Function at 0x180001660
Capabilities:
Check os version
Get disk information
Get disk size
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x8c0
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov qword [0x18009d678], r12
mov dword [rsp + 0x30], 0xc0000001
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x34], r12b
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x78], 0x400
mov eax, dword [0x18009c868]
test eax, eax
jne 0x1800022cc
lea rcx, [0x18009d640]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x18009c868]
test eax, eax
jne 0x1800022cc
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jne 0x180001709
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff00
cmp eax, 0x100
jae 0x180001717
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jbe 0x1800017f3
lea rdx, str.SYSTEM
lea rcx, [0x18009d680]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x18000177f
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x180001773
test byte [rcx + 0x1c], 1
je 0x180001773
cmp byte [rcx + 0x19], 2
jb 0x180001773
mov edx, 0xe
mov dword [rsp + 0x20], eax
lea r9, str.UstrInitStatic
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
lea r14, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
jmp 0x1800020f0
lea r14, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
lea rax, str.SECTOR_SIZES
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000000
lea rcx, [0x18009d690]
call fcn.18004b2b0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001ae6
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x15
lea r9, str.LstAllocAndInit
jmp 0x180001a70
mov eax, dword [rsp + 0x78]
add eax, eax
cmp byte [0x18009b380], 0
je 0x180001831
mov ecx, 0x18b
lea r14, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], cx
xor r9d, r9d
mov r8d, 0x5254533a
mov edx, eax
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180001851
mov r8d, eax
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea r14, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov qword [rsp + 0x58], rax
mov qword [0x18009c870], rax
test rax, rax
jne 0x18000189e
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x180001894
test byte [rcx + 0x1c], 1
je 0x180001894
cmp byte [rcx + 0x19], 2
jb 0x180001894
lea edx, [rax + 0xf]
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov ebx, 0xc000009a
jmp 0x1800020ec
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1800019f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp eax, 0x7a
jne 0x1800019c8
mov eax, dword [rsp + 0x78]
lea eax, [rax*2 + 2]
cmp byte [0x18009b380], 0
je 0x180001903
mov ecx, 0x198
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], cx
xor r9d, r9d
mov r8d, 0x5254533a
mov edx, eax
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18000191c
mov r8d, eax
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0x60], rax
mov qword [0x18009c870], rax
test rax, rax
jne 0x180001960
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x180001894
test byte [rcx + 0x1c], 1
je 0x180001894
cmp byte [rcx + 0x19], 2
jb 0x180001894
lea edx, [rax + 0x10]
jmp 0x180001884
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1800019f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800019bd
test byte [rcx + 0x1c], 1
je 0x1800019bd
cmp byte [rcx + 0x19], 2
jb 0x1800019bd
mov edx, 0x11
lea r9, str.Get_user_name
mov dword [rsp + 0x20], ebx
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
add ebx, 0xe8f00000
jmp 0x1800020ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800019bd
test byte [rcx + 0x1c], 1
je 0x1800019bd
cmp byte [rcx + 0x19], 2
jb 0x1800019bd
mov edx, 0x12
jmp 0x1800019a2
mov ecx, dword [rsp + 0x78]
mov edx, 0x24
mov rax, qword [0x18009c870]
mov word [rax + rcx*2], dx
mov ecx, dword [rsp + 0x78]
inc ecx
mov rax, qword [0x18009c870]
mov word [rax + rcx*2], r12w
mov rdx, qword [0x18009c870]
lea rcx, [0x18009d680]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001a89
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x13
lea r9, str.UstrInitStatic
mov dword [rsp + 0x20], eax
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x1800020f0
xor r8d, r8d
lea rdx, [0x18009d680]
lea rcx, [0x18009d680]
call fcn.18004a690
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001786
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x14
lea r9, str.UstrUpper
jmp 0x180001a70
lea rdx, [rsp + 0xb0]
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x180001b41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rsi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800019bd
test byte [rcx + 0x1c], 1
je 0x1800019bd
cmp byte [rcx + 0x19], 2
jb 0x1800019bd
mov edx, 0x16
lea r9, str.Get_drive_names
jmp 0x1800019a9
lea rdi, [rsp + 0xb0]
mov qword [rsp + 0x48], rdi
lea rsi, [0x18009b358]
mov r13d, 0x1f9
movzx r15d, byte [rsp + 0x34]
mov ebx, 0x1da
cmp r12w, word [rdi]
je 0x180001f9c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x180001b9e
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x180001b85
lea rdi, [rdi + rax*2]
add rdi, 2
mov qword [rsp + 0x48], rdi
jmp 0x180001b66
test r15b, r15b
jne 0x180001d2f
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x180001bb0
mov r9, r14
movzx r8d, bx
lea rcx, [rsp + 0x80]
call fcn.180049910
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001c0d
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x17
lea r9, str.UstrAlloc
jmp 0x180001a70
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], 0
jne 0x180001c14
add r8, r8
mov rdx, rdi
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
call fcn.18005f360
mov rax, qword [rsp + 0x80]
mov ecx, 4
mov word [rax], cx
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call fcn.180040cc0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001c97
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x18
lea r9, str.TrfGetVolInfoObjectFromDosDeviceName
jmp 0x180001a70
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x59], 1
jne 0x180001d08
mov r8d, 0x1ea
mov r9, r14
mov rdx, qword [rsp + 0x80]
lea rcx, [0x18009c860]
call fcn.18004aa10
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001cfe
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x19
lea r9, str.WstrAllocAndInit
jmp 0x180001a70
mov r15b, 1
mov byte [rsp + 0x34], r15b
jmp 0x180001d2f
mov edx, 0x1f4
mov r8, r14
lea rcx, [rsp + 0x80]
call fcn.18004a470
mov qword [rsp + 0x80], r12
lea rcx, [rsp + 0x38]
call fcn.1800407f0
cmp byte [0x18009b380], 0
je 0x180001d5e
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], r13w
xor r9d, r9d
lea edx, [r9 + 0x20]
mov r8d, 0x4b45443a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180001d78
xor edx, edx
lea r8d, [rdx + 0x20]
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x180001db3
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x180001894
test byte [rcx + 0x1c], 1
je 0x180001894
cmp byte [rcx + 0x19], 2
jb 0x180001894
lea edx, [rax + 0x1a]
jmp 0x180001884
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov r9d, 0x201
mov rcx, qword [rsp + 0x70]
add rcx, 0x18
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rdi
call fcn.18004a900
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001e1b
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x1b
lea r9, str.WstrAllocAndInit
jmp 0x180001a70
mov rcx, qword [rsp + 0x70]
lea r8, [rcx + 0x10]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x180001f32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x180001e97
test byte [rcx + 0x1c], 1
je 0x180001e97
cmp byte [rcx + 0x19], 3
jb 0x180001e97
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x70]
mov r9, qword [r9 + 0x18]
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001180
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x180001f0a
lea rcx, [r8 + 0x18]
cmp qword [rcx], 0
je 0x180001ebd
mov edx, 0x214
mov r8, r14
call fcn.18004afd0
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x180001f0a
cmp byte [0x18009b380], 0
je 0x180001eef
mov r9d, 0x216
mov qword [rsp + 0x20], r14
mov r8d, 0x4b45443a
lea rdx, [rsp + 0x70]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180001f05
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x70], r12
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x180001f16
lea rdi, [rdi + rax*2]
add rdi, 2
mov qword [rsp + 0x48], rdi
jmp 0x180001b61
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x18009d690]
call fcn.18004b5a0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180001f82
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x1d
lea r9, str.LstInsertTail
jmp 0x180001a70
mov qword [rsp + 0x70], r12
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x180001f90
jmp 0x180001f20
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, ax
lea rax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
lea rdx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
cmp ecx, 0x105
cmovne rax, rdx
mov qword [0x18009d670], rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x50], eax
mov r8d, 0x235
mov r9, r14
mov edx, 0x64
lea rcx, [0x18009c858]
call fcn.18004a890
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x180002041
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x1e
lea r9, str.WstrAlloc
jmp 0x180001a70
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [0x18009c860]
lea r8, str._s_I64u
mov edx, 0x64
mov rcx, qword [0x18009c858]
call fcn.180001010
cmp eax, 0xffffffff
jne 0x18000209c
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
lea edx, [rax + 0x20]
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
jmp 0x1800020f0
lea rdx, [0x18009d668]
lea rcx, [0x18009d678]
call fcn.180005dd0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x1800020e2
mov rcx, qword [0x18009b358]
cmp rcx, rsi
je 0x1800020f0
test byte [rcx + 0x1c], 1
je 0x1800020f0
cmp byte [rcx + 0x19], 2
jb 0x1800020f0
mov edx, 0x20
lea r9, str.GetIv
jmp 0x180001a70
lock inc dword [0x18009c868]
mov ebx, r12d
mov dword [rsp + 0x30], ebx
test ebx, ebx
jns 0x18000227c
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18000216e
lea rcx, [rax + 0x18]
cmp qword [rcx], 0
je 0x180002119
mov edx, 0x254
mov r8, r14
call fcn.18004afd0
cmp qword [rsp + 0x70], 0
je 0x18000216e
cmp byte [0x18009b380], 0
je 0x18000214e
mov r9d, 0x256
mov qword [rsp + 0x20], r14
mov r8d, 0x4b45443a
lea rdx, [rsp + 0x70]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180002169
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x70], r12
mov r8, qword [0x18009d678]
test r8, r8
je 0x1800021c6
cmp byte [0x18009b380], 0
je 0x1800021a9
mov r9d, 0x25a
mov qword [rsp + 0x20], r14
mov r8d, 0x4b45443a
lea rdx, [0x18009d678]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x1800021bf
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [0x18009d678], r12
cmp qword [0x18009d690], 0
je 0x1800021e8
call fcn.1800015a0
mov rcx, qword [0x18009d690]
call fcn.18004b6a0
mov qword [0x18009d690], r12
cmp qword [0x18009c858], 0
je 0x180002206
mov edx, 0x264
mov r8, r14
lea rcx, [0x18009c858]
call fcn.18004afd0
cmp qword [0x18009c860], 0
je 0x180002224
mov edx, 0x268
mov r8, r14
lea rcx, [0x18009c860]
call fcn.18004afd0
mov r8, qword [0x18009c870]
test r8, r8
je 0x18000227c
cmp byte [0x18009b380], 0
je 0x18000225f
mov r9d, 0x26c
mov qword [rsp + 0x20], r14
mov r8d, 0x5254533a
lea rdx, [0x18009c870]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180002275
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [0x18009c870], r12
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x18000229b
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x88]
call fcn.18004f370
cmp qword [rsp + 0x80], 0
je 0x1800022bb
mov edx, 0x275
mov r8, r14
lea rcx, [rsp + 0x80]
call fcn.18004a470
lea rcx, [0x18009d640]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x1800022ce
xor eax, eax
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret