Function at 0x1800047cc
Capabilities:
Get disk size
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180029528]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, r8
mov r14, rdx
mov r15, rcx
lea rdx, [0x180021d60]
xor r12d, r12d
test r8, r8
cmovne rdx, r8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
cmp word [rdx], r12w
jne 0x18000484a
mov r8d, r12d
jmp 0x180004858
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x18000484e
lea rcx, [rsp + 0x40]
call fcn.18000398c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x18000487a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [0x18002bde8]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x16
jne 0x1800048cf
mov ecx, 4
call fcn.1800095a8
mov rbx, rax
call fcn.18000a138
mov dword [rbx], eax
mov dword [0x18002bde8], eax
mov rcx, rbx
call fcn.1800095a0
mov r8d, dword [0x18002bde8]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180004990
cmp dword [rbx], 0x4550
jne 0x180004990
mov eax, 0x10b
cmp word [rbx + 0x18], ax
jne 0x18000491c
cmp dword [rbx + 0x84], r12d
je 0x180004af7
mov eax, dword [rbx + 0x80]
test eax, eax
je 0x180004af7
lea rbx, [rdi + rax]
jmp 0x180004993
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x180004af7
cmp dword [rbx + 0x94], r12d
je 0x180004af7
cmp dword [rbx + 0x90], r12d
je 0x180004af7
mov ecx, r8d
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xb
jne 0x180004985
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x18002bde8]
mov ebx, dword [rbx + 0x90]
add rbx, rdi
jmp 0x180004993
mov rbx, r12
test rbx, rbx
je 0x180004af7
cmp dword [rbx + 0x10], r12d
je 0x180004af7
mov esi, r12d
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 3
jne 0x1800049f1
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x18002bde8]
mov r9d, dword [rbx]
add r9, rdi
jmp 0x180004a72
add rax, 2
add rax, rdi
mov r10, r15
sub r10, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r10]
sub ecx, edx
jne 0x180004a19
inc rax
test edx, edx
jne 0x180004a06
test ecx, ecx
je 0x180004a87
inc esi
add r9, 8
mov ecx, r8d
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x16
jne 0x180004a72
mov ecx, r12d
lea rdx, [rsp + 0x60]
mov eax, dword [rdx]
imul eax, eax, 0xa6
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x29c
jb 0x180004a4f
mov dword [0x18002bde8], r8d
mov rax, qword [r9]
test rax, rax
jne 0x1800049f9
add rbx, 0x14
jmp 0x18000499c
movsxd rdx, esi
mov ecx, dword [rbx + 0x10]
add rcx, rdi
lea rbx, [rcx + rdx*8]
mov rdi, qword [rbx]
test rdi, rdi
je 0x180004afa
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x180004ab3
mov qword [rbx], r14
jmp 0x180004afa
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180004aae
lea r9, [rsp + 0x30]
mov edx, 8
lea r8d, [rdx - 4]
mov rcx, rbx
call rsi
mov qword [rbx], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 8
mov rcx, rbx
call rsi
jmp 0x180004afa
mov rdi, r12
cmp qword [rsp + 0x58], 8
jb 0x180004b0c
mov rcx, qword [rsp + 0x40]
call fcn.1800095a0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
mov rax, rdi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.180008ef0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret