Function at 0x4cba10
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x574ea2
mov eax, dword fs:[0]
push eax
sub esp, 0x534
mov eax, dword [0x5d480c]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d480c]
xor eax, esp
push eax
lea eax, [esp + 0x548]
mov dword fs:[0], eax
mov edi, dword [esp + 0x558]
mov esi, dword [esp + 0x560]
xor ebx, ebx
push 0x3fc
lea eax, [esp + 0x14c]
push ebx
push eax
mov dword [esp + 0x150], ebx
call fcn.00493420
add esp, 0xc
mov dword [esp + 0x28], 0x200
call fcn.0045e1b2
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4cba9a
push 0x80004005
call fcn.004017e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x114
lea ecx, [esp + 0x34]
push ebx
push ecx
mov dword [esp + 0x55c], ebx
call fcn.00493420
add esp, 0xc
mov dword [esp + 0x30], 0x114
call fcn.0045e1b2
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4cbae6
push 0x80004005
call fcn.004017e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x554], 1
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4cbb2a
cmp esi, ebx
je 0x4cbf61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 0x10]
push eax
push edx
push str._LAYER__s__ERROR:GetDemoDrive___GetVersionEx_failed_GetLastError__d_
jmp 0x4cbf58
mov eax, dword [esp + 0x34]
cmp eax, 5
jbe 0x4cbe90
cmp eax, 6
jne 0x4cbd38
cmp dword [esp + 0x38], ebx
jne 0x4cbd38
mov edx, dword [esp + 0x55c]
push ebx
push 0x200
lea ecx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDW]
test eax, eax
jne 0x4cbd12
lea ecx, [esp + 0x1c]
call fcn.00403dd0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x20]
push 0x5859d4
push ecx
mov byte [esp + 0x55c], 2
call fcn.00404280
add esp, 0xc
push 0x23
push 0x5c
lea ecx, [esp + 0x24]
call fcn.0043a930
mov ebp, dword [esp + 0x1c]
cmp dword [ebp - 0xc], ebx
jl 0x4cbcf3
push str.USBSTOR
push ebp
call fcn.00494ad6
add esp, 8
cmp eax, ebx
je 0x4cbcf3
sub eax, ebp
sar eax, 1
cmp eax, 0xffffffff
je 0x4cbcf3
push ebp
lea edx, [esp + 0x18]
push str._STORAGEVOLUME119F7E59C0_____s53f56307_b6bf_11d0_94f2_00a0c91efb8b53f5630d_b6bf_11d0_94f2_00a0c91efb8b
push edx
call fcn.00404280
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00403dd0
push 0x581258
lea ecx, [esp + 0x24]
mov byte [esp + 0x554], 3
call fcn.00408aa0
push esi
lea eax, [esp + 0x24]
push eax
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edi
call fcn.004c9250
add esp, 0x14
test eax, eax
jne 0x4cbc61
cmp esi, ebx
je 0x4cbc38
mov edx, dword [edi + 0x10]
push edx
push str._LAYER__s__ERROR:GetDemoDrive___Get_PDOName_failed
push esi
call fcn.004d2ee0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00403e00
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x18]
call fcn.00403e00
lea ecx, [esp + 0x14]
call fcn.00403e00
jmp 0x4cbfaf
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004071f0
call fcn.004c8760
movzx eax, ax
add esp, 4
mov word [edi + 4], ax
cmp ax, bx
jbe 0x4cbcb4
lea ecx, [esp + 0x20]
call fcn.00403e00
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x18]
call fcn.00403e00
lea ecx, [esp + 0x14]
call fcn.00403e00
mov eax, 1
jmp 0x4cbfb1
cmp esi, ebx
je 0x4cbcca
mov ecx, dword [edi + 0x10]
push ecx
push str._LAYER__s__ERROR:GetDemoDrive___QueryVolume_failed
push esi
call fcn.004d2ee0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00403e00
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x18]
call fcn.00403e00
lea ecx, [esp + 0x14]
call fcn.00403e00
jmp 0x4cbfaf
cmp esi, ebx
je 0x4cbc41
mov edx, dword [edi + 0x10]
push edx
push str._LAYER__s__ERROR:GetDemoDrive___Find_USBSTOR_failed
push esi
call fcn.004d2ee0
add esp, 0xc
jmp 0x4cbc41
cmp esi, ebx
je 0x4cbc4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [edi + 0x10]
push eax
push str._LAYER__s__ERROR:GetDemoDrive___CM_Get_Device_ID_failed_GetLastError__d_
push esi
call fcn.004d2ee0
add esp, 0x10
jmp 0x4cbc4a
mov edx, dword [esp + 0x55c]
push ebx
push 0x200
lea ecx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDW]
cmp eax, ebx
jne 0x4cbe5d
lea ecx, [esp + 0x20]
call fcn.00403dd0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x24]
push 0x5859d4
push ecx
mov byte [esp + 0x55c], 4
call fcn.00404280
add esp, 0xc
push 0x23
push 0x5c
lea ecx, [esp + 0x28]
call fcn.0043a930
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push str._STORAGEVOLUME_____s53f56307_b6bf_11d0_94f2_00a0c91efb8b53f5630d_b6bf_11d0_94f2_00a0c91efb8b
push eax
call fcn.00404280
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00403dd0
push esi
lea ecx, [esp + 0x20]
push ecx
push 0xa
lea edx, [esp + 0x20]
push edx
push edi
mov byte [esp + 0x564], 5
call fcn.004c9250
add esp, 0x14
test eax, eax
jne 0x4cbdfe
cmp esi, ebx
je 0x4cbdec
mov eax, dword [edi + 0x10]
push eax
push str._LAYER__s__ERROR:GetDemoDrive___Get_PDOName_failed
push esi
call fcn.004d2ee0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x20]
jmp 0x4cbc45
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.004071f0
call fcn.004c8760
movzx eax, ax
add esp, 4
mov word [edi + 4], ax
cmp ax, bx
jbe 0x4cbe35
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x20]
jmp 0x4cbc93
cmp esi, ebx
je 0x4cbe4b
mov eax, dword [edi + 0x10]
push eax
push str._LAYER__s__ERROR:GetDemoDrive___QueryVolume_failed
push esi
call fcn.004d2ee0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00403e00
lea ecx, [esp + 0x20]
jmp 0x4cbc45
cmp esi, ebx
je 0x4cbe74
mov ecx, dword [edi + 0x10]
push eax
push ecx
push str._LAYER__s__ERROR:GetDemoDrive___CM_Get_Device_ID_failed_ErrCode_0x_x_
push esi
call fcn.004d2ee0
add esp, 0x10
lea eax, [ebp - 0x10]
mov byte [esp + 0x550], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4cbf78
mov ecx, dword [esp + 0x55c]
push ebx
push ecx
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
cmp eax, ebx
jne 0x4cbf4a
mov edx, dword [esp + 0x2c]
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14c]
push ecx
push ebx
push 0xf
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyW]
cmp eax, ebx
jne 0x4cbf2a
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x1c]
call fcn.00408aa0
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.004071f0
call fcn.004c8760
movzx eax, ax
add esp, 4
mov word [edi + 4], ax
cmp ax, bx
ja 0x4cbc98
cmp esi, ebx
je 0x4cbc4a
mov eax, dword [esp + 0x18]
mov ecx, dword [edi + 0x10]
push eax
push ecx
push str._LAYER__s__ERROR:GetDemoDrive___QueryVolume_failed_PDOName_s
push esi
call fcn.004d2ee0
add esp, 0x10
jmp 0x4cbc4a
cmp esi, ebx
je 0x4cbc4a
mov edx, dword [edi + 0x10]
push eax
push edx
push str._LAYER__s__ERROR:GetDemoDrive___CM_Get_DevNode_Registry_Property_failed_ErrCode_0x_x_
push esi
call fcn.004d2ee0
add esp, 0x10
jmp 0x4cbc4a
cmp esi, ebx
je 0x4cbf61
push eax
mov eax, dword [edi + 0x10]
push eax
push str._LAYER__s__ERROR:GetDemoDrive___CM_Get_Child_failed_ErrCode_0x_x_
push esi
call fcn.004d2ee0
add esp, 0x10
lea eax, [ebp - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x550], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbf84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x550], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbfaf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x548]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00493eee
add esp, 0x540
ret