Function at 0x4031cc
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3e8]
mov esi, 0x489080
push ebx
lea ebx, [ebp - 0x5a0]
push ecx
sub esp, 0x638
mov eax, dword [ecx]
mov ecx, 0x11
mov dword [ebp - 0x4d0], str.USBSTOR
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x4cc], str.RTSUER
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x4c8], str.CMIUCR
mov dword [ebp - 0x4c4], str.EUCR
mov dword [ebp - 0x4c0], str.UASPSTOR
mov dword [ebp - 0x4bc], str.VUSBSTOR
mov dword [ebp - 0x4b8], str.ETRONSTOR
mov eax, ecx
mov ecx, 8
mov dword [ebp - 0x4b4], str.ASUSSTPT
mov dword [ebp - 0x4b0], str._SD_
mov dword [ebp - 0x4ac], str._SDHC_
mov dword [ebp - 0x4a8], str._SDXC_
mov dword [ebp - 0x4a4], str._MMC_
mov dword [ebp - 0x4a0], str._MS_
mov dword [ebp - 0x49c], str._MSPro_
mov dword [ebp - 0x498], str._xDPicture_
mov dword [ebp - 0x494], str._O2Media_
mov dword [ebp - 0x574], 0x492710
mov dword [ebp - 0x570], str.USB_1.0
mov dword [ebp - 0x56c], str.USB_1.1
mov dword [ebp - 0x568], str.USB_2.0
mov dword [ebp - 0x564], str.USB_3.0
movups xmm0, xmmword [str._:EFIRufus_ntfus_ntfs_x64.efi]
mov dword [ebp - 0x5ac], edi
movups xmm1, xmmword [0x493220]
mov dword [ebp - 0x5a8], edi
mov dword [ebp - 0x5a4], edi
lea edi, [ebp - 0x490]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x470]
mov ecx, 8
movups xmmword [ebp - 0x55a], xmm0
rep stosd dword es:[edi], eax
xor eax, eax
movups xmmword [ebp - 0x550], xmm1
mov dword [ebp - 0x560], str.USB_3.1
mov dword [ebp - 0x5b2], 0x3a3f2820
mov word [ebp - 0x5ae], 0x29
mov dword [ebp - 0x5b6], 0x5c3a3f
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x14b
mov eax, dword [0x52417c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
call fcn.00403159
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call fcn.0043c01b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x49264e
mov dword [esp], ebx
call fcn.0043c061
mov dword [esp], 0x104
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x5dc], eax
test eax, eax
je 0x4054d8
xor esi, esi
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp], 0x4931f8
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
sub esp, 0x10
mov edi, eax
cmp eax, 0xffffffff
je 0x4036be
lea eax, [ebp - 0x5ac]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call fcn.0043b087
test eax, eax
jne 0x403408
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
push ebx
jmp 0x4036be
mov dword [ebp - 0x508], 0x1c
xor ecx, ecx
mov dword [ebp - 0x5e4], ecx
lea eax, [ebp - 0x508]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
test eax, eax
je 0x4033f9
inc dword [ebp - 0x5e4]
cmp dword [0x524104], 0
je 0x403463
mov eax, dword [ebp - 0x5e4]
mov dword [esp], str.Processing_Hub__d:
mov dword [esp + 4], eax
call fcn.0043d9e0
xor edx, edx
lea eax, [ebp - 0x508]
lea ebx, [ebp - 0x4ec]
mov dword [ebp - 0x4ec], 0x1c
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x4931f8
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
sub esp, 0x14
test eax, eax
je 0x40341a
xor eax, eax
mov dword [esp + 4], ebx
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], edi
call esi
sub esp, 0x18
test eax, eax
jne 0x40341a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x40341a
mov edx, dword [ebp - 0x5cc]
mov dword [esp + 4], edx
mov dword [ebp - 0x5e8], edx
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x5e0], eax
test eax, eax
je 0x40341a
mov dword [eax], 5
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x5e8]
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], edi
call esi
sub esp, 0x18
test eax, eax
jne 0x40355d
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40341a
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
sub esp, 0xc
test eax, eax
jne 0x40354a
mov eax, dword [ebp - 0x5dc]
mov byte [eax], 0
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 8], 1
lea esi, [eax + 4]
lea eax, [ebp - 0x5a0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0043c061
cmp dword [0x524104], 0
mov ebx, eax
je 0x4035ce
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.__Hub__d____s
call fcn.0043d9e0
test ebx, ebx
js 0x40354a
xor eax, eax
mov dword [esp + 8], 0x104
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5dc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x40354a
mov eax, dword [ebp - 0x5dc]
call fcn.00402529
lea eax, [ebp - 0x5ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5dc]
mov dword [esp], eax
call fcn.0043b17c
test eax, eax
je 0x40363b
imul edx, eax, 0xc
add edx, dword [ebp - 0x5ac]
mov dword [edx + 8], ebx
cmp dword [0x524104], 0
je 0x40365e
mov ecx, dword [ebp - 0x5dc]
mov dword [esp + 4], eax
mov dword [esp], str.__Found_ID__03d_:__s
mov dword [esp + 8], ecx
call fcn.0043d9e0
xor ecx, ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
sub esp, 0xc
test eax, eax
jne 0x40354a
mov eax, dword [ebp - 0x5dc]
xor esi, esi
mov byte [eax], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x40365e
jmp 0x403608
mov eax, dword [ebp - 0x5dc]
lea esi, [ebp - 0x490]
xor ebx, ebx
mov dword [esp], eax
call sub.msvcrt.dll_free
xor edx, edx
mov dword [ebp - 0x5ec], 8
mov dword [ebp - 0x5dc], edx
mov edi, dword [ebp + ebx*4 - 0x4d0]
mov dword [esp + 4], str.UASPSTOR
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [ebp - 0x5ec]
cmove eax, ebx
mov dword [ebp - 0x5ec], eax
mov dword [esp + 8], 0x102
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeA]
sub esp, 0xc
test eax, eax
je 0x40372e
xor eax, eax
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x403744
mov ecx, dword [ebp - 0x5dc]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x5dc], eax
inc ebx
add esi, 4
cmp ebx, 8
jne 0x4036e6
mov dword [ebp - 0x600], 0x11
xor ebx, ebx
mov dword [esp + 4], 0x492775
mov eax, dword [ebp + ebx*4 - 0x3e8]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [ebp - 0x600]
cmove eax, ebx
inc ebx
mov dword [ebp - 0x600], eax
cmp ebx, 0x11
jne 0x403759
xor esi, esi
lea edx, [ebp - 0x430]
inc esi
mov dword [esp + 0xc], str.IgnoreUsb_02d
mov dword [esp], edx
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x20
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, dword [0x522ecc]
mov byte [ebp - 0x411], 0
lea edx, [ebp - 0x430]
test eax, eax
je 0x40380c
mov dword [esp + 8], 1
xor ebx, ebx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00426ea9
mov edi, eax
test eax, eax
je 0x4039c4
xor eax, eax
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call sub.msvcrt.dll_strtol
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_free
jmp 0x4039c4
lea edi, [ebp - 0x11c]
mov ecx, 0x41
mov dword [ebp - 0x324], 0xffffffff
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [esp], edx
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x430]
mov ebx, eax
test ebx, ebx
je 0x4038c2
cmp byte [edx + ebx], 0x5c
je 0x403860
dec ebx
jmp 0x403853
inc eax
lea edi, [ebp - 0x11c]
mov ecx, edx
mov edx, 0x104
mov dword [esp], eax
mov eax, edi
call fcn.004024ec
lea eax, [ebp - 0x410]
mov byte [ebp + ebx - 0x11c], 0
inc ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x403955
xor ecx, ecx
mov dword [ebp - 0x410], ecx
jmp 0x403996
lea eax, [ebp - 0x524]
xor edx, edx
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0x492786
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x403903
xor eax, eax
mov dword [ebp - 0x524], eax
jmp 0x403996
lea eax, [ebp - 0x3a4]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x410]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x49278f
mov eax, dword [ebp - 0x524]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x4038b5
lea eax, [ebp - 0x220]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x540]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x324]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp + ebx - 0x430]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x410]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x4039aa
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x4039be
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov ebx, dword [ebp - 0x540]
mov dword [ebp + esi*4 - 0x454], ebx
cmp esi, 8
jne 0x403789
mov eax, dword [ebp - 0x5ec]
dec eax
cmp eax, 6
jbe 0x4039f9
mov dword [esp + 8], 0x24b
mov dword [esp + 4], str.dev.c
mov dword [esp], str._uasp_start___0____uasp_start___ARRAYSIZE_usbstor_name__
jmp 0x403a1c
mov eax, dword [ebp - 0x600]
dec eax
cmp eax, 0xf
jbe 0x403a22
mov dword [esp + 8], 0x24c
mov dword [esp + 4], str.dev.c
mov dword [esp], str._card_start___0____card_start___ARRAYSIZE_genstor_name__
call dword [0x491228]
cmp dword [ebp - 0x5dc], 0
je 0x403b2c
mov eax, dword [ebp - 0x5dc]
xor edi, edi
xor ebx, ebx
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x5dc], eax
test eax, eax
jne 0x403a9d
mov dword [esp], str.Could_not_allocate_Device_ID_list
call fcn.0043d9e0
jmp 0x4054da
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ebp + edi*4 - 0x4d0]
mov dword [esp + 0xc], 0x102
mov dword [esp + 8], eax
lea esi, [ecx + ebx]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [ebp - 0x5e0], edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListA]
sub esp, 0x10
test eax, eax
je 0x403ab2
inc edi
cmp edi, 8
je 0x403b34
mov eax, dword [ebp + edi*4 - 0x490]
mov dword [ebp + edi*4 - 0x470], ebx
cmp eax, 1
jbe 0x403a93
jmp 0x403a5d
cmp dword [0x524104], 0
mov edx, dword [ebp - 0x5e0]
jne 0x403aca
add ebx, dword [ebp + edi*4 - 0x490]
jmp 0x403b0f
mov dword [esp + 4], edx
mov dword [esp], str.Processing_IDs_belonging_to__s:
call fcn.0043d9e0
cmp byte [esi], 0
je 0x403ac1
mov dword [esp + 4], esi
mov dword [esp], str.___s
call fcn.0043d9e0
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea esi, [esi + eax + 1]
jmp 0x403ada
mov ecx, dword [ebp - 0x5dc]
lea eax, [ebx - 1]
cmp byte [ecx + ebx - 2], 0
jne 0x403b19
mov ebx, eax
cmp ebx, 2
ja 0x403afd
jmp 0x403a93
cmp byte [ecx + ebx - 1], 0
jne 0x403b0d
cmp byte [ecx + eax + 1], 0
jne 0x403b0d
jmp 0x403a93
xor esi, esi
mov dword [ebp - 0x5dc], esi
xor ebx, ebx
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], 0x4c24bc
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x5e0], eax
sub esp, 0x10
inc eax
jne 0x403b79
call fcn.0043df77
mov dword [esp], str.SetupDiGetClassDevs__Interface__failed:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x4054d8
mov dword [ebp - 0x508], 0x1c
xor ecx, ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x604], ecx
lea ebx, [ebp - 0x508]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x604]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
test eax, eax
je 0x405215
lea edx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, edx
lea esi, [ebp - 0x524]
rep stosd dword es:[edi], eax
mov ecx, 7
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x16
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
jne 0x403c3e
call fcn.0043df77
mov dword [esp], str.SetupDiGetDeviceRegistryProperty__Enumerator_Name__failed:__s
mov dword [esp + 4], eax
jmp 0x404a0d
inc ebx
cmp ebx, 8
je 0x403c75
lea eax, [ebp - 0x324]
mov dword [esp + 4], str.USBSTOR
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x403c38
mov byte [ebp - 0x510], 1
test ebx, ebx
je 0x403c75
mov eax, dword [ebp - 0x5ec]
cmp ebx, eax
jae 0x403c75
mov byte [ebp - 0x50e], 1
xor ebx, ebx
mov eax, dword [ebp + ebx*4 - 0x3e8]
test eax, eax
jne 0x403c87
mov eax, 0x4923d7
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x403cb8
mov eax, dword [ebp - 0x600]
mov byte [ebp - 0x50f], 1
cmp ebx, eax
jb 0x403cbe
mov byte [ebp - 0x50e], 1
jmp 0x403cbe
inc ebx
cmp ebx, 0x11
jne 0x403c77
cmp dword [0x524104], 0
je 0x403cdd
lea eax, [ebp - 0x324]
mov dword [esp], str.Processing__s_device:
mov dword [esp + 4], eax
call fcn.0043d9e0
cmp word [ebp - 0x510], 0
jne 0x403d07
cmp dword [0x524104], 0
je 0x403cfc
mov dword [esp], str.__Unsupported_or_disabled_by_policy
call fcn.0043d9e0
inc dword [ebp - 0x604]
jmp 0x403b91
lea ebx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0x104
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
je 0x403dc2
cmp dword [0x52410c], 1
mov dword [ebp - 0x410], str.Arsenal_________Virtual_
mov dword [ebp - 0x40c], str.KernSafeVirtual_________
sbb edi, edi
xor esi, esi
mov dword [ebp - 0x408], str.Msft____Virtual_Disk____
add edi, 4
mov dword [ebp - 0x404], str.VMware__VMware_Virtual_S
mov eax, dword [ebp + esi*4 - 0x410]
test eax, eax
jne 0x403da6
mov eax, 0x4923d7
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x403dbd
inc esi
cmp esi, edi
jne 0x403d96
jmp 0x403dc2
mov eax, 1
cmp byte [ebp - 0x50e], 0
mov byte [ebp - 0x50c], al
jne 0x403e98
lea eax, [ebp - 0x324]
mov dword [esp + 8], 3
mov dword [esp + 4], str.SCSIDisk
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x403e98
xor ebx, ebx
mov edi, dword [ebp + ebx*4 - 0x4b0]
mov eax, 1
test edi, edi
je 0x403e17
mov dword [esp], edi
call sub.msvcrt.dll_strlen
inc eax
mov dword [esp], eax
lea esi, [ebp - 0x594]
mov ecx, edi
mov edx, 0x10
mov eax, esi
lea edi, [ebp - 0x324]
call fcn.004024ec
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x403e4d
mov byte [ebp - 0x50e], 1
jmp 0x403e98
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp eax, 1
ja 0x403e76
mov dword [esp + 8], 0x2a3
mov dword [esp + 4], str.dev.c
mov dword [esp], str.strlen_scsi_card_name_copy____1
jmp 0x403a1c
mov byte [ebp + eax - 0x595], 0x26
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x403e44
inc ebx
cmp ebx, 8
jne 0x403dfe
cmp dword [0x524104], 0
je 0x403eb7
lea eax, [ebp - 0x324]
mov dword [esp], str.__Hardware_ID:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
lea eax, [ebp - 0x5cc]
lea ebx, [ebp - 0x11c]
mov dword [esp + 0xc], 0x104
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x508]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
sub esp, 0x14
test eax, eax
jne 0x403f18
call fcn.0043df77
mov dword [esp], str.SetupDiGetDeviceInstanceId_failed:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp + 4], str._N_A_
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
lea edx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0x104
mov dword [esp + 8], 0x1f
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
je 0x403f83
mov eax, dword [ebp - 0x324]
sub eax, 2
cmp eax, 1
setbe al
movzx eax, al
lea edx, [ebp - 0x324]
mov byte [ebp - 0x50b], al
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp], edx
lea ecx, [ebp - 0x5c8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
lea edx, [ebp - 0x508]
call fcn.0040266e
test eax, eax
jne 0x404026
call fcn.0043df77
mov dword [esp], str.SetupDiGetDeviceRegistryProperty__Friendly_Name__failed:__s
mov ebx, 1
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp], 0xbe5
call fcn.00422df0
test eax, eax
je 0x404003
mov dword [esp], 0xbe5
call fcn.00422df0
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [eax + 1]
mov dword [esp], 0xbe5
call fcn.00422df0
mov dword [esp], ebx
mov edx, 0x104
mov ecx, eax
lea eax, [ebp - 0x324]
call fcn.004024ec
jmp 0x40403c
cmp byte [ebp - 0x50c], 0
jne 0x40403c
cmp dword [ebp - 0x5dc], 0
jne 0x404172
xor edx, edx
mov dword [ebp - 0x5f4], edx
jmp 0x404163
mov edx, dword [ebp - 0x5f0]
cmp edx, 2
je 0x40407f
mov al, byte [esi + ebx]
inc ebx
cmp al, 0x5c
je 0x404333
cmp dword [ebp - 0x5e8], 0
jne 0x4042e9
mov dword [ebp - 0x5f0], edx
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp ebx, eax
jb 0x404049
cmp dword [ebp - 0x524], 0
mov edx, str._ID_
mov eax, 0x49264e
cmovne eax, edx
mov dword [ebp - 0x5f0], eax
imul eax, edi, 0xc
add eax, dword [ebp - 0x5ac]
cmp dword [eax + 8], 0
je 0x40434c
imul eax, edi, 0xc
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [ebp - 0x5f4]
mov eax, dword [eax + ecx + 8]
test eax, eax
je 0x4046bd
cmp dword [0x524104], 0
je 0x4040f3
mov edx, dword [ebp - 0x5a0]
mov edx, dword [edx + eax*4]
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with_Hub__d_:__s
mov dword [esp + 8], edx
call fcn.0043d9e0
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [ebp - 0x5f4]
mov edx, dword [eax + ecx + 8]
mov eax, dword [ebp - 0x5a0]
mov edi, dword [eax + edx*4]
test edi, edi
jne 0x4043f5
mov dword [ebp - 0x5e8], 0xffffffff
xor ebx, ebx
mov eax, dword [ebp - 0x5e8]
dec eax
cmp eax, 0xfffffffd
ja 0x40413c
mov eax, dword [ebp - 0x5e8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
test ebx, ebx
je 0x4046bd
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [ebp - 0x5f4]
mov edx, dword [eax + ecx + 8]
mov eax, dword [ebp - 0x5a0]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], 0x49264e
jmp 0x4046c5
mov esi, dword [ebp - 0x5dc]
cmp byte [esi], 0
je 0x40403c
xor eax, eax
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x5d8]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
sub esp, 0xc
test eax, eax
je 0x4041bb
cmp dword [0x524104], 0
je 0x4046ac
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_locate_device_node_for__s
jmp 0x4041fb
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x404205
cmp dword [0x524104], 0
je 0x4046ac
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_children_of__s
call fcn.0043d9e0
jmp 0x4046ac
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
jne 0x40427e
mov ecx, dword [ebp - 0x5ec]
lea edx, [esi + 2]
mov eax, dword [ebp - 0x5dc]
add eax, dword [ebp + ecx*4 - 0x470]
cmp edx, eax
mov eax, esi
setae byte [ebp - 0x50d]
call fcn.00402529
lea eax, [ebp - 0x5ac]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0043b17c
cmp dword [0x524104], 0
mov edi, eax
je 0x4042da
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with_ID__03d_:__s
call fcn.0043d9e0
jmp 0x4042da
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
je 0x4042a6
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
sub esp, 0xc
test eax, eax
je 0x404270
jmp 0x4042c3
cmp dword [0x524104], 0
je 0x404213
mov dword [esp + 4], esi
mov dword [esp], str.NOTE:_Matched_instance_from_sibling_for__s
call fcn.0043d9e0
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
jne 0x4046ac
jmp 0x404213
xor eax, eax
xor edx, edx
mov dword [ebp - 0x5e8], eax
jmp 0x40406d
cmp al, 0x5f
jne 0x40406d
xor eax, eax
mov dword [ebp - 0x5f0], edx
mov dword [esp + 4], eax
lea eax, [esi + ebx]
mov dword [esp + 8], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x5f0]
movzx eax, ax
mov dword [ebp - 0x520], eax
test edx, edx
jne 0x404342
mov dword [ebp - 0x524], eax
mov edx, 1
jmp 0x40406d
mov dword [ebp - 0x5e8], 1
jmp 0x40406d
mov edx, 2
jmp 0x40406d
xor ebx, ebx
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
sub esp, 0xc
test eax, eax
jne 0x4040ac
xor ecx, ecx
lea ebx, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 0xc], ecx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x5d4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x4040ac
mov eax, ebx
call fcn.00402529
lea eax, [ebp - 0x5ac]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0043b17c
cmp dword [0x524104], 0
mov edi, eax
je 0x4043e0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with__GP__ID__03d_:__s
call fcn.0043d9e0
mov dword [ebp - 0x5f0], str._GP_
lea esi, [ebp - 0x220]
jmp 0x4040ac
xor edx, edx
lea eax, [ebp - 0x5bc]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
sub esp, 0xc
test eax, eax
je 0x40442e
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_device_instance_handle_for__s:_CR_error__d
call fcn.0043d9e0
jmp 0x404114
xor eax, eax
lea ebx, [ebp - 0x5c0]
mov dword [ebp - 0x5c0], 4
mov dword [ebp - 0x514], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x514]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1d
mov eax, dword [ebp - 0x5bc]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyA]
sub esp, 0x18
test eax, eax
je 0x40448f
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_port_for__s:_CR_error__d
jmp 0x404424
xor eax, eax
mov dword [esp + 0x14], 0x40000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x5e8], eax
sub esp, 0x1c
inc eax
jne 0x4044e9
call fcn.0043df77
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_open_hub__s:__s
jmp 0x404424
xor eax, eax
mov ecx, 0x1f
lea edi, [ebp - 0x40c]
mov dword [ebp - 0x5c0], 0x23
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x514]
lea edx, [ebp - 0x410]
xor ecx, ecx
mov dword [ebp - 0x410], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], 0x23
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x23
mov dword [esp + 8], edx
mov dword [esp + 4], 0x220448
mov eax, dword [ebp - 0x5e8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x40456f
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_node_connection_information_for__s:__s
jmp 0x40464c
mov edx, dword [ebp - 0x404]
mov ax, word [ebp - 0x402]
xor ebx, ebx
mov ecx, edx
or cx, ax
je 0x4045aa
movzx eax, ax
movzx edx, dx
mov ebx, 1
mov dword [ebp - 0x520], eax
movzx eax, byte [ebp - 0x3f9]
mov dword [ebp - 0x524], edx
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [0x524a20], 0x61
jbe 0x404120
mov edx, dword [ebp - 0x514]
xor edi, edi
mov dword [ebp - 0x5c0], 0x10
lea eax, [ebp - 0x584]
mov dword [ebp - 0x57c], edi
mov dword [ebp - 0x584], edx
xor edx, edx
mov dword [ebp - 0x578], edi
mov dword [ebp - 0x580], 0x10
mov byte [ebp - 0x57c], 4
mov dword [esp + 0x1c], edx
lea edx, [ebp - 0x5c0]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], 0x22045c
mov eax, dword [ebp - 0x5e8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
jne 0x404656
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_node_connection_information__V2__for_device__s:__s
call fcn.0043d9e0
jmp 0x404120
mov al, byte [ebp - 0x578]
test al, 4
je 0x40466f
mov dword [ebp - 0x51c], 5
jmp 0x404120
test al, 1
je 0x404682
mov dword [ebp - 0x51c], 4
jmp 0x404120
test al, 8
je 0x404695
mov dword [ebp - 0x518], 2
jmp 0x404120
test al, 2
je 0x404120
mov dword [ebp - 0x518], 1
jmp 0x404120
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea esi, [esi + eax + 1]
jmp 0x404178
xor ebx, ebx
mov dword [ebp - 0x5f4], ebx
cmp byte [ebp - 0x50d], 0
je 0x40473b
movups xmm2, xmmword [str.SCSI_Disk_DeviceRufus_7]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x580], 0x69766544
mov byte [ebp - 0x400], 0
mov dword [ebp - 0x584], 0x20534155
mov dword [ebp - 0x57d], 0x656369
movups xmmword [ebp - 0x410], xmm2
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x40473b
cmp byte [eax + 0x11], 0
jne 0x40473b
mov ecx, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x580]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 7], 0x656369
cmp byte [ebp - 0x50c], 0
je 0x40475a
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_VHD_device__s
mov dword [esp + 4], eax
jmp 0x404993
cmp byte [ebp - 0x50e], 0
je 0x404790
cmp byte [ebp - 0x510], 0
je 0x40477a
mov eax, dword [ebp - 0x524]
or eax, dword [ebp - 0x520]
jne 0x404790
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_card_reader_device__s
mov dword [esp + 4], eax
jmp 0x404993
test dword [ebp - 0x510], 0xff0000ff
jne 0x4047e9
cmp byte [ebp - 0x50b], 0
je 0x4047e9
cmp dword [0x5240ec], 0
lea eax, [ebp - 0x324]
mov dword [esp + 4], eax
jne 0x4047dd
mov dword [esp], str.Found_non_USB_removable_device__s___Eliminated
call fcn.0043d9e0
cmp dword [0x524104], 0
je 0x403cfc
mov dword [esp], str.If_you_REALLY_need__you_can_enable_listing_of_this_device_with__Ctrl__Alt__F_
jmp 0x403cf7
mov dword [esp], str.Found_non_USB_removable_device__s
jmp 0x404993
mov eax, dword [ebp - 0x524]
mov edx, dword [ebp - 0x520]
mov edi, eax
or edi, edx
jne 0x404848
cmp byte [ebp - 0x510], 0
jne 0x404827
cmp dword [0x524104], 0
je 0x403cfc
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_non_USB_non_removable_device__s___Eliminated
mov dword [esp + 4], eax
jmp 0x404a0d
mov ecx, str.____:____
mov dword [esp], 0xa
mov edx, 0x104
lea eax, [ebp - 0x220]
call fcn.004024ec
jmp 0x40490b
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str._04X:_04X
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf_s]
cmp dword [0x52412c], 0
mov byte [ebp - 0x11d], 0
mov edx, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x520]
je 0x4048c7
cmp edx, 0x525
jne 0x4048a3
cmp ecx, 0x622b
jmp 0x4048c1
cmp edx, 0x781
jne 0x4048b3
cmp ecx, 0x75a0
jmp 0x4048c1
cmp edx, 0x10d6
jne 0x4048c7
cmp ecx, 0x1101
je 0x403cfc
xor eax, eax
mov ebx, dword [ebp + eax*4 - 0x450]
mov esi, ebx
shr esi, 0x10
cmp edx, esi
jne 0x404905
movzx ebx, bx
cmp ecx, ebx
jne 0x404905
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring__s___s___per_user_settings
mov dword [esp + 8], eax
lea eax, [ebp - 0x324]
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x403cfc
inc eax
cmp eax, 8
jne 0x4048c9
cmp dword [ebp - 0x51c], 5
jbe 0x40491c
xor ecx, ecx
mov dword [ebp - 0x51c], ecx
mov ecx, dword [ebp - 0x51c]
mov eax, 0x49264e
mov edx, 0x492659
cmp byte [ebp - 0x50d], 0
cmove edx, eax
mov ebx, dword [ebp + ecx*4 - 0x574]
mov ecx, str.UAS__
cmovne eax, ecx
mov ecx, dword [ebp - 0x5f0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 0x18], ecx
lea ecx, [ebp - 0x220]
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x324]
mov dword [esp + 4], eax
mov dword [esp + 0x10], ecx
mov dword [esp], str.Found__s_s_s_device__s___s___s
call fcn.0043d9e0
mov eax, dword [ebp - 0x518]
test eax, eax
je 0x404998
add eax, 0x2f
mov dword [esp], str.NOTE:_This_device_is_a_USB_3._c_device_operating_at_lower_speed...
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [ebp - 0x4ec], 0x1c
xor edx, edx
xor edi, edi
mov dword [ebp - 0x608], edx
mov dword [esp], edi
lea ebx, [ebp - 0x4ec]
call sub.msvcrt.dll_free
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x608]
mov dword [esp + 8], 0x4c24bc
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
sub esp, 0x14
test eax, eax
jne 0x404a23
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x103
je 0x404a17
call fcn.0043df77
mov dword [esp], str.SetupDiEnumDeviceInterfaces_failed:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x403cfc
mov dword [esp], str.A_device_was_eliminated_because_it_didnt_report_itself_as_a_disk
jmp 0x403cf7
xor eax, eax
mov dword [esp + 4], ebx
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call esi
mov dword [ebp - 0x5e8], eax
sub esp, 0x18
test eax, eax
jne 0x404b09
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x404aed
mov edx, dword [ebp - 0x5cc]
mov dword [esp + 4], edx
mov dword [ebp - 0x5f0], edx
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov edx, dword [ebp - 0x5f0]
test eax, eax
mov edi, eax
jne 0x404a9f
mov dword [esp], str.Unable_to_allocate_data_for_SP_DEVICE_INTERFACE_DETAIL_DATA
jmp 0x404b10
mov dword [eax], 5
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x404b17
call fcn.0043df77
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__actual__failed:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x40520a
call fcn.0043df77
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__dummy__failed:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
xor edi, edi
jmp 0x40520a
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__dummy____no_data_was_allocated
call fcn.0043d9e0
jmp 0x404b02
xor eax, eax
lea ebx, [edi + 4]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x404b77
call fcn.0043df77
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0x492df2
call fcn.0043d9e0
jmp 0x40520a
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00409a0c
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
test ebx, ebx
js 0x40520a
lea eax, [ebx + 0x80]
mov dword [ebp - 0x5f0], eax
mov dword [esp], eax
call fcn.0040a763
test eax, eax
jne 0x404bbb
mov dword [esp], str.Device_eliminated_because_it_appears_to_contain_no_media
jmp 0x404dfd
mov eax, dword [ebp - 0x5f0]
mov dword [esp], eax
call fcn.0040a6ba
mov dword [ebp - 0x5f8], eax
mov ecx, dword [ebp - 0x5f8]
mov eax, 0x7fffff
mov dword [ebp - 0x5fc], edx
cmp eax, ecx
mov eax, dword [ebp - 0x5e8]
mov dword [esp + 0xc], 0
sbb eax, edx
jb 0x404c21
xor ecx, ecx
xor ebx, ebx
mov dword [esp], 0x800000
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
call fcn.0043e475
mov dword [esp], str.Device_eliminated_because_it_is_smaller_than__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x405060
lea eax, [ebp - 0x5c4]
mov dword [esp + 8], eax
lea eax, [ebp - 0x540]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5f0]
mov dword [esp], eax
call fcn.0040a303
test eax, eax
je 0x40520a
cmp byte [ebp - 0x50f], 0
mov al, byte [ebp - 0x50c]
je 0x404cb3
or al, byte [ebp - 0x50d]
jne 0x404cb3
cmp byte [ebp - 0x50b], 0
je 0x405060
cmp dword [0x5240ec], 0
jne 0x404cb3
lea esi, [ebp - 0x540]
mov al, byte [esi]
test al, al
je 0x404c9f
mov byte [ebp - 0x5b6], al
lea eax, [ebp - 0x5b6]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
push edx
cmp eax, 2
je 0x404cb0
cmp byte [esi], 0
je 0x404cb3
mov dword [esp], str.Device_eliminated_because_it_contains_a_mounted_partition_that_is_set_as_non_removable
jmp 0x404dfd
inc esi
jmp 0x404c7e
cmp dword [0x524128], 0
mov al, byte [ebp - 0x50c]
jne 0x404d99
or al, byte [ebp - 0x50e]
je 0x404d2c
cmp byte [ebp - 0x50e], 0
je 0x404d99
mov ecx, dword [ebp - 0x5f8]
xor eax, eax
cmp eax, ecx
mov eax, 0x7d
sbb eax, dword [ebp - 0x5fc]
jae 0x404d99
xor eax, eax
mov dword [esp + 4], 0x7d
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.0043e475
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_card_larger_than__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp], str.To_use_such_a_card__check_List_USB_Hard_Drives_under_advanced_drive_properties
jmp 0x404dfd
lea eax, [ebp - 0x324]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x520]
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x524]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5f0]
mov dword [esp], eax
call fcn.0043a450
test eax, eax
jle 0x404d8c
mov dword [esp + 4], eax
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_Hard_Drive__score__d___0_
call fcn.0043d9e0
cmp dword [0x5240ec], 0
jne 0x404d83
mov dword [esp], str.If_this_device_is_not_a_Hard_Drive__please_e_mail_the_author_of_this_application
call fcn.0043d9e0
mov dword [esp], str.NOTE:_You_can_enable_the_listing_of_Hard_Drives_under_advanced_drive_properties
jmp 0x404dfd
cmp dword [0x524128], 0
je 0x404cce
cmp byte [ebp - 0x50c], 0
je 0x404dbd
mov eax, dword [ebp - 0x5f0]
mov dword [esp], eax
call fcn.0040d9fe
test eax, eax
je 0x404dbd
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_Microsoft_Dev_Drive
jmp 0x404dfd
mov eax, dword [ebp - 0x5c4]
test eax, eax
je 0x404de4
mov dword [esp + 4], str.PortableBaseLayer
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x404de4
mov dword [esp], str.Device_eliminated_because_it_is_a_Windows_Sandbox_VHD
jmp 0x404dfd
cmp byte [ebp - 0x50c], 0
je 0x404e07
cmp dword [0x48fbb4], 0
jne 0x404e07
mov dword [esp], str.Device_eliminated_because_listing_of_VHDs_is_disabled__Alt_G_
call fcn.0043d9e0
jmp 0x405060
cmp byte [ebp - 0x540], 0
jne 0x404e5c
mov eax, dword [0x524100]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
mov eax, dword [ebp - 0x5fc]
mov dword [esp + 4], eax
call fcn.0043e475
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5c4]
mov dword [esp], 0xbe6
mov dword [esp + 4], eax
call fcn.00422df0
mov ebx, eax
jmp 0x4050fa
xor ebx, ebx
mov al, byte [ebp + ebx - 0x540]
test al, al
je 0x404e9c
mov byte [ebp - 0x55a], al
lea eax, [ebp - 0x55a]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
test eax, eax
je 0x404e99
lea eax, [ebp + ebx - 0x540]
inc eax
cmp byte [eax - 1], 0
je 0x404e98
mov dl, byte [eax]
mov byte [eax - 1], dl
jmp 0x404e8a
dec ebx
inc ebx
jmp 0x404e5e
cmp byte [ebp - 0x540], 0
je 0x404ebe
cmp byte [ebp - 0x53f], 0
je 0x404ebe
mov dword [esp], 0xbe7
call fcn.00422df0
test eax, eax
jmp 0x404ec5
cmp dword [ebp - 0x5c4], 0
sete al
mov ebx, 1
test al, al
jne 0x404f02
cmp byte [ebp - 0x540], 0
je 0x404ef1
cmp byte [ebp - 0x53f], 0
je 0x404ef1
mov dword [esp], 0xbe7
call fcn.00422df0
jmp 0x404ef7
mov eax, dword [ebp - 0x5c4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [eax + 1]
cmp byte [ebp - 0x540], 0
je 0x404f24
cmp byte [ebp - 0x53f], 0
je 0x404f24
mov dword [esp], 0xbe7
call fcn.00422df0
mov ecx, eax
jmp 0x404f2a
mov ecx, dword [ebp - 0x5c4]
mov dword [esp], ebx
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x3a4]
xor ebx, ebx
call fcn.004024ec
cmp dword [ebp - 0x5e8], 0
mov al, byte [ebp + ebx - 0x540]
jne 0x405027
test al, al
je 0x40501e
cmp dword [0x524134], 0
mov byte [ebp - 0x5b0], al
je 0x404f91
lea eax, [ebp - 0x3a4]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x492690
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strncat_s]
lea eax, [ebp - 0x5b2]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
lea eax, [ebp - 0x3a4]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strncat_s]
mov al, byte [ebp + ebx - 0x540]
mov byte [ebp - 0x608], al
mov eax, 0x523e80
call fcn.0040262a
mov esi, eax
movsx eax, byte [ebp + ebx - 0x540]
mov dword [ebp - 0x610], eax
mov eax, 0x523d60
call fcn.0040262a
mov dword [ebp - 0x5e8], 2
add eax, 0x41
cmp dword [ebp - 0x610], eax
je 0x405018
movsx eax, byte [ebp - 0x608]
add esi, 0x41
cmp esi, eax
sete al
movzx eax, al
mov dword [ebp - 0x5e8], eax
inc ebx
jmp 0x404f3f
cmp dword [ebp - 0x5e8], 0
je 0x40506d
cmp dword [ebp - 0x5e8], 1
mov eax, str.disk_from_which_Rufus_7_is_running
mov esi, str.system_disk
cmove esi, eax
movsx eax, byte [ebp + ebx - 0x541]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.Removing__c:_from_the_list:_This_is_the__s_
call fcn.0043d9e0
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x403cfc
lea ebx, [ebp - 0x3a4]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x7f
xor ecx, ecx
sub edx, eax
lea esi, [ebx + eax]
mov eax, dword [0x524100]
mov dword [ebp - 0x5e8], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
mov eax, dword [ebp - 0x5fc]
mov dword [esp + 4], eax
call fcn.0043e475
cmp dword [0x524134], 0
mov ecx, 0x492690
mov dword [esp + 0xc], 0x493141
mov edx, eax
mov eax, 0x49264e
mov dword [esp + 8], 0xffffffff
cmovne eax, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x5e8]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [ebp - 0x326], 0
imul ecx, dword [ebp - 0x5e4], 0x28
mov eax, dword [ebp - 0x5f0]
mov esi, dword [sym.imp.msvcrt.dll__strdup]
lea edx, [ecx + 0x522420]
mov dword [ecx + 0x522434], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x5e8], edx
mov dword [ebp - 0x608], ecx
mov dword [esp], eax
call esi
mov ecx, dword [ebp - 0x608]
mov dword [ecx + 0x522420], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x5e8]
mov dword [edx + 4], eax
test ebx, ebx
je 0x40515b
mov dword [esp], ebx
call esi
mov ebx, eax
imul eax, dword [ebp - 0x5e4], 0x28
mov dword [eax + 0x522428], ebx
mov eax, dword [ebp - 0x5c4]
test eax, eax
je 0x40517b
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
imul ebx, dword [ebp - 0x5e4], 0x28
mov dword [ebx + 0x52242c], eax
mov eax, dword [ebp - 0x5f8]
mov dword [ebx + 0x522440], eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebx + 0x522444], eax
add ebx, 0x522420
cmp dword [ebp - 0x5f4], 0
je 0x4051ca
mov eax, dword [ebp - 0x5f4]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x514]
mov dword [ebx + 0x18], eax
inc dword [ebp - 0x5e4]
cmp dword [ebp - 0x5e4], 0x40
jne 0x4051ed
mov dword [esp + 4], 0x40
mov dword [esp], str.Warning:_Found_more_than__d_drives___ignoring_remaining_ones...
