Function at 0x40be34
Capabilities:
Accept command line arguments
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff944
xor eax, eax
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c326
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6b0]
xor eax, eax
call fcn.00402848
mov edx, dword [ebp - 0x6b0]
lea eax, [ebp - 4]
mov ecx, 0x40c33c
call fcn.0040429c
lea eax, [ebp - 0x6b8]
call fcn.00406c44
mov eax, dword [ebp - 0x6b8]
mov dl, byte [eax]
lea eax, [ebp - 0x6b4]
call fcn.004041a8
lea eax, [ebp - 0x6b4]
mov edx, 0x40c348
call fcn.00404258
mov eax, dword [ebp - 0x6b4]
call fcn.00404448
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x40bf0f
jmp 0x40beed
mov edx, dword [ebp - 4]
mov eax, 0x40c354
call fcn.00404530
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004044e8
mov edx, dword [ebp - 4]
mov eax, 0x40c354
call fcn.00404530
test eax, eax
jg 0x40bed1
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [0x40e870]
call fcn.0040429c
lea edx, [ebp - 0x6bc]
xor eax, eax
call fcn.00402848
mov edx, dword [ebp - 0x6bc]
lea eax, [ebp - 0x160]
call fcn.00402b64
mov eax, dword [0x40d480]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00402f68
call fcn.004026fc
test eax, eax
je 0x40bf53
call fcn.00403ef0
lea eax, [ebp - 0x160]
call fcn.00402d98
call fcn.00402648
mov dword [ebp - 8], eax
mov edx, 0x26
lea eax, [ebp - 0x160]
call fcn.00402f90
call fcn.00402648
push 0
mov edx, 0x40e864
mov ecx, 4
lea eax, [ebp - 0x160]
call fcn.00402cc8
call fcn.00402648
xor edx, edx
lea eax, [ebp - 0x160]
call fcn.00402f90
call fcn.00402648
cmp dword [0x40e864], 0
jne 0x40bfba
mov eax, dword [ebp - 8]
mov dword [0x40e864], eax
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x40bfdc
cmp eax, 0xa
jae 0x40bfe6
jmp 0x40bfde
jge 0x40bfe6
mov eax, dword [0x40e864]
mov dword [ebp - 8], eax
mov eax, dword [0x40e864]
mov dword [0x40e860], eax
mov eax, dword [0x40e864]
call fcn.00402554
mov dword [0x40e85c], eax
lea eax, [ebp - 0xc]
push eax
mov edx, dword [0x40e85c]
mov ecx, dword [0x40e864]
lea eax, [ebp - 0x160]
call fcn.00402cc8
call fcn.00402648
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
cmp edx, dword [esp + 4]
jne 0x40c035
cmp eax, dword [esp]
pop edx
pop eax
je 0x40c2f8
xor eax, eax
call fcn.00406c10
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [esp + 4]
jne 0x40c06f
cmp eax, dword [esp]
pop edx
pop eax
ja 0x40c2f8
jmp 0x40c077
pop edx
pop eax
jg 0x40c2f8
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2ac]
call fcn.00402b64
mov edx, 1
lea eax, [ebp - 0x2ac]
call fcn.00402f84
call fcn.004026fc
test eax, eax
setne byte [ebp - 0x11]
mov al, byte [ebp - 0x11]
and al, byte [0x40e853]
jne 0x40c174
xor eax, eax
push ebp
push 0x40c16d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00402554
mov dword [0x40e858], eax
push 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov ecx, eax
mov edx, dword [0x40e858]
lea eax, [ebp - 0x160]
call fcn.00402cc8
call fcn.00402648
push 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov ecx, eax
mov edx, dword [0x40e858]
lea eax, [ebp - 0x2ac]
call fcn.00402ce8
call fcn.00402648
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c174
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e864]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov edx, eax
mov eax, dword [0x40e858]
call fcn.00402574
ret
lea eax, [ebp - 0x2ac]
call fcn.00402d08
lea eax, [ebp - 0x160]
call fcn.00402d08
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.004041b8
mov edx, dword [ebp - 0x10]
mov eax, 0x40c360
call fcn.00404530
test eax, eax
jle 0x40c1c9
mov edx, dword [ebp - 0x10]
mov eax, 0x40c360
call fcn.00404530
mov ecx, eax
dec ecx
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.004044e8
jmp 0x40c1d1
lea eax, [ebp - 0x10]
call fcn.00403fe0
mov dword [0x40e874], 0x44
xor eax, eax
mov dword [0x40e878], eax
xor eax, eax
mov dword [0x40e880], eax
xor eax, eax
mov dword [0x40e8a0], eax
mov word [0x40e8a6], 0
xor eax, eax
mov dword [0x40e8a8], eax
lea eax, [ebp - 0x6ac]
mov ecx, 0x400
mov edx, dword [ebp - 4]
call fcn.00406d04
push 0x40e8b8
push 0x40e874
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404448
push eax
lea eax, [ebp - 0x6ac]
push eax
call sub.kernel32.dll_CreateProcessA
mov al, byte [0x40e853]
and al, byte [ebp - 0x11]
je 0x40c258
mov eax, dword [0x40e868]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40c2f8
call fcn.00409e18
cmp byte [0x40e852], 0
je 0x40c2b0
mov eax, dword [0x40e8e4]
mov edx, dword [0x40e8e0]
mov eax, dword [eax + edx*4 - 4]
call fcn.0040b208
test al, al
je 0x40c2b0
mov eax, dword [0x40e8e4]
mov edx, dword [0x40e8e0]
mov eax, dword [eax + edx*4 - 4]
xor edx, edx
call fcn.0040b168
mov byte [0x40e852], 0
mov eax, 0x40e8d0
mov edx, 0x40e8dc
mov ecx, dword [0x409d24]
call fcn.00404960
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x40e8b8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x40c2d2
call fcn.00403ef0
cmp dword [ebp - 0xc], 0x103
je 0x40c258
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2ac]
call fcn.00402b64
lea eax, [ebp - 0x2ac]
call fcn.00402d60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c32d
lea eax, [ebp - 0x6bc]
mov edx, 4
call fcn.00404004
lea eax, [ebp - 0x10]
call fcn.00403fe0
lea eax, [ebp - 4]
call fcn.00403fe0
ret