Function at 0x652a40
Capabilities:
Get disk size

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], rbp
nop
nop
mov eax, dword [0x006958a0]
mov dword [0x00695804], eax
mov eax, dword [0x006958a0]
mov dword [0x00695804], eax
mov eax, dword [0x00698d38]
cmp eax, dword [0x00699380]
je 0x652aee
mov eax, dword [0x00698d38]
mov dword [0x00699380], eax
mov eax, dword [0x006965e0]
mov dword [0x0069614c], eax
lea rcx, [rbp + 0x70]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x68]
lea rdx, [0x006a87c6]
call fcn.0040ff20
lea rcx, [rbp + 0x60]
lea rdx, [0x006a8721]
call fcn.0040ff20
lea rcx, [rbp + 0x98]
mov edx, 4
mov r8, qword [rbp + 0x70]
mov r9, qword [rbp + 0x68]
lea rax, [0x00653280]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov eax, dword [0x00699da8]
mov dword [0x00699c30], eax
mov dword [0x0069aa90], 0x2f3
mov eax, dword [0x0069aa90]
sub eax, 0x18c
mov dword [0x0069aff8], eax
mov eax, dword [0x00696570]
add eax, dword [0x00696c9c]
mov ecx, dword [0x006974d4]
add ecx, dword [0x006980f0]
cmp eax, ecx
jle 0x652ba9
call fcn.004096f0
mov eax, dword [0x0069a990]
mov dword [0x00699da8], eax
call fcn.0061fe80
mov eax, dword [0x0069a9c8]
add eax, dword [0x0069aacc]
mov ecx, dword [0x0069b030]
add ecx, dword [0x006932fc]
cmp eax, ecx
jle 0x652be0
mov dword [0x0069a9c8], 0x8e
mov eax, dword [0x00693928]
add eax, 1
cmp dword [0x00693928], eax
jne 0x652c07
mov eax, dword [0x0069a4f0]
test eax, eax
jge 0x652c00
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00696894]
add eax, dword [0x00696c9c]
mov ecx, dword [0x006974d4]
add ecx, dword [0x00698990]
cmp eax, ecx
jle 0x652c2f
mov eax, dword [0x00698990]
mov dword [0x00696894], eax
mov byte [0x006a896d], 5
call fcn.0063aa80
cmp eax, dword [0x0069adf8]
jle 0x652c4d
mov dword [0x0069adf8], 0x4c1
mov eax, dword [0x00693288]
add eax, 1
cmp dword [0x00693288], eax
jne 0x652c9e
mov eax, dword [0x0069a030]
test eax, eax
jge 0x652c6d
call fcn.0040afc0
mov ecx, dword [0x0069afd4]
test ecx, ecx
jge 0x652c7c
call fcn.0040afc0
mov edx, dword [0x006932a0]
test edx, edx
jge 0x652c8b
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00699d48]
mov dword [0x0069964c], eax
mov eax, dword [0x006934d4]
add eax, 1
cmp dword [0x006934d4], eax
jne 0x652cfb
mov eax, dword [0x00698b2c]
test eax, eax
jge 0x652cca
call fcn.0040afc0
mov ecx, dword [0x006995f8]
test ecx, ecx
jge 0x652cd9
call fcn.0040afc0
mov edx, dword [0x00699c18]
test edx, edx
jge 0x652ce8
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069584c]
add eax, 1
cmp dword [0x0069584c], eax
jne 0x652d63
mov eax, dword [0x006965bc]
test eax, eax
jge 0x652d1b
call fcn.0040afc0
mov ecx, dword [0x00698af8]
test ecx, ecx
jge 0x652d2a
call fcn.0040afc0
mov edx, dword [0x00699858]
test edx, edx
jge 0x652d39
call fcn.0040afc0
mov r8d, dword [0x0069a948]
test r8d, r8d
jge 0x652d4a
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
lea rcx, [rbp + 0x50]
lea rdx, [0x00693076]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x40]
mov edx, dword [0x006a88c8]
call fcn.005a81d0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x38]
lea rdx, [0x006a8940]
call fcn.0061f350
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
call fcn.0040ff90
lea rcx, [rbp + 0x90]
mov edx, 3
mov r8, qword [rbp + 0x58]
mov r9, qword [rbp + 0x48]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.00410400
call fcn.006187e0
mov rcx, qword [rbp + 0x90]
call fcn.00410050
mov rsi, rax
mov rcx, qword [rbp + 0x98]
call fcn.00410050
mov rbx, rax
xor ecx, ecx
mov rdx, rsi
mov r8, rbx
xor r9, r9
mov qword [rsp + 0x20], 0
call qword [0x006a9140]
mov eax, dword [0x006942a4]
mov dword [0x006940c4], eax
mov eax, dword [0x006942a4]
mov dword [0x006940c4], eax
mov eax, dword [0x00699d30]
cmp eax, dword [0x0069aab4]
je 0x652e5f
mov eax, dword [0x00699d30]
mov dword [0x0069aab4], eax
mov eax, dword [0x0069342c]
mov dword [0x0069ae14], eax
mov eax, dword [0x00695bd0]
mov dword [0x006958fc], eax
mov eax, dword [0x00699d98]
mov dword [0x00699890], eax
mov eax, dword [0x00693958]
add eax, 1
cmp dword [0x00693958], eax
jne 0x652f01
mov eax, dword [0x006978f4]
test eax, eax
jge 0x652ea3
call fcn.0040afc0
mov ecx, dword [0x0069909c]
test ecx, ecx
jge 0x652eb2
call fcn.0040afc0
mov edx, dword [0x00699560]
test edx, edx
jge 0x652ec1
call fcn.0040afc0
mov r8d, dword [0x0069ae24]
test r8d, r8d
jge 0x652ed2
call fcn.0040afc0
mov r9d, dword [0x00693274]
test r9d, r9d
jge 0x652ee3
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov esi, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, esi
call sub.kernel32.dll_LockFile
mov rcx, rbx
call qword [0x006a8cf0]
mov eax, dword [0x006965e8]
add eax, dword [0x00696e7c]
mov ecx, dword [0x00697e88]
add ecx, dword [0x00698b28]
cmp eax, ecx
jle 0x652f2b
call fcn.004096f0
call fcn.00626020
mov eax, dword [0x00693564]
add eax, 1
cmp dword [0x00693564], eax
jne 0x652f57
mov eax, dword [0x00698b1c]
test eax, eax
jge 0x652f50
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00696cb0]
add eax, dword [0x006978c4]
mov ecx, dword [0x006989a0]
add ecx, dword [0x00698e4c]
cmp eax, ecx
jle 0x652f7f
mov eax, dword [0x00698e4c]
mov dword [0x00696cb0], eax
mov eax, dword [0x006933b4]
add eax, dword [0x00693450]
mov ecx, dword [0x0069aaf0]
add ecx, dword [0x0069b058]
cmp ecx, eax
jle 0x652fa5
mov dword [0x0069aaf0], 0x59
mov ecx, dword [0x0069aaf0]
add ecx, dword [0x0069b058]
cmp ecx, eax
jle 0x652fbf
mov dword [0x0069aaf0], 0x59
mov eax, dword [0x0069936c]
cmp eax, dword [0x006995f8]
je 0x652fd9
mov eax, dword [0x0069936c]
mov dword [0x006995f8], eax
mov eax, dword [0x00699a48]
mov dword [0x0069951c], eax
mov eax, dword [0x00699a48]
mov dword [0x0069951c], eax
mov eax, dword [0x00699614]
cmp eax, dword [0x0069a4f8]
je 0x653072
mov eax, dword [0x00699614]
mov dword [0x0069a4f8], eax
jmp 0x653072
mov eax, dword [0x006933b0]
add eax, dword [0x00693950]
mov ecx, dword [0x00695914]
add ecx, dword [0x006965d4]
cmp eax, ecx
jle 0x653098
mov dword [0x006933b0], 0x1b
mov eax, dword [0x00697464]
add eax, dword [0x0069811c]
mov ecx, dword [0x00698e64]
add ecx, dword [0x006993b8]
cmp eax, ecx
jle 0x6530c0
mov eax, dword [0x006993b8]
mov dword [0x00697464], eax
call fcn.0064d990
cmp eax, dword [0x006933e0]
jle 0x6530d7
mov dword [0x006933e0], 0xec
mov eax, dword [0x0069a954]
mov dword [0x00699d6c], eax
mov eax, dword [0x00696ce0]
add eax, dword [0x006978f8]
mov ecx, dword [0x00698af4]
add ecx, dword [0x006990a0]
cmp eax, ecx
jle 0x65310b
mov eax, dword [0x006990a0]
mov dword [0x00696ce0], eax
mov eax, dword [0x00693568]
add eax, 1
cmp dword [0x00693568], eax
jne 0x653132
mov eax, dword [0x00696304]
test eax, eax
jge 0x65312b
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006933c0]
add eax, 1
cmp dword [0x006933c0], eax
jne 0x65319a
mov eax, dword [0x006974d0]
test eax, eax
jge 0x653152
call fcn.0040afc0
mov ecx, dword [0x00698fb0]
test ecx, ecx
jge 0x653161
call fcn.0040afc0
mov edx, dword [0x00699518]
test edx, edx
jge 0x653170
call fcn.0040afc0
mov r8d, dword [0x00699c34]
test r8d, r8d
jge 0x653181
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
nop
lea rcx, [rbp + 0x30]
call fcn.0040e9c0
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040ea30
lea rcx, [rbp + 0x48]
call fcn.0040e9c0
lea rcx, [rbp + 0x50]
call fcn.0040e970
lea rcx, [rbp + 0x58]
mov edx, 4
call fcn.0040ea60
lea rcx, [rbp + 0x88]
call fcn.0040e970
lea rcx, [rbp + 0x90]
mov edx, 2
call fcn.0040ea60
lea rsp, [rbp + 0xa0]
pop rbx
pop rsi
pop rbp
ret