call fcn.0043d9e0
mov dword [esp], edi
call sub.msvcrt.dll_free
inc dword [ebp - 0x604]
cmp dword [ebp - 0x5e4], 0x40
jne 0x403b91
jmp 0x405215
inc dword [ebp - 0x608]
jmp 0x4049ac
mov eax, dword [ebp - 0x5e0]
mov ebx, 0x522420
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
push edx
mov edi, dword [ebp - 0x5e4]
mov dword [ebp - 0x5e0], ebx
dec edi
mov dword [ebp - 0x5f8], edi
cmp dword [ebp - 0x5f8], eax
jle 0x405320
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x5e8], eax
mov esi, dword [edi + 0x20]
mov edi, dword [edi + 0x24]
mov dword [ebp - 0x5f0], edi
lea edi, [eax + 1]
mov dword [ebp - 0x5f4], edi
mov ecx, dword [ebp - 0x5e4]
cmp edi, ecx
je 0x4052c7
imul ecx, edi, 0x28
mov edx, dword [ecx + 0x522440]
mov ecx, dword [ecx + 0x522444]
mov dword [ebp - 0x5ec], edx
cmp edx, esi
mov edx, ecx
sbb edx, dword [ebp - 0x5f0]
cmovb esi, dword [ebp - 0x5ec]
cmovae ecx, dword [ebp - 0x5f0]
mov dword [ebp - 0x5ec], esi
mov esi, dword [ebp - 0x5e8]
mov dword [ebp - 0x5f0], ecx
cmovb esi, edi
inc edi
mov dword [ebp - 0x5e8], esi
mov esi, dword [ebp - 0x5ec]
jmp 0x40526c
mov ecx, dword [ebp - 0x5e8]
cmp eax, ecx
je 0x40530e
imul eax, dword [ebp - 0x5e8], 0x28
mov esi, dword [ebp - 0x5e0]
lea edi, [ebp - 0x410]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x5e0]
mov ecx, 0xa
add eax, 0x522420
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x410]
mov ecx, 0xa
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add dword [ebp - 0x5e0], 0x28
mov eax, dword [ebp - 0x5f4]
jmp 0x40523f
xor eax, eax
xor edi, edi
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e4]
mov esi, dword [0x52417c]
cmp edi, eax
jge 0x40540b
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebx + 8]
call fcn.00402560
mov dword [esp + 0xc], eax
mov dword [ebp - 0x5ec], eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x143
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x5ec]
test edx, edx
je 0x405399
mov dword [ebp - 0x5ec], eax
mov dword [esp], edx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x5ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
mov eax, dword [ebp - 0x5e8]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x151
mov eax, dword [0x52417c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 8]
sub esp, 0x10
mov dword [esp + 4], eax
mov eax, dword [0x52417c]
mov dword [esp], eax
call fcn.004411ad
mov ecx, dword [ebp - 0x5e0]
cmp eax, ecx
jl 0x405402
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x52417c]
mov dword [esp], eax
call fcn.004411ad
mov dword [ebp - 0x5e0], eax
inc edi
add ebx, 0x28
jmp 0x40532a
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x160
call esi
sub esp, 0x10
cmp dword [ebp - 0x60c], 0x7f
ja 0x40543e
xor ebx, ebx
jmp 0x40548f
xor ebx, ebx
xor edi, edi
mov dword [esp + 4], 0x146
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov eax, dword [0x52417c]
mov dword [esp], eax
call esi
sub esp, 0x10
cmp ebx, eax
jae 0x40543a
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x150
mov eax, dword [0x52417c]
mov dword [esp], eax
call esi
mov edi, dword [ebp - 0x60c]
sub esp, 0x10
cmp eax, edi
je 0x40548f
inc ebx
jmp 0x405440
xor ecx, ecx
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x14e
mov eax, dword [0x52417c]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 0xc], ebx
mov ebx, 1
mov dword [esp + 8], 0x103e9
mov dword [esp + 4], 0x111
mov eax, dword [0x5241b4]
mov dword [esp], eax
call esi
sub esp, 0x10
jmp 0x4054da
xor ebx, ebx
mov dword [esp + 4], 0x3eb
mov eax, dword [0x5241b4]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov eax, dword [0x5241b4]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x5dc]
sub esp, 0x10
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, [ebp - 0x5a0]
mov dword [esp], eax
call fcn.0043c17c
lea eax, [ebp - 0x5ac]
mov dword [esp], eax
call fcn.0043b11d
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret