Function at 0x48f820
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov esi, ecx
call fcn.005359d0
add esp, 4
push eax
call fcn.0053c4fd
add esp, 8
mov dword [0x5d0700], 0
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48f883
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00525fd0
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1a3
push 0x5a7330
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
push str.vnclang_server.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5d0700], eax
test eax, eax
jne 0x48f8e6
mov dword [0x5d0700], esi
call fcn.0048f4a0
mov dword [0x5d07c8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0x224]
call fcn.0048e3a0
cmp dword [ebp - 0x224], 0
jne 0x48f932
push 0
push 0x5adfa8
mov edx, 0x5d04f0
call fcn.00425f30
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov al, byte [ebp - 0x254]
add al, byte [ebp - 0x240]
add al, byte [ebp - 0x23c]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0
push 0
push 0
push 0
mov byte [ebp - 0x21d], al
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x5b4ba8
mov dword [ebp - 0x224], 0
call edi
mov eax, dword [ebp - 0x224]
xorps xmm0, xmm0
mov ecx, eax
shr ecx, 0x10
add cl, al
xor eax, eax
mov dword [ebp - 0x228], ecx
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x21c], xmm0
pop ebx
nop
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x224], 0
mov dword [edi], eax
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0
push 0
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
movups xmm1, xmmword [ebp - 0x21c]
push 0
push 0
movaps xmm0, xmm1
psrldq xmm0, 8
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
movd eax, xmm1
movzx eax, ax
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x254]
shr eax, 8
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x5b4ba8
call edi
mov ecx, dword [ebp - 0x224]
lea edi, [ebp - 0x21c]
shr ecx, 0x10
xor eax, eax
add ecx, dword [ebp - 0x224]
xorps xmm0, xmm0
shr ecx, 8
mov dword [ebp - 0x224], ecx
xor ecx, ecx
push ebx
movups xmmword [ebp - 0x21c], xmm0
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov cl, byte [ebp - 0x21d]
mov dword [edi + 0xc], edx
movups xmm1, xmmword [ebp - 0x21c]
mov byte [0x5c3c10], cl
mov ecx, dword [ebp - 0x228]
movaps xmm0, xmm1
mov byte [0x5c3c11], cl
mov ecx, dword [ebp - 0x22c]
psrldq xmm0, 8
paddw xmm1, xmm0
mov byte [0x5c3c12], cl
mov ecx, dword [ebp - 0x230]
movups xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
mov byte [0x5c3c13], cl
mov ecx, dword [ebp - 0x224]
movups xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
mov byte [str.NX_a], cl
movd eax, xmm1
mov word [0x5c3c16], 0x758
mov byte [ebp - 0x21d], 1
movzx eax, ax
shr eax, 8
mov byte [0x5c3c15], al
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret