
mov ecx, dword [0x00698774]
add ecx, dword [0x00698e88]
cmp eax, ecx
jle 0x61ee7f
mov eax, dword [0x00698e88]
mov dword [0x00696aac], eax
mov rcx, qword [rbp + 0x70]
mov edx, dword [rbp + 0x4c]
xor r8, r8
call fcn.0040fd40
mov eax, dword [0x00696aac]
add eax, dword [0x0069749c]
mov ecx, dword [0x00698774]
add ecx, dword [0x00698e88]
cmp eax, ecx
jle 0x61eeb6
mov eax, dword [0x00698e88]
mov dword [0x00696aac], eax
mov eax, dword [0x00697440]
cmp eax, dword [0x006980ec]
je 0x61eed0
mov eax, dword [0x00697440]
mov dword [0x006980ec], eax
mov eax, dword [0x006974b8]
add eax, dword [0x00698968]
mov ecx, dword [0x00696570]
add ecx, dword [0x00696c90]
cmp ecx, eax
jle 0x61eef8
mov ecx, dword [0x00698968]
mov dword [0x00696570], ecx
mov ecx, dword [0x00696570]
add ecx, dword [0x00696c90]
cmp ecx, eax
jle 0x61ef14
mov eax, dword [0x00698968]
mov dword [0x00696570], eax
mov eax, dword [0x00697438]
cmp eax, dword [0x006980e0]
je 0x61ef2e
mov eax, dword [0x00697438]
mov dword [0x006980e0], eax
mov rcx, qword [rbp + 0x78]
mov edx, ebx
mov r8d, 1
mov rax, qword [rbp + 0x70]
mov r9, qword [rax]
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x20], rax
call qword [0x006a9260]
test al, al
je 0x61f079
lea rcx, [rbp + 0x40]
call fcn.0040e970
mov eax, dword [0x00695d80]
add eax, dword [0x00696578]
mov ecx, dword [0x00696c98]
add ecx, dword [0x00697460]
cmp eax, ecx
jle 0x61ef8a
mov eax, dword [0x00697460]
mov dword [0x00695d80], eax
mov eax, dword [0x00695900]
mov dword [0x0069581c], eax
jmp 0x61f00d
lea rcx, [0x0061f1c4]
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
mov r8d, 1
call fcn.004110b0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x70]
mov rdx, qword [rdx]
mov r8d, 1
mov r9d, eax
sub r9d, 1
call fcn.0040fc10
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
call fcn.0040f6e0
lea rcx, [0x0061f1c4]
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
mov r8d, 1
call fcn.004110b0
mov rcx, qword [rbp + 0x70]
mov edx, 1
mov r8d, eax
add r8d, 1
call fcn.0040fc90
lea rcx, [0x0061f1c4]
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
mov r8d, 1
call fcn.004110b0
test eax, eax
jne 0x61ef98
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax]
lea rdx, [0x0061f1d4]
call fcn.0040fb90
test eax, eax
je 0x61f056
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
call fcn.0040f6e0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x40]
call fcn.0040f070
mov eax, dword [0x006931cc]
mov dword [0x00698b04], eax
jmp 0x61f079
call fcn.005ff400
mov dword [0x00693408], 0x341
mov eax, dword [0x00693408]
sub eax, 0x1c1
mov dword [0x00693904], eax
mov eax, dword [0x00698e9c]
mov dword [0x00698960], eax
mov eax, dword [0x00693520]
add eax, 1
cmp dword [0x00693520], eax
jne 0x61f0f7
mov eax, dword [0x0069393c]
test eax, eax
jge 0x61f0c6
call fcn.0040afc0
mov ecx, dword [0x006962e0]
test ecx, ecx
jge 0x61f0d5
call fcn.0040afc0
mov edx, dword [0x00696cac]
test edx, edx
jge 0x61f0e4
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00695d6c]
add eax, dword [0x0069631c]
mov ecx, dword [0x006968b4]
add ecx, dword [0x0069744c]
cmp eax, ecx
jle 0x61f118
call fcn.004096f0
mov dword [0x00693278], 0x2ef
mov eax, dword [0x00693278]
sub eax, 0x19a
mov dword [0x006933cc], eax
mov eax, dword [0x00698aec]
mov dword [0x00698104], eax
mov eax, dword [0x006962e0]
mov dword [0x00695be4], eax
mov eax, dword [0x00698e6c]
mov dword [0x0069812c], eax
nop
lea rcx, [rbp + 0x30]
call fcn.0040e970
lea rcx, [rbp + 0x40]
call fcn.0040e970
mov rax, qword [rbp + 0x70]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret