Function at 0x1400585e0
Capabilities:
Contain obfuscated stackstrings
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov rax, qword [0x1403abd28]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x190]
call qword [rax + 0x18]
test eax, eax
je 0x140058da1
mov byte [rsp + 0x128], 0x2c
mov byte [rsp + 0x129], 0
mov byte [rsp + 0x12a], 0
mov byte [rsp + 0x12b], 0
mov byte [rsp + 0x12c], 0
mov byte [rsp + 0x12d], 0
mov byte [rsp + 0x12e], 0xa
mov byte [rsp + 0x12f], 0
mov byte [rsp + 0x130], 1
mov byte [rsp + 0x131], 0
mov byte [rsp + 0x132], 0
mov byte [rsp + 0x133], 0
mov byte [rsp + 0x134], 8
mov byte [rsp + 0x135], 0
mov byte [rsp + 0x136], 0
mov byte [rsp + 0x137], 0
mov byte [rsp + 0x138], 4
mov byte [rsp + 0x139], 0
mov byte [rsp + 0x13a], 0
mov byte [rsp + 0x13b], 0
mov byte [rsp + 0x13c], 0x4c
mov byte [rsp + 0x13d], 0
mov byte [rsp + 0x13e], 0
mov byte [rsp + 0x13f], 0
mov byte [rsp + 0x140], 0x2c
mov byte [rsp + 0x141], 0
mov byte [rsp + 0x142], 0
mov byte [rsp + 0x143], 0
mov byte [rsp + 0x144], 0x25
mov byte [rsp + 0x145], 0
mov byte [rsp + 0x146], 0
mov byte [rsp + 0x147], 0
mov byte [rsp + 0x148], 0
mov byte [rsp + 0x149], 0
mov byte [rsp + 0x14a], 0
mov byte [rsp + 0x14b], 0
mov byte [rsp + 0x14c], 0
mov byte [rsp + 0x14d], 0
mov byte [rsp + 0x14e], 0
mov byte [rsp + 0x14f], 0
mov byte [rsp + 0x150], 0
mov byte [rsp + 0x151], 0
mov byte [rsp + 0x152], 0
mov byte [rsp + 0x153], 0
mov byte [rsp + 0xe0], 0x2c
mov byte [rsp + 0xe1], 0
mov byte [rsp + 0xe2], 0
mov byte [rsp + 0xe3], 0
mov byte [rsp + 0xe4], 1
mov byte [rsp + 0xe5], 0
mov byte [rsp + 0xe6], 0xa
mov byte [rsp + 0xe7], 0
mov byte [rsp + 0xe8], 1
mov byte [rsp + 0xe9], 0
mov byte [rsp + 0xea], 0
mov byte [rsp + 0xeb], 0
mov byte [rsp + 0xec], 8
mov byte [rsp + 0xed], 0
mov byte [rsp + 0xee], 0
mov byte [rsp + 0xef], 0
mov byte [rsp + 0xf0], 4
mov byte [rsp + 0xf1], 0
mov byte [rsp + 0xf2], 0
mov byte [rsp + 0xf3], 0
mov byte [rsp + 0xf4], 0x4c
mov byte [rsp + 0xf5], 0
mov byte [rsp + 0xf6], 0
mov byte [rsp + 0xf7], 0
mov byte [rsp + 0xf8], 0x2c
mov byte [rsp + 0xf9], 0
mov byte [rsp + 0xfa], 0
mov byte [rsp + 0xfb], 0
mov byte [rsp + 0xfc], 0x25
mov byte [rsp + 0xfd], 0
mov byte [rsp + 0xfe], 0
mov byte [rsp + 0xff], 0
mov byte [rsp + 0x100], 0
mov byte [rsp + 0x101], 0
mov byte [rsp + 0x102], 0
mov byte [rsp + 0x103], 0
mov byte [rsp + 0x104], 0
mov byte [rsp + 0x105], 0
mov byte [rsp + 0x106], 0
mov byte [rsp + 0x107], 0
mov byte [rsp + 0x108], 0
mov byte [rsp + 0x109], 0
mov byte [rsp + 0x10a], 0
mov byte [rsp + 0x10b], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x190]
cmp dword [rax + 0x14], 3
jne 0x140058b61
mov r8d, 0x54
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll_memset
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0
jne 0x140058988
mov qword [rsp + 0x120], 0
jmp 0x1400589c8
xor edx, edx
mov rax, qword [rsp + 0x120]
mov ecx, 0x200
div rcx
cmp rax, 0xffffffffffffffff
jne 0x1400589ae
mov qword [rsp + 0x120], 0
jmp 0x1400589c8
xor edx, edx
mov rax, qword [rsp + 0x120]
mov ecx, 0x200
div rcx
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41018
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0
je 0x140058b57
lea rax, [rsp + 0x128]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x168]
movzx eax, byte [rsp + 0x165]
