Function at 0x40e38f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x10], 0
push ebx
push 0x3000
push 0
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x40e6a3
push esi
push edi
lea esi, [ebx + 0x1c]
mov edi, esi
add esi, 0x1000
mov dword [ebp - 4], esi
add esi, 0x400
push 0x5c
push dword [ebp - 0x18]
lea eax, [esi + 0x400]
mov dword [ebp - 0x1c], eax
call fcn.004cdb0e
pop ecx
pop ecx
test eax, eax
je 0x40e691
inc eax
push eax
push dword [ebp - 4]
call fcn.004c99d0
push 0x23
push dword [ebp - 4]
call fcn.004cdb0e
add esp, 0x10
test eax, eax
je 0x40e691
push dword [ebp - 4]
mov byte [eax], 0
call fcn.004cd9ab
push dword [ebp - 4]
push esi
call fcn.004c99d0
add esp, 0xc
xor edx, edx
mov eax, edx
mov dword [ebp - 8], eax
mov cl, byte [esi]
jmp 0x40e443
cmp cl, 0x5c
je 0x40e449
cmp cl, 0x23
je 0x40e449
inc eax
mov dword [ebp - 8], eax
mov cl, byte [eax + esi]
test cl, cl
jne 0x40e432
jmp 0x40e44c
mov byte [eax + esi], dl
push 6
push edx
push esi
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40e691
mov esi, dword [ebp + 8]
xor edx, edx
push ebx
push edx
mov dword [ebp - 0x14], edx
mov dword [esi + 0x114], edx
push eax
jmp 0x40e4b3
lea eax, [ebp - 8]
push eax
push 0x1000
push edi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
je 0x40e688
push edi
call fcn.004cd9ab
pop ecx
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.0040e1b6
test eax, eax
jne 0x40e4c8
mov eax, dword [ebp - 0x14]
inc eax
push ebx
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebx], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x40e476
jmp 0x40e688
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [esi + 0x114]
push eax
lea eax, [ebp - 0x28]
push eax
push 0xf
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
push str.____
push dword [ebp - 4]
call fcn.004cdbbc
pop ecx
pop ecx
test eax, eax
je 0x40e51a
add eax, 4
push eax
push edi
call fcn.004c99d0
push 0x23
push edi
call fcn.004cdb0e
add esp, 0x10
test eax, eax
je 0x40e688
mov byte [eax], 0
jmp 0x40e584
push str.USBSTOR
push 0x52ff70
call fcn.0049f330
pop ecx
pop ecx
test eax, eax
je 0x40e555
push 0x52ff74
push edi
call fcn.004c99d0
push 0x23
push edi
call fcn.004cdb0e
add esp, 0x10
test eax, eax
je 0x40e54c
mov byte [eax], 0
push edi
call fcn.004cd9ab
pop ecx
jmp 0x40e584
push 0
push dword [ebx + 0x14]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x40e688
push eax
push 0x1000
push edi
push dword [ebp - 0x20]
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x40e688
push esi
mov ecx, edi
call fcn.0040e214
pop ecx
test eax, eax
je 0x40e688
push 0x5069c8
push dword [ebp - 0x18]
push 0x507908
push edi
call fcn.00402a6e
add esp, 0x10
push 0x400
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x40e688
lea eax, [ebp - 8]
mov ecx, 0x1000
push eax
push ecx
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
call dword [0x51e8b4]
test eax, eax
je 0x40e688
and dword [esi + 0x10c], 0
mov cl, byte [edi]
mov dword [ebp - 0x10], 1
test cl, cl
je 0x40e688
mov ebx, dword [ebp - 0x10]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x40e671
movsx ecx, cl
mov eax, ebx
sub ecx, 0x41
shl eax, cl
push edi
mov dword [esi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
sub eax, 1
je 0x40e66e
sub eax, 1
jne 0x40e671
test byte [esi + 0x114], 0x84
je 0x40e671
push str.USBSTOR
push 0x52ff70
call fcn.0049f330
pop ecx
pop ecx
test eax, eax
je 0x40e671
lea eax, [esi + 8]
cmp byte [eax], 0
jne 0x40e65f
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
or dword [esi + 4], 0x80000001
mov dword [esi], 2
jmp 0x40e671
or dword [esi + 4], ebx
push edi
call fcn.004c8d20
inc edi
add edi, eax
pop ecx
mov cl, byte [edi]
test cl, cl
jne 0x40e5fc
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret