Function at 0x180005dd0
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, 0xffffffffffffffff
mov qword [r11 - 0x70], r15
xor ebx, ebx
mov qword [r11 - 0x58], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x48], xmm0
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x40], 0xc0000001
mov qword [r11 - 0x50], rbx
cmp byte [0x18009b380], al
je 0x180005e69
mov eax, 0x922
lea rbx, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x20], ax
xor r9d, r9d
mov edx, 0x400
mov r8d, 0x4b45443a
lea rcx, [0x18009cc40]
call fcn.18004b960
xor ebx, ebx
jmp 0x180005e85
xor edx, edx
mov r8d, 0x400
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea rdi, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x180005ed8
lea r14, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180005eca
test byte [rcx + 0x1c], 1
je 0x180005eca
cmp byte [rcx + 0x19], 2
jb 0x180005eca
mov edx, 0x84
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov esi, 0xc000009a
mov dword [rsp + 0x40], esi
jmp 0x1800063c4
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [0x18009c858]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180006013
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [0x18009c858]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180005fb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x44], eax
lea r14, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180005fa3
test byte [rcx + 0x1c], 1
je 0x180005fa3
cmp byte [rcx + 0x19], 2
jb 0x180005fa3
mov edx, 0x85
lea r9, str.CreateFile
mov dword [rsp + 0x20], ebx
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
lea esi, [rbx - 0x17100000]
mov dword [rsp + 0x40], esi
jmp 0x1800063c4
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x98]
mov r8d, 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180006013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x44], eax
lea r14, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180005fa3
test byte [rcx + 0x1c], 1
je 0x180005fa3
cmp byte [rcx + 0x19], 2
jb 0x180005fa3
mov edx, 0x86
lea r9, [0x180090950]
jmp 0x180005f8f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x58], r15
lea rdx, [rsp + 0x50]
mov rcx, qword [0x18009c858]
call fcn.1800013b0
mov esi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x180006093
lea r14, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x1800063c4
test byte [rcx + 0x1c], 1
je 0x1800063c4
cmp byte [rcx + 0x19], 2
jb 0x1800063c4
mov edx, 0x87
mov dword [rsp + 0x20], eax
lea r9, str.GetSectorSize
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x1800063c4
xor edi, edi
mov r12d, edi
mov dword [rsp + 0x60], edi
lea r14, [0x18009b358]
mov r13d, dword [rsp + 0x50]
mov rcx, qword [0x18009b358]
lea rbx, [0x180006480]
cmp r12d, 2
jae 0x180006375
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, qword [0x18009c858]
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
mov dword [rsp + 0x44], eax
test eax, eax
je 0x1800062b5
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180006110
test byte [rcx + 0x1c], 1
je 0x180006110
cmp byte [rcx + 0x19], 3
jb 0x180006110
mov edx, 0x88
mov r9d, eax
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], 0xc0000001
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, qword [0x18009c858]
call fcn.18001e500
mov ebx, eax
mov dword [rsp + 0x48], eax
test eax, eax
jns 0x180006182
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180006178
test byte [rcx + 0x1c], 1
je 0x180006178
cmp byte [rcx + 0x19], 3
jb 0x180006178
mov edx, 0x89
mov r9d, eax
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov rdi, qword [rsp + 0x50]
jmp 0x180006268
mov rdi, qword [rsp + 0x50]
jmp 0x18000626f
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x18000620e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180006202
test byte [rcx + 0x1c], 1
je 0x180006202
cmp byte [rcx + 0x19], 3
jb 0x180006202
mov edx, 0x8a
mov r9d, ebx
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov rcx, qword [0x18009b358]
add ebx, 0xe8f00000
mov dword [rsp + 0x48], ebx
jmp 0x18000626f
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov r8d, 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180006262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x180006202
test byte [rcx + 0x1c], 1
je 0x180006202
cmp byte [rcx + 0x19], 3
jb 0x180006202
mov edx, 0x8b
jmp 0x1800061e8
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov rcx, qword [0x18009b358]
test rdi, rdi
je 0x18000628a
mov rcx, rdi
call fcn.18001ed50
xor edi, edi
mov qword [rsp + 0x50], rdi
mov rcx, qword [0x18009b358]
cmp r15, 0xffffffffffffffff
je 0x1800062a0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x18009b358]
test ebx, ebx
jns 0x180006375
inc r12d
mov dword [rsp + 0x60], r12d
jmp 0x1800060af
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0x400
mov dword [rsp + 0x90], r13d
mov qword [rsp + 0x68], rbx
mov r8, qword [rsp + 0x78]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReadEncryptedFileRaw]
mov ebx, eax
mov dword [rsp + 0x44], eax
test eax, eax
je 0x180006346
mov rcx, qword [0x18009b358]
cmp rcx, r14
je 0x18000633a
test byte [rcx + 0x1c], 1
je 0x18000633a
cmp byte [rcx + 0x19], 2
jb 0x18000633a
mov edx, 0x8c
mov dword [rsp + 0x20], eax
lea r9, [0x180090960]
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov rcx, qword [0x18009b358]
lea esi, [rbx - 0x17100000]
mov dword [rsp + 0x40], esi
jmp 0x18000634d
mov rcx, qword [0x18009b358]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x180006367
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
mov rcx, qword [0x18009b358]
test ebx, ebx
jne 0x1800062a8
mov dword [rsp + 0x40], edi
jmp 0x1800063a1
test esi, esi
jns 0x1800063a1
cmp rcx, r14
je 0x1800063bd
test byte [rcx + 0x1c], 1
je 0x1800063bd
cmp byte [rcx + 0x19], 2
jb 0x1800063bd
mov edx, 0x8d
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
jmp 0x1800063bd
mov rax, qword [rsp + 0x70]
mov qword [0x18009d678], rax
mov dword [0x18009d668], 0x10
mov esi, edi
mov dword [rsp + 0x40], edi
lea rdi, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
cmp r15, 0xffffffffffffffff
je 0x1800063d3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x180006430
cmp qword [rsp + 0x70], 0
je 0x180006430
cmp byte [0x18009b380], 0
je 0x18000640c
mov r9d, 0x9d5
mov qword [rsp + 0x20], rdi
mov r8d, 0x4b45443a
lea rdx, [rsp + 0x70]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180006427
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x70], 0
mov rcx, qword [0x18009c858]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret