Function at 0x1400887d0
Capabilities:
Get disk information
Get system information on windows
Initialize winsock library

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rcx
mov ecx, 2
call fcn.14014b088
mov rcx, rax
xor edx, edx
call fcn.14014c630
xor r12d, r12d
lea rdx, [rbp + 0x240]
mov r8d, 0x104
mov qword [0x1401fc638], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140088843
lea edx, [r12 + 0x5c]
lea rcx, [rbp + 0x240]
call fcn.140133e58
mov byte [rax], r12b
lea r8, [rbp + 0x240]
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.14013ac00
lea r8, [0x1401c3a08]
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.14013ac60
lea r8, str.vnclang_server.dll
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.14013ac60
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
cmove rax, rbx
mov qword [0x1401fc638], rax
call fcn.1400881d0
call fcn.1400765a0
mov qword [0x1401fc848], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 2
lea rdx, [rbp - 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140088ab1
movzx eax, word [rbp - 0x80]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x480], rsi
mov qword [rsp + 0x488], rdi
mov qword [rsp + 0x490], r14
mov qword [rsp + 0x498], r15
mov word [0x14023f4fc], ax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r15d, byte [rsp + 0x48]
lea r9, [rsp + 0x40]
add r15b, byte [rsp + 0x68]
lea rcx, [0x1401d1814]
add r15b, byte [rsp + 0x6c]
xor r8d, r8d
mov dword [rsp + 0x38], r12d
xor edx, edx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edi, dword [rsp + 0x6c]
mov r14d, eax
add edi, dword [rsp + 0x68]
xor ecx, ecx
add edi, dword [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov qword [rsp + 0x30], r12
shr r14d, 0x10
add r14b, al
mov qword [rsp + 0x28], r12
xor eax, eax
shr edi, 8
cpuid
mov dword [rbp + 0x12c], edx
movzx esi, word [rbp + 0x12e]
add si, dx
mov dword [rbp + 0x128], ecx
add si, word [rbp + 0x12a]
xor edx, edx
add si, cx
mov dword [rbp + 0x120], eax
mov dword [rbp + 0x124], ebx
lea rcx, [0x1401d1814]
add si, word [rbp + 0x126]
add si, bx
mov dword [rsp + 0x40], r12d
add si, word [rbp + 0x122]
add si, ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x40]
xor ecx, ecx
mov r8d, eax
mov byte [reloc.WS2_32.dll_socket], r15b
shr r8d, 0x10
xorps xmm0, xmm0
add r8w, ax
mov byte [0x1401f0d51], r14b
xor eax, eax
shr r8w, 8
cpuid
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x120], eax
mov dword [rbp + 0x12c], edx
movzx eax, word [rbp + 0x12e]
add ax, dx
mov dword [rbp + 0x128], ecx
add ax, word [rbp + 0x12a]
add ax, cx
mov dword [rbp + 0x124], ebx
add ax, word [rbp + 0x126]
add ax, bx
add ax, word [rbp + 0x122]
add ax, word [rbp + 0x120]
shr ax, 8
mov byte [0x1401f0d52], sil
mov byte [reloc.WS2_32.dll_getsockname], dil
mov byte [str.NX_a], r8b
mov byte [0x1401f0d55], al
mov word [0x1401f0d56], 0x758
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r15, qword [rsp + 0x498]
mov al, 1
mov r14, qword [rsp + 0x490]
mov rdi, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x480]
jmp 0x140088ac9
xor r9d, r9d
lea r8, [0x1401ca37c]
lea rdx, [0x1401fd9b0]
call fcn.1400208f0
xor al, al
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x460
pop r12
pop rbx
pop rbp
ret