Function at 0x40d364
Capabilities:
Accept command line arguments
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff944
xor eax, eax
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d82d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6b0]
xor eax, eax
call fcn.00402870
mov edx, dword [ebp - 0x6b0]
lea eax, [ebp - 4]
mov ecx, 0x40d840
call fcn.0040433c
lea eax, [ebp - 0x6b8]
call fcn.00406dd4
mov eax, dword [ebp - 0x6b8]
mov dl, byte [eax]
lea eax, [ebp - 0x6b4]
call fcn.00404248
lea eax, [ebp - 0x6b4]
mov edx, 0x40d84c
call fcn.004042f8
mov eax, dword [ebp - 0x6b4]
call fcn.004044e8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x40d441
jmp 0x40d41d
mov edx, dword [ebp - 4]
mov eax, 0x40d858
call fcn.004045d0
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.00404588
mov edx, dword [ebp - 4]
mov eax, 0x40d858
call fcn.004045d0
test eax, eax
jg 0x40d401
mov edx, dword [0x40e40c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040433c
lea edx, [ebp - 0x6bc]
xor eax, eax
call fcn.00402870
mov edx, dword [ebp - 0x6bc]
lea eax, [ebp - 0x160]
call fcn.00402bc8
mov eax, dword [0x40e4e0]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00402fe8
call fcn.0040270c
test eax, eax
je 0x40d485
call fcn.00403f90
lea eax, [ebp - 0x160]
call fcn.00402dfc
call fcn.00402658
mov dword [ebp - 8], eax
mov edx, 0x26
lea eax, [ebp - 0x160]
call fcn.00403010
call fcn.00402658
push 0
mov edx, dword [0x40e51c]
mov ecx, 4
lea eax, [ebp - 0x160]
call fcn.00402d2c
call fcn.00402658
xor edx, edx
lea eax, [ebp - 0x160]
call fcn.00403010
call fcn.00402658
mov eax, dword [0x40e51c]
cmp dword [eax], 0
jne 0x40d4f0
mov eax, dword [0x40e51c]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x40d514
cmp eax, 0xa
jae 0x40d520
jmp 0x40d516
jge 0x40d520
mov eax, dword [0x40e51c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
mov edx, dword [0x40e3c8]
mov dword [edx], eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
call fcn.00402564
mov edx, dword [0x40e4e4]
mov dword [edx], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [0x40e51c]
mov ecx, dword [ecx]
mov edx, dword [0x40e4e4]
mov edx, dword [edx]
lea eax, [ebp - 0x160]
call fcn.00402d2c
call fcn.00402658
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
cmp edx, dword [esp + 4]
jne 0x40d57f
cmp eax, dword [esp]
pop edx
pop eax
je 0x40d7ff
xor eax, eax
call fcn.00406da0
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [esp + 4]
jne 0x40d5bb
cmp eax, dword [esp]
pop edx
pop eax
ja 0x40d7ff
jmp 0x40d5c3
pop edx
pop eax
jg 0x40d7ff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2ac]
call fcn.00402bc8
mov edx, 1
lea eax, [ebp - 0x2ac]
call fcn.00403004
call fcn.0040270c
test eax, eax
setne byte [ebp - 0x11]
cmp byte [ebp - 0x11], 0
je 0x40d600
mov eax, dword [0x40e3ac]
cmp byte [eax], 0
jne 0x40d6d6
xor eax, eax
push ebp
push 0x40d6cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00402564
mov edx, dword [0x40e458]
mov dword [edx], eax
push 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov ecx, eax
mov edx, dword [0x40e458]
mov edx, dword [edx]
lea eax, [ebp - 0x160]
call fcn.00402d2c
call fcn.00402658
push 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov ecx, eax
mov edx, dword [0x40e458]
mov edx, dword [edx]
lea eax, [ebp - 0x2ac]
call fcn.00402d4c
call fcn.00402658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d6d6
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [0x40e51c]
mov eax, dword [eax]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov edx, eax
mov eax, dword [0x40e458]
mov eax, dword [eax]
call fcn.00402584
ret
lea eax, [ebp - 0x2ac]
call fcn.00402d6c
lea eax, [ebp - 0x160]
call fcn.00402d6c
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404258
mov edx, dword [ebp - 0x10]
mov eax, 0x40d864
call fcn.004045d0
test eax, eax
jle 0x40d72b
mov edx, dword [ebp - 0x10]
mov eax, 0x40d864
call fcn.004045d0
mov ecx, eax
dec ecx
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.00404588
jmp 0x40d733
lea eax, [ebp - 0x10]
call fcn.00404080
mov dword [0x40f8d4], 0x44
xor eax, eax
mov dword [0x40f8d8], eax
xor eax, eax
mov dword [0x40f8e0], eax
xor eax, eax
mov dword [0x40f900], eax
mov word [0x40f906], 0
xor eax, eax
mov dword [0x40f908], eax
lea eax, [ebp - 0x6ac]
mov ecx, 0x400
mov edx, dword [ebp - 4]
call fcn.00406e94
push 0x40f918
push 0x40f8d4
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.004044e8
push eax
lea eax, [ebp - 0x6ac]
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, dword [0x40e3ac]
mov al, byte [eax]
and al, byte [ebp - 0x11]
je 0x40d7bb
mov eax, dword [0x40e3d4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40d7ff
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x40f918]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x40d7dd
call fcn.00403f90
cmp dword [ebp - 0xc], 0x103
je 0x40d7bb
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2ac]
call fcn.00402bc8
lea eax, [ebp - 0x2ac]
call fcn.00402dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d834
lea eax, [ebp - 0x6bc]
mov edx, 4
call fcn.004040a4
lea eax, [ebp - 0x10]
call fcn.00404080
lea eax, [ebp - 4]
call fcn.00404080
ret