Function at 0x401530
Capabilities:
Get disk information
Set registry value

Disassembly:
mov eax, 0x4a44
call fcn.00412360
push ebp
push esi
push 0x441700
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
push 2
push esi
push esi
push 0x435888
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebp, eax
cmp ebp, esi
je 0x401888
push ebx
lea eax, [esp + 0x34]
push edi
push eax
push esi
push ebp
mov dword [esp + 0x44], 0x1c
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x4016da
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
lea ecx, [esp + 0xa54]
mov dword [esp + 0x10], ecx
push 0
lea edx, [esp + 0x258]
push 0x400
lea eax, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x48]
push 4
push ecx
push ebp
call ebx
test eax, eax
je 0x4016bc
lea edx, [esp + 0x254]
push str.USBSTOR
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4016bc
push eax
lea eax, [esp + 0x258]
push 0x400
lea ecx, [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x48]
push 1
push edx
push ebp
call ebx
test eax, eax
je 0x4016bc
xor edi, edi
mov esi, str.USBVid_054cPid_0241
push 0x15
lea eax, [esp + 0x258]
push esi
push eax
call fcn.00412262
add esp, 0xc
test eax, eax
je 0x40162f
add esi, 0x2c
inc edi
cmp esi, str.MV_VE_FORMAT1.00
jb 0x401607
jmp 0x4016bc
cmp edi, 3
jae 0x4016bc
mov ecx, dword [esp + 0x4c]
mov esi, dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
push 0
lea edx, [esp + 0x34]
push ecx
push edx
call esi
test eax, eax
jne 0x4016bc
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x30]
push eax
push ecx
call esi
test eax, eax
jne 0x4016bc
push eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x258]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0xf
push edx
mov dword [esp + 0x40], 0x400
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyW]
test eax, eax
jne 0x4016bc
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov eax, ecx
add ecx, 0x200
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x254]
inc esi
push ecx
push eax
mov dword [esp + 0x1c], esi
call fcn.0041223d
add esp, 8
cmp esi, 0x20
jae 0x4016da
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x38]
inc eax
push edx
push eax
push ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x40159a
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [0x441718]
lea ecx, [esp + 0x54]
xor edi, edi
push ecx
push 0xff
mov dword [esp + 0x20], eax
mov dword [0x441718], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea edx, [esp + 0x654]
push 0x4416f8
push edx
lea esi, [esp + 0x5c]
call fcn.0041223d
add esp, 8
cmp word [esp + 0x54], di
lea ebp, [esp + 0x654]
mov dword [esp + 0x10], edi
je 0x401807
push esi
call fcn.004121f6
add esp, 4
xor edi, edi
mov word [esi + eax*2 - 2], di
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x4017c5
lea eax, [esp + 0x854]
push 0x100
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x4017f0
lea ebx, [esp + 0xa54]
lea ecx, [esp + 0x854]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401798
mov eax, dword [esp + 0x14]
inc edi
add ebx, 0x200
cmp edi, eax
jb 0x401774
jmp 0x4017f0
push esi
push ebp
mov edi, 1
call fcn.0041223d
push ebp
call fcn.004121f6
mov edx, dword [esp + 0x1c]
push ebp
lea eax, [edx + eax + 1]
mov dword [esp + 0x20], eax
call fcn.004121f6
add esp, 0x10
lea ebp, [ebp + eax*2 + 2]
jmp 0x4017d4
cmp eax, 3
je 0x4017d4
cmp eax, 4
je 0x4017d4
cmp eax, 6
jne 0x4017f0
mov edx, dword [esp + 0x4a58]
push edi
lea ecx, [esp + 0x1c]
push esi
push ecx
push 0x441718
push edx
call fcn.00401be0
add esp, 0x14
push esi
call fcn.004121f6
lea esi, [esi + eax*2 + 4]
add esp, 4
cmp word [esi], 0
jne 0x401731
lea eax, [esp + 0x34]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push 0x20006
push 1
push 0
push 0
push 0x4318e0
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop edi
pop ebx
test eax, eax
jne 0x40186a
mov edx, dword [esp + 8]
lea ecx, [esp + 0x64c]
lea eax, [edx + edx + 2]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push 7
push 0
push str.CurrentDrive
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401888
mov esi, dword [eax + 0x24]
push eax
call fcn.00401d10
add esp, 4
mov eax, esi
test esi, esi
mov dword [esp + 0x10], eax
jne 0x401872
push 0x441700
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
add esp, 0x4a44
ret