Function at 0x14008bad0
Capabilities:
Get disk information
Get system information on windows
Initialize winsock library

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rcx
mov ecx, 2
call fcn.14015b94c
mov rcx, rax
xor edx, edx
call fcn.140162478
xor r12d, r12d
lea rdx, [rbp + 0x240]
mov r8d, 0x104
mov qword [0x1402281b0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14008bb43
lea edx, [r12 + 0x5c]
lea rcx, [rbp + 0x240]
call fcn.140149b38
mov byte [rax], r12b
lea r8, [rbp + 0x240]
mov qword [rsp + 0x488], rdi
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.140150800
lea r8, [0x1401ef4f8]
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.140150860
lea r8, str.vnclang_server.dll
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.140150860
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
cmove rax, rbx
mov qword [0x1402281b0], rax
call fcn.14008b4d0
call fcn.140078140
mov qword [0x1402281b8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 2
lea rdx, [rbp - 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14008bdac
movzx eax, word [rbp - 0x80]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x480], rsi
mov qword [rsp + 0x490], r14
mov qword [rsp + 0x498], r15
mov word [0x14026aca8], ax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r15d, byte [rsp + 0x48]
lea r9, [rsp + 0x40]
add r15b, byte [rsp + 0x68]
lea rcx, [0x1401fd694]
add r15b, byte [rsp + 0x6c]
xor r8d, r8d
mov dword [rsp + 0x38], r12d
xor edx, edx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edi, dword [rsp + 0x6c]
mov r14d, eax
add edi, dword [rsp + 0x68]
xor ecx, ecx
add edi, dword [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov qword [rsp + 0x30], r12
shr r14d, 0x10
add r14b, al
mov qword [rsp + 0x28], r12
xor eax, eax
shr edi, 8
cpuid
mov dword [rbp + 0x12c], edx
movzx esi, word [rbp + 0x12e]
add si, dx
mov dword [rbp + 0x128], ecx
add si, word [rbp + 0x12a]
xor edx, edx
add si, cx
mov dword [rbp + 0x120], eax
mov dword [rbp + 0x124], ebx
lea rcx, [0x1401fd694]
add si, word [rbp + 0x126]
add si, bx
mov dword [rsp + 0x40], r12d
add si, word [rbp + 0x122]
add si, ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x40]
xor ecx, ecx
mov r8d, eax
mov byte [reloc.WS2_32.dll_socket], r15b
shr r8d, 0x10
xorps xmm0, xmm0
add r8w, ax
mov byte [0x14021be31], r14b
xor eax, eax
shr r8w, 8
cpuid
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x120], eax
mov dword [rbp + 0x12c], edx
movzx eax, word [rbp + 0x12e]
add ax, dx
mov dword [rbp + 0x128], ecx
add ax, word [rbp + 0x12a]
add ax, cx
mov dword [rbp + 0x124], ebx
add ax, word [rbp + 0x126]
add ax, bx
mov byte [0x14021be32], sil
add ax, word [rbp + 0x122]
add ax, word [rbp + 0x120]
shr ax, 8
mov byte [reloc.WS2_32.dll_getsockname], dil
mov byte [str.NX_a], r8b
mov byte [0x14021be35], al
mov word [0x14021be36], 0x758
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r15, qword [rsp + 0x498]
mov al, 1
mov r14, qword [rsp + 0x490]
mov rsi, qword [rsp + 0x480]
jmp 0x14008be40
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], r12d
je 0x14008be25
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14008be3e
test rax, rax
je 0x14008be3e
cmp rax, rbx
je 0x14008be3e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, str.WinVNC
lea rdx, [0x140227de0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008be3e
xor r9d, r9d
lea r8, str.WinVNC
lea rdx, [0x140227de0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rdi, qword [rsp + 0x488]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x460
pop r12
pop rbx
pop rbp
ret