Function at 0x1800027a8
Capabilities:
Get disk size
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp byte [rcx + 0x78], 0
je 0x1800027df
call fcn.180002b78
test al, al
je 0x180002b5c
lea r14, [rdi + 0xb0]
mov rax, qword [r14 + 8]
mov esi, 1
cmp qword [r14], rax
jne 0x1800028f8
lea rax, [rdi + 0xd0]
mov qword [rbp - 0x48], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x120], 0
jne 0x1800028aa
mov ecx, dword [0x18002dde8]
imul ecx, ecx
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x13
jne 0x18000289c
mov rax, qword [str.gSzq6d3FysIlFs]
mov qword [rbp - 0x40], rax
mov eax, dword [0x180023d18]
mov dword [rbp - 0x38], eax
movzx eax, word [0x180023d1c]
mov word [rbp - 0x34], ax
mov al, byte [0x180023d1e]
mov byte [rbp - 0x32], al
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp byte [rax + rcx], 0
jne 0x180002876
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180008ef4
mov rcx, rax
call fcn.18000a234
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180002b5c
lea rcx, [rdi + 0x100]
lea rdx, [rbp - 0x28]
call fcn.1800039b0
mov rdx, rax
mov rax, qword [rax]
test rax, rax
je 0x1800028c8
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
sub rcx, rsi
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
add rdx, 8
mov rcx, r14
call fcn.180003408
and qword [rdi + 0xc8], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [rbp - 0x50], 0
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
sub r8, rdx
lea rcx, [rdi + 0x80]
add rdx, qword [rdi + 0xc8]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x50]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800029ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x18000297b
cmp eax, 0x3e5
je 0x180002975
lea rax, str.Channel_write_failure
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180009fb8
nop
lea rax, [0x180023da8]
mov qword [rbp - 0x28], rax
lea rdx, [0x1800298c0]
lea rcx, [rbp - 0x28]
call fcn.18000a7b8
int3
mov byte [rdi + 0x78], sil
jmp 0x1800029ac
lea rcx, [rbp - 0x40]
call fcn.18000a030
nop
lea rax, [0x180023da8]
mov qword [rbp - 0x40], rax
lea rax, [0x180023dc8]
mov qword [rbp - 0x40], rax
lea rdx, [0x180029878]
lea rcx, [rbp - 0x40]
call fcn.18000a7b8
int3
cmp byte [rdi + 0x78], 0
jne 0x180002b5c
mov r8d, dword [0x18002dde8]
lea eax, [r8 + 1]
imul eax, r8d
and eax, 0x80000003
jge 0x1800029d3
sub eax, esi
or eax, 0xfffffffc
add eax, esi
cmp eax, esi
jne 0x1800029f4
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x18002dde8]
mov eax, dword [rbp - 0x50]
add qword [rdi + 0xc8], rax
lea r10d, [r8 + 1]
mov r9d, r10d
imul r9d, r8d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r9d
sub ecx, eax
cmp ecx, esi
jne 0x180002aae
lea eax, [r8 + 2]
imul eax, r10d
imul eax, r8d
and eax, 0x8000000f
jge 0x180002a42
sub eax, esi
or eax, 0xfffffff0
add eax, esi
cmp eax, 0xd
je 0x180002a8c
mov eax, 0x66666667
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r9d, ecx
cmp r9d, 0xe
jne 0x180002a8c
xor r9d, r9d
test r8d, r8d
je 0x180002a85
mov ecx, r8d
and ecx, esi
add r9d, ecx
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
jne 0x180002a70
mov dword [0x18002dde8], r9d
mov ecx, 4
call fcn.1800095e8
mov rbx, rax
call fcn.18000a23c
mov dword [rbx], eax
mov dword [0x18002dde8], eax
mov rcx, rbx
call fcn.1800095e0
mov rax, qword [r14 + 8]
sub rax, qword [r14]
cmp qword [rdi + 0xc8], rax
jne 0x180002b4a
lea rax, [rdi + 0xd0]
mov qword [rbp - 0x48], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x120], 0
je 0x180002b26
mov rcx, qword [rdi + 0x110]
sub rcx, rsi
and rcx, qword [rdi + 0x118]
mov rax, qword [rdi + 0x108]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
or r8, 0xffffffffffffffff
add qword [rdi + 0x120], r8
jne 0x180002b1f
and qword [rdi + 0x118], 0
jmp 0x180002b26
add qword [rdi + 0x118], rsi
mov rax, qword [r14]
mov qword [r14 + 8], rax
and qword [rdi + 0xc8], 0
cmp qword [rdi + 0x120], 0
setne sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, sil
jmp 0x180002b5e
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret