Function at 0x100012eb0
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov r12b, dl
mov rdi, rcx
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x48], ebx
mov r13d, r15d
mov r9, qword [rcx + 0x10aa0]
mov eax, dword [r9 + 8]
movzx ecx, r8w
add rax, r9
lea r14, [rcx + rax + 0xc]
mov eax, dword [r9 + 8]
lea rcx, [rax + r9 + 0xc]
cmp rcx, r14
jae 0x100013611
lea esi, [r15 + 3]
lea ebp, [rsi + 0xa]
lea rdx, [rsp + 0x44]
mov rcx, qword [rdi + 0x10aa0]
call fcn.10001185c
cmp eax, r15d
je 0x10001360d
mov al, byte [rsp + 0x44]
cmp al, 1
je 0x10001346a
cmp al, 0x44
je 0x100013299
cmp al, 0x47
jbe 0x100013229
cmp al, 0x49
jbe 0x1000131ba
cmp al, 0x4a
je 0x100013098
cmp al, 0xc3
je 0x100013004
cmp al, 0xc4
je 0x100012fb6
cmp al, 0xf0
jne 0x100013229
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x10aa0]
call fcn.1000118e8
cmp eax, r15d
je 0x100013571
mov ebx, dword [rsp + 0x48]
cmp ebx, r15d
jne 0x100013631
jmp 0x100013554
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 0x10aa0]
call fcn.1000118e8
cmp eax, r15d
je 0x100013578
cmp r12b, 2
je 0x100012fe0
cmp r12b, 0x82
jne 0x100013554
mov eax, dword [rsp + 0x60]
movabs rcx, 0x2b6109100
add rax, rcx
imul rax, rax, 0x989680
mov qword [rdi + 0x10440], rax
jmp 0x100013554
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi + 0x10aa0]
call fcn.1000118e8
cmp eax, r15d
je 0x1000135d3
cmp r12b, 0x80
jne 0x100013034
mov eax, dword [rsp + 0x50]
mov qword [rdi + 0x10a70], rax
jmp 0x100013554
cmp r12b, 2
je 0x100013044
cmp r12b, 0x82
jne 0x100013554
mov esi, dword [rsp + 0x50]
mov qword [rdi + 0x10a80], rsi
lea rcx, [rdi + 0x10238]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, r15d
je 0x10001357f
mov eax, r15d
cmp qword [rsp + 0x78], rsi
setae al
cmp eax, r15d
je 0x10001357f
mov esi, 3
jmp 0x100013554
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x10aa0]
call fcn.100011894
cmp eax, r15d
je 0x1000135de
movzx esi, word [rsp + 0x40]
sub si, 3
mov eax, 0x10
cmp si, ax
jb 0x1000131a3
mov rbp, qword [rdi + 0x10aa0]
cmp dword [rbp + 8], 0xffffffef
ja 0x1000135d7
mov edx, dword [rbp + 8]
mov ecx, dword [rbp + 4]
lea rax, [rdx + 0x10]
cmp rax, rcx
ja 0x1000135d7
movdqu xmm0, xmmword [rdx + rbp + 0xc]
movdqu xmmword [rsp + 0x98], xmm0
mov eax, 4
mov r8d, eax
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.100011bb8
mov edx, 2
mov r8d, edx
lea rcx, [rsp + 0x9c]
call fcn.100011bb8
mov edx, 2
mov r8d, edx
lea rcx, [rsp + 0x9e]
call fcn.100011bb8
mov r10d, 0x10
add dword [rbp + 8], r10d
mov eax, 0xfff0
add si, ax
lea rax, [rsp + 0x98]
lea rcx, [0x100000000]
lea rcx, [rcx + 0x1f520]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10001317c
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10001317c
mov eax, r15d
jmp 0x100013181
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
je 0x100013197
cmp si, r10w
jae 0x1000130c9
mov ebp, 0xd
jmp 0x1000131a3
mov dword [rdi + 0x7c], 2
mov ebp, 0xd
mov rcx, qword [rdi + 0x10aa0]
movzx eax, si
add dword [rcx + 8], eax
mov esi, 3
jmp 0x100013554
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x10aa0]
call fcn.100011894
cmp eax, r15d
je 0x1000135e2
mov rcx, qword [rdi + 0x10aa0]
mov eax, dword [rcx + 8]
lea rdx, [rax + rcx + 0xc]
cmp r12b, 2
je 0x1000131ef
cmp r12b, 0x82
jne 0x100013213
movzx r8d, word [rsp + 0x40]
sub r8w, si
xor r9d, r9d
mov rcx, rdi
call fcn.10001077c
mov ebx, eax
mov dword [rsp + 0x48], eax
cmp eax, r15d
jne 0x100013631
mov rdx, qword [rdi + 0x10aa0]
movzx ecx, word [rsp + 0x40]
sub ecx, esi
add dword [rdx + 8], ecx
jmp 0x100013554
mov rsi, qword [rdi + 0x10aa0]
mov word [rsp + 0x4c], r15w
and al, 0xc0
cmp al, 0x80
jne 0x100013253
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.10001185c
mov esi, 3
jmp 0x100013554
cmp al, 0xc0
jne 0x10001326e
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1000118e8
mov esi, 3
jmp 0x100013554
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.100011894
cmp eax, r15d
je 0x10001354f
movzx eax, word [rsp + 0x4c]
sub eax, 3
add dword [rsi + 8], eax
mov esi, 3
jmp 0x100013554
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x10aa0]
call fcn.100011894
cmp eax, r15d
je 0x1000135f2
cmp word [rsp + 0x40], 0x55
ja 0x1000135ee
mov r8d, 0x52
lea rdx, [rsp + 0xe0]
mov rcx, qword [rdi + 0x10aa0]
call fcn.10001193c
cmp eax, r15d
je 0x100013631
cmp r12b, 2
je 0x1000132f2
cmp r12b, 0x82
jne 0x100013554
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x29
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0xe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, r15d
je 0x1000135ea
lea rsi, [rsp + 0xa8]
lea r8, [rsp + 0x68]
mov edx, r15d
mov word [rsp + 0x68], r15w
mov r10b, byte [rsp + 0xa8]
cmp r10b, r15b
je 0x100013424
cmp r10b, 0x20
je 0x10001341a
movsx rax, r10b
lea r9, [0x100000000]
mov r11b, byte [rax + r9 + 0x1f390]
test r11b, r11b
jns 0x10001337d
and r11b, 0x7f
cmp edx, 0x13
jge 0x100013416
cmp r11b, 6
jge 0x100013416
movsxd rax, edx
lea rcx, [rax + rax*2]
movsx rax, r11b
lea rdx, [rax + rcx*2]
movzx r9d, byte [rdx + r9 + 0x1f490]
mov edx, r9d
and edx, 0x1f
cmp r11b, 1
jne 0x1000133d4
movzx ecx, word [r8]
movzx eax, cx
shl ax, 2
add cx, ax
add cx, cx
movsx eax, r10b
add cx, ax
sub cx, 0x30
mov word [r8], cx
shr r9d, 5
sub r9d, 1
je 0x1000133f3
cmp r9d, 1
jne 0x100013405
mov word [r8 + 2], r15w
add r8, 4
mov word [r8], r15w
jmp 0x100013405
lea rax, [rsp + 0x76]
cmp r8, rax
je 0x100013436
add r8, 2
mov word [r8], r15w
inc rsi
mov r10b, byte [rsi]
cmp r10b, r15b
jne 0x100013357
jmp 0x10001341a
mov eax, ebp
jmp 0x100013457
lea rax, [rsp + 0x76]
cmp r8, rax
jae 0x100013436
add r8, 2
mov word [r8], r15w
lea rax, [rsp + 0x76]
cmp r8, rax
jb 0x100013424
lea rdx, [rdi + 0x10440]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp eax, r15d
jne 0x100013548
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r15d
jne 0x1000135e6
mov esi, 3
jmp 0x100013554
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x10aa0]
call fcn.100011894
cmp eax, r15d
je 0x100013606
movzx eax, word [rsp + 0x40]
cmp ax, si
jb 0x100013602
mov ecx, 0xfffd
add ax, cx
mov word [rsp + 0x40], ax
mov ecx, 0x208
cmp ax, cx
ja 0x1000135fe
test al, 1
jne 0x1000135fa
movzx r8d, ax
lea rdx, [rsp + 0x140]
mov rcx, qword [rdi + 0x10aa0]
call fcn.10001193c
cmp eax, r15d
je 0x1000135f6
lea rcx, [rsp + 0x140]
call fcn.100011738
cmp eax, r15d
jle 0x100013554
mov r13d, 1
cmp r12b, 0x85
jne 0x10001350a
lea rdx, [rsp + 0x140]
mov rcx, rdi
call fcn.1000105f8
mov ebx, eax
mov dword [rsp + 0x48], eax
cmp r12b, 2
je 0x100013516
cmp r12b, 0x82
jne 0x10001353d
lea rcx, [rdi + 0x10448]
lea r8, [rsp + 0x140]
mov edx, 0x208
call fcn.10000b75c
mov rcx, rdi
call fcn.100010834
mov ebx, eax
mov dword [rsp + 0x48], eax
cmp ebx, r15d
jne 0x100013631
jmp 0x100013554
mov esi, 3
jmp 0x100013554
mov esi, 3
mov rcx, qword [rdi + 0x10aa0]
mov eax, dword [rcx + 8]
lea rcx, [rax + rcx + 0xc]
cmp rcx, r14
jae 0x100013611
jmp 0x100012f30
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
lea rdx, [0x100003fc8]
lea rcx, [rsp + 0x58]
call fcn.1000184c0
nop
xor r9d, r9d
lea edx, [r9 + 2]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r8d, 0xc0ff2004
lea rcx, [rsp + 0x58]
call fcn.1000185a4
mov ebx, 0x70
mov rcx, qword [rsp + 0x58]
cmp rcx, r15
je 0x100013631
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rsp + 0x58], r15
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, 0xd
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
mov ebx, 8
jmp 0x100013631
mov ebx, ebp
jmp 0x100013631
cmp r12b, 0x85
jne 0x100013631
test byte [rdi + 0x10ab0], 1
jne 0x100013631
cmp r13d, r15d
jne 0x100013631
xor edx, edx
mov rcx, rdi
call fcn.1000105f8
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.100019220
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret