Function at 0x408b97
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x1c], 0
push ebx
push 0x3000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x408e74
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [ebp - 4], edi
add edi, 0x1000
mov esi, edi
add edi, 0x400
push 0x5c
push dword [ebp + 8]
lea eax, [edi + 0x400]
mov dword [ebp - 0x18], eax
call fcn.0046e8f2
pop ecx
pop ecx
test eax, eax
je 0x408e62
inc eax
push eax
push esi
call fcn.0046eb90
push 0x23
push esi
call fcn.0046e8f2
add esp, 0x10
test eax, eax
je 0x408e62
push esi
mov byte [eax], 0
call fcn.0046eb66
push esi
push edi
call fcn.0046eb90
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov al, byte [edi]
jmp 0x408c3c
cmp al, 0x5c
je 0x408c42
cmp al, 0x23
je 0x408c42
inc ecx
mov dword [ebp - 0xc], ecx
mov al, byte [ecx + edi]
test al, al
jne 0x408c2d
jmp 0x408c46
mov byte [ecx + edi], 0
push 6
push 0
push edi
push 0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x408e62
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebx
mov dword [edi + 0x114], eax
mov dword [ebx], 0x1c
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov dword [ebp - 0x14], eax
push eax
jmp 0x408cc3
lea eax, [ebp - 0xc]
push eax
push 0x1000
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
je 0x408e56
push dword [ebp - 4]
call fcn.0046eb66
push dword [ebp - 4]
call fcn.004086f1
pop ecx
pop ecx
test eax, eax
jne 0x408cd1
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x14]
push eax
push dword [ebp - 0x14]
mov dword [eax], 0x1c
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x408c7d
jmp 0x408e56
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [edi + 0x114]
push eax
lea eax, [ebp - 0x24]
push eax
push 0xf
push ebx
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
push 0x4857b4
push esi
call fcn.0046ea4a
pop ecx
pop ecx
test eax, eax
je 0x408d27
mov esi, dword [ebp - 4]
add eax, 4
push eax
push esi
call fcn.0046eb90
push 0x23
push esi
call fcn.0046e8f2
add esp, 0x10
test eax, eax
je 0x408e56
mov byte [eax], 0
jmp 0x408d5b
push 0
push dword [ebx + 0x14]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
test eax, eax
jne 0x408e56
push eax
push 0x1000
push dword [ebp - 4]
push dword [ebp - 0x20]
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
test eax, eax
jne 0x408e56
mov esi, dword [ebp - 4]
push edi
push dword [ebp + 0xc]
push esi
call fcn.00408a2c
add esp, 0xc
test eax, eax
je 0x408e56
push 0x494bb0
push dword [ebp + 8]
push str._s_s
push esi
call fcn.0046ec88
add esp, 0x10
push 0x400
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x408e56
lea ecx, [ebp - 0xc]
push ecx
mov eax, 0x1000
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
call dword [0x49c420]
test eax, eax
je 0x408e56
and dword [edi + 0x10c], 0
cmp byte [esi], 0
je 0x408e4f
push 2
pop ebx
mov al, byte [esi]
cmp al, 0x41
jl 0x408e3f
cmp al, 0x5a
jg 0x408e3f
movsx ecx, al
xor eax, eax
sub ecx, 0x41
inc eax
shl eax, cl
push esi
mov dword [edi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, ebx
je 0x408e3b
dec eax
jne 0x408e3f
test byte [edi + 0x114], 0x84
je 0x408e3f
push str.USBSTOR
push dword [ebp + 0xc]
call fcn.0046e7b0
pop ecx
pop ecx
test eax, eax
je 0x408e3f
lea eax, [edi + 8]
cmp byte [eax], 0
jne 0x408e30
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
or dword [edi + 4], 0x80000001
mov dword [edi], ebx
jmp 0x408e3f
or dword [edi + 4], 1
push esi
call fcn.0046df70
lea esi, [esi + eax + 1]
cmp byte [esi], 0
pop ecx
jne 0x408dcf
mov dword [ebp - 0x1c], 1
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ebx, dword [ebp - 0x10]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, dword [ebp - 0x1c]
pop ebx
leave
ret