mov byte [rcx + 3], al
mov rcx, qword [rsp + 0x168]
movzx eax, byte [rsp + 0x166]
mov byte [rcx + 4], al
mov rcx, qword [rsp + 0x168]
movzx eax, byte [rsp + 0x167]
mov byte [rcx + 5], al
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x54
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2c
lea r8, [rsp + 0x128]
mov edx, 0x4d004
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0
je 0x140058b57
movzx eax, byte [rsp + 0xcc]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
shl rax, 8
mov qword [rsp + 0x58], rax
movzx ecx, byte [rsp + 0xcd]
mov rax, qword [rsp + 0x58]
or rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
shl rax, 8
mov qword [rsp + 0x58], rax
movzx ecx, byte [rsp + 0xce]
mov rax, qword [rsp + 0x58]
or rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
shl rax, 8
mov qword [rsp + 0x58], rax
movzx ecx, byte [rsp + 0xcf]
mov rax, qword [rsp + 0x58]
or rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 1
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x190]
cmp dword [rax + 0x14], 4
jne 0x140058bbd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2404c
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x118], eax
jmp 0x140058c09
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0
jne 0x140058c1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140058da6
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
imul rax, rcx
mov ecx, dword [rsp + 0x4c]
imul rax, rcx
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x40]
add rax, 1
mov ecx, dword [rsp + 0x50]
imul rax, rcx
mov ecx, dword [rsp + 0x4c]
imul rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x58], rax
jne 0x140058c97
cmp qword [rsp + 0x58], 0
je 0x140058c97
mov rax, qword [rsp + 0x110]
cmp qword [rsp + 0x58], rax
jb 0x140058c95
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x58], rax
ja 0x140058c95
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x110], rax
jmp 0x140058cf5
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x58], rax
je 0x140058cf5
mov rax, qword [rsp + 0x110]
cmp qword [rsp + 0x58], rax
jb 0x140058ccd
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x58], rax
ja 0x140058ccd
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x110], rax
jmp 0x140058cf5
mov rax, qword [rsp + 0x110]
cmp qword [rsp + 0x68], rax
jb 0x140058cf5
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x68], rax
ja 0x140058cf5
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
cmp qword [rsp + 0x120], rax
jb 0x140058d26
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x120], rax
ja 0x140058d26
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x110]
mov qword [rcx + 0x28], rax
xor edx, edx
mov eax, dword [rsp + 0x54]
mov ecx, 0x200
div ecx
mov eax, eax
mov rcx, qword [rsp + 0x110]
imul rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax + 0x30], rcx
mov rcx, qword [rsp + 0x190]
mov eax, dword [rsp + 0x54]
mov dword [rcx + 0x24], eax
mov rcx, qword [rsp + 0x190]
mov eax, dword [rsp + 0x40]
mov dword [rcx + 0x18], eax
mov rcx, qword [rsp + 0x190]
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x20], eax
mov rcx, qword [rsp + 0x190]
mov eax, dword [rsp + 0x4c]
mov dword [rcx + 0x1c], eax
xor eax, eax
jmp 0x140058da6
mov eax, 0x10df
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14012bc90
add rsp, 0x188
ret