Function at 0x1800067f8
Capabilities:
Get disk size
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18002f528]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rbx, r8
mov r12, rdx
mov r13, rcx
mov r9d, dword [0x180031de8]
lea r8d, [r9 + 1]
imul r8d, r9d
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
mov edi, 1
xor r14d, r14d
cmp r8d, 0xf
jne 0x180006886
test r9d, r9d
cmove r9d, edi
mov dword [0x180031de8], r9d
lea rdx, [0x180026fe0]
test rbx, rbx
cmovne rdx, rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
cmp word [rdx], r14w
jne 0x1800068bd
mov r8, r14
jmp 0x1800068cb
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x1800068c1
lea rcx, [rsp + 0x40]
call fcn.180003d38
nop
mov r9d, dword [0x180031de8]
lea r8d, [r9 + 1]
imul r8d, r9d
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 3
jne 0x18000690d
sub r9d, edi
mov dword [0x180031de8], r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
test rax, rax
jne 0x180006924
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [0x180031de8]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 0xa
jne 0x1800069b8
lea r15, [rsp + 0x60]
xor r10d, r10d
lea ebx, [r10 + 1]
lea ecx, [r14 + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, r14d
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov edx, r8d
lea rcx, [0x180026cb8]
call fcn.18000cfd8
mov r10d, ebx
add r15, 4
mov r9d, dword [0x180031de8]
cmp ebx, 9
jl 0x180006963
add r14d, edi
cmp r14d, 0xd
jl 0x180006960
xor r14d, r14d
movsxd r8, dword [rsi + 0x3c]
add r8, rsi
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x180006a5a
cmp dword [r8], 0x4550
jne 0x180006a5a
mov eax, 0x10b
cmp word [r8 + 0x18], ax
jne 0x180006a07
cmp dword [r8 + 0x84], r14d
je 0x180006bad
mov eax, dword [r8 + 0x80]
test eax, eax
je 0x180006bad
add rax, rsi
jmp 0x180006a5d
mov eax, 0x20b
cmp word [r8 + 0x18], ax
jne 0x180006bad
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xb
jne 0x180006a44
sub r9d, edi
mov dword [0x180031de8], r9d
cmp dword [r8 + 0x94], r14d
je 0x180006bad
mov eax, dword [r8 + 0x90]
jmp 0x1800069fa
mov rax, r14
test rax, rax
je 0x180006bad
cmp dword [rax + 0x10], r14d
je 0x180006bad
mov ebx, r14d
mov ecx, dword [rax]
add rcx, rsi
jmp 0x180006aa8
add rdx, 2
add rdx, rsi
mov r11, r13
sub r11, rdx
movzx r8d, byte [rdx]
movzx r10d, byte [rdx + r11]
sub r8d, r10d
jne 0x180006a9d
add rdx, rdi
test r10d, r10d
jne 0x180006a87
test r8d, r8d
je 0x180006ab6
add ebx, edi
add rcx, 8
mov rdx, qword [rcx]
test rdx, rdx
jne 0x180006a7a
add rax, 0x14
jmp 0x180006a66
movsxd rdx, ebx
mov ecx, dword [rax + 0x10]
add rcx, rsi
lea rbx, [rcx + rdx*8]
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x180006b05
cmp r9d, edi
jle 0x180006afc
mov eax, r9d
cdq
idiv edi
inc edi
add edi, edx
cmp edi, r9d
jl 0x180006aed
mov r9d, edi
mov dword [0x180031de8], edi
mov rdi, qword [rbx]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 5
jne 0x180006b4d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test rdi, rdi
je 0x180006bb0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x180006b69
mov qword [rbx], r12
jmp 0x180006bb0
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180006b64
lea r9, [rsp + 0x30]
mov edx, 8
lea r8d, [rdx - 4]
mov rcx, rbx
call rsi
mov qword [rbx], r12
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 8
mov rcx, rbx
call rsi
jmp 0x180006bb0
mov rdi, r14
cmp qword [rsp + 0x58], 8
jb 0x180006bc2
mov rcx, qword [rsp + 0x40]
call fcn.18000c430
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
mov rax, rdi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18000bd80
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret