Function at 0x401400
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e71b
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x674], ebx
push 0x12
push 0
push 0
push 0x41f1a0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp dword [ebx + 0x260], 0
mov edi, eax
mov dword [ebp - 0x670], edi
mov dword [ebp - 0x680], 0x12
je 0x4017e7
cmp dword [ebx + 0x264], 0
je 0x4017e7
push str.Finding_all_devices_in_emergency_download_mode..._n
call fcn.0040b79b
add esp, 4
cmp edi, 0xffffffff
je 0x4015fb
mov bl, byte [ebp + 8]
xor esi, esi
nop
lea eax, [ebp - 0x640]
mov dword [ebp - 0x640], 0x1c
push eax
push esi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4014be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x4015ee
push 0
lea eax, [ebp - 0x690]
push eax
push 0x400
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x680]
push eax
push 0x423ffc
lea eax, [ebp - 0x640]
push eax
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
je 0x4015e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4015e8
lea eax, [ebp - 0x624]
push str.QDLoader_9008
push eax
call fcn.0040b84a
add esp, 8
test eax, eax
je 0x4015e8
lea eax, [ebp - 0x624]
push eax
call fcn.0040b79b
add esp, 4
test bl, bl
je 0x4015db
lea eax, [ebp - 0x624]
push 0x42389c
push eax
call fcn.0040b84a
mov edi, eax
add esp, 8
test edi, edi
je 0x4015d5
lea ecx, [ebp - 0x68c]
call fcn.0040a920
lea eax, [edi + 6]
mov dword [ebp - 4], 0
push eax
call fcn.0040b511
add esp, 4
lea ecx, [ebp - 0x68c]
push eax
call fcn.0040a980
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x69c], eax
lea ecx, [ebp - 0x69c]
lea eax, [ebp - 0x66c]
push eax
call fcn.0040a040
test eax, eax
jne 0x4015c3
push dword [ebp - 0x668]
push dword [ebp - 0x66c]
push str.:_SERIAL0x_x_:_HW_ID0x_x
call fcn.0040b79b
add esp, 0xc
lea ecx, [ebp - 0x68c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040a950
mov edi, dword [ebp - 0x670]
push 0x4238dc
call fcn.0040b79b
add esp, 4
inc esi
jmp 0x401490
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ebx, dword [ebp - 0x674]
push 0xd680
push 0
push dword [ebx + 0x264]
call fcn.00411990
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebx + 0x264]
mov dword [ecx + eax + 0x10], 0xffffffff
add ecx, 0x840
cmp ecx, 0xd680
jl 0x401612
push 0x4238e0
call fcn.0040b79b
add esp, 4
lea eax, [ebp - 0x224]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov edi, eax
xor esi, esi
cmp esi, 0xd680
jge 0x4016a8
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebx + 0x264]
add eax, 0x428
add eax, esi
push 0x104
push eax
call fcn.0040bcd0
mov eax, dword [ebx + 0x264]
add esp, 0xc
add eax, esi
mov ecx, ebx
push eax
call fcn.00401130
push 0x104
lea eax, [ebp - 0x224]
add esi, 0x840
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x401651
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x670], edx
mov dword [ebp - 0x674], ecx
nop
mov eax, dword [ebx + 0x260]
mov dword [edx + eax + 0xc], ecx
mov ecx, ebx
mov eax, dword [ebx + 0x260]
add eax, edx
push eax
call fcn.004012e0
test eax, eax
jne 0x4017a8
mov edx, dword [ebp - 0x678]
xor edi, edi
xor esi, esi
nop dword [eax]
mov ecx, dword [ebx + 0x264]
cmp dword [eax + ecx + 0x10], edx
jne 0x401715
mov edx, dword [ebp - 0x674]
mov ecx, dword [ebx + 0x260]
add edx, edi
inc edi
mov dword [ecx + edx*4 + 0x10], esi
mov edx, dword [ebp - 0x678]
add eax, 0x840
inc esi
cmp eax, 0xd680
jl 0x4016f0
mov ecx, dword [ebp - 0x674]
mov eax, dword [ebx + 0x260]
add ecx, edi
mov edx, dword [ebp - 0x670]
mov dword [eax + ecx*4 + 0x10], 0
mov esi, dword [ebx + 0x260]
add esi, edx
mov dword [ebp - 0x67c], esi
cmp dword [esi + 0xc], 0xffffffff
je 0x4017ae
imul edx, dword [esi + 0x10], 0x840
mov eax, dword [esi + 8]
mov edi, dword [esi]
mov esi, dword [esi + 4]
add edx, dword [ebx + 0x264]
lea ecx, [edx + 0x632]
push ecx
lea ecx, [edx + 0x21e]
push ecx
push eax
cdq
push edx
push eax
push esi
push edi
call fcn.0041d7c0
push edx
push eax
mov eax, dword [ebp - 0x67c]
shrd edi, esi, 0x14
add eax, 0x7c
shr esi, 0x14
push esi
push edi
push eax
push dword [ebp - 0x678]
push str._i.__s__Size:__I64dMB____I64d_sectors___size:__i_Mount:_s__Name:__s__n
call fcn.0040b79b
add esp, 0x28
mov edx, dword [ebp - 0x670]
mov eax, dword [ebp - 0x674]
add edx, 0x288
mov ecx, dword [ebp - 0x678]
add eax, 0xa2
inc ecx
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x670], edx
cmp eax, 0x1074
jl 0x4016c0
xor eax, eax
jmp 0x4017ec
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040b500
mov esp, ebp
pop ebp
ret 4