Function at 0x5a7790
Capabilities:
Get disk size

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x90], rcx
nop
mov eax, dword [0x00693540]
mov dword [0x00693504], eax
mov eax, dword [0x006931e4]
add eax, 1
cmp dword [0x006931e4], eax
jne 0x5a7800
mov ecx, dword [0x00693208]
mov edx, dword [0x006933b4]
mov r8d, dword [0x00693418]
mov r9d, dword [0x00693458]
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005a72d0
cmp eax, dword [0x006931e4]
jle 0x5a7817
mov dword [0x006931e4], 0x1e
mov eax, dword [0x006933f8]
add eax, dword [0x00693438]
mov ecx, dword [0x006934cc]
add ecx, dword [0x0069350c]
cmp eax, ecx
jle 0x5a7838
call fcn.004096f0
mov dword [0x006931e4], 0x322
mov eax, dword [0x006931e4]
sub eax, 0x1b2
mov dword [0x00693280], eax
call fcn.005a72d0
cmp eax, dword [0x006931e4]
jle 0x5a786b
mov dword [0x006931e4], 0x1d
mov eax, dword [0x006931dc]
add eax, 1
cmp dword [0x006931dc], eax
jne 0x5a78a5
mov ecx, dword [0x00693434]
mov edx, dword [0x006934f4]
mov r8d, dword [0x00693544]
mov r9d, dword [0x006931bc]
mov eax, dword [0x00693300]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
nop
call fcn.005a6ff0
mov eax, dword [0x006931d8]
mov dword [0x006935f8], eax
call fcn.005a6ff0
cmp eax, dword [0x006935f8]
jle 0x5a78ce
mov dword [0x006935f8], 0xc
mov eax, dword [0x00693294]
add eax, 1
cmp dword [0x00693294], eax
jne 0x5a78f7
mov ecx, dword [0x006933f8]
mov edx, dword [0x006934b4]
mov r8d, dword [0x0069351c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00693298]
add eax, 1
cmp dword [0x00693298], eax
jne 0x5a7931
mov ecx, dword [0x006932e0]
mov edx, dword [0x006933d8]
mov r8d, dword [0x0069342c]
mov r9d, dword [0x006934d4]
mov eax, dword [0x00693528]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
call fcn.005a72d0
cmp eax, dword [0x006931d8]
jle 0x5a7948
mov dword [0x006931d8], 0x1b
mov eax, dword [0x006931d8]
mov dword [0x006935f8], eax
mov eax, dword [0x006934e4]
cmp eax, dword [0x00693534]
je 0x5a796e
mov eax, dword [0x006934e4]
mov dword [0x00693534], eax
mov eax, dword [0x006933f8]
add eax, dword [0x00693434]
mov ecx, dword [0x006934e0]
add ecx, dword [0x00693520]
cmp eax, ecx
jle 0x5a798f
call fcn.004096f0
mov eax, dword [0x0069342c]
add eax, dword [0x006934c4]
mov ecx, dword [0x00693500]
add ecx, dword [0x00693540]
cmp eax, ecx
jle 0x5a79b7
mov eax, dword [0x00693540]
mov dword [0x0069342c], eax
mov dword [rbp + 0x7c], 0x400
mov dword [rbp + 0x70], 0x64
mov dword [rbp + 0x78], 0x400
mov dword [rbp + 0x6c], 0x64
mov dword [rbp + 0x74], 0x200
mov dword [rbp + 0x68], 0x32
call fcn.004096f0
mov ecx, dword [rbp + 0x78]
call fcn.00409720
mov dword [rbp + 0x78], eax
mov ecx, dword [rbp + 0x6c]
call fcn.00409720
mov dword [rbp + 0x6c], eax
mov ecx, dword [rbp + 0x7c]
call fcn.00409720
mov dword [rbp + 0x7c], eax
mov ecx, dword [rbp + 0x70]
call fcn.00409720
mov dword [rbp + 0x70], eax
mov ecx, dword [rbp + 0x74]
call fcn.00409720
mov dword [rbp + 0x74], eax
mov ecx, dword [rbp + 0x68]
call fcn.00409720
mov dword [rbp + 0x68], eax
mov ecx, 1
call sub.kernel32.dll_Sleep_2
lea rcx, [rbp + 0x48]
mov edx, dword [rbp + 0x78]
imul edx, dword [rbp + 0x6c]
call fcn.0042e830
lea rcx, [rbp + 0x40]
mov edx, dword [rbp + 0x7c]
imul edx, dword [rbp + 0x70]
call fcn.0042e830
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x74]
imul edx, dword [rbp + 0x68]
call fcn.0042e830
lea rcx, [rbp + 0x50]
mov edx, 3
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.00410ca0
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x50]
call fcn.004108e0
mov dword [rbp + 0x64], 0
mov rax, qword [rbp + 0x90]
mov rax, qword [rax]
test rax, rax
je 0x5a7ab2
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0x14
jle 0x5a7bd7
mov rcx, qword [rbp + 0x90]
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax]
mov r8d, 1
mov r9d, 0x13
call fcn.00410530
jmp 0x5a7bd7
mov eax, dword [0x00693560]
mov dword [0x00693538], eax
mov eax, dword [0x00693560]
mov dword [0x00693538], eax
mov eax, dword [0x006934e0]
cmp eax, dword [0x00693520]
je 0x5a7c09
mov eax, dword [0x006934e0]
mov dword [0x00693520], eax
mov eax, dword [0x00693400]
add eax, dword [0x0069343c]
mov ecx, dword [0x006934d4]
add ecx, dword [0x006934fc]
cmp eax, ecx
jle 0x5a7c31
mov eax, dword [0x006934fc]
mov dword [0x00693400], eax
mov eax, dword [0x00693530]
mov dword [0x006934f0], eax
mov eax, dword [0x00693530]
mov dword [0x006934f0], eax
mov eax, dword [0x006934c8]
cmp eax, dword [0x006934f0]
je 0x5a7c63
mov eax, dword [0x006934c8]
mov dword [0x006934f0], eax
mov eax, dword [0x006933e0]
mov dword [0x006933b4], eax
mov eax, dword [0x0069353c]
mov dword [0x00693514], eax
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.0040ea00
mov rax, qword [rbp + 0x90]
lea rsp, [rbp + 0x80]
pop rbp
ret