Function at 0x417fd6
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0xa8], eax
mov eax, dword [ebp + 0xb4]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x80], 0x5c3a41
cmp eax, 0x8000
jne 0x4181bd
push ecx
call fcn.0041665d
mov eax, dword [esi + 4]
pop ecx
cmp eax, 5
jne 0x418157
cmp dword [esi], 0x20
jb 0x4182cf
lea edi, [esi + 0xc]
push edi
push 0x490c38
call fcn.004090f7
pop ecx
pop ecx
mov ebx, 0x49cf10
test eax, eax
je 0x41804f
lea eax, [esi + 0x1c]
push eax
push ebx
call fcn.0046eb90
pop ecx
pop ecx
push edi
push 0x490c18
call fcn.004090f7
pop ecx
pop ecx
test eax, eax
je 0x4182cf
mov edi, 0x118
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.0046e3e0
lea eax, [ebp - 0x70]
push eax
push ebx
add esi, 0x1c
push esi
call fcn.00408b97
add esp, 0x18
test eax, eax
je 0x4182cf
cmp dword [ebp + 0xa0], 2
ja 0x4182cf
cmp byte [ebp - 0x68], 0
jne 0x4180b0
push str.USB_DEVICE
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.00404bbc
pop ecx
cmp dword [ebp - 0x78], ebx
je 0x4180e0
mov eax, dword [ebp + 0xa0]
push dword [ebp + 0x9c]
imul eax, eax, 0x50
push dword [eax + 0x49c1d8]
call fcn.004161fa
pop ecx
pop ecx
mov eax, dword [ebp + 0xa0]
imul eax, eax, 0x50
cmp dword [eax + 0x49c1dc], 1
jne 0x4182cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x7c], eax
cmp eax, ebx
je 0x4182cf
push edi
lea ecx, [ebp - 0x70]
push ecx
push eax
call fcn.0046c470
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp - 0x7c]
push 0x417d1f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x418145
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4182cf
push dword [ebp - 0x7c]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4182cf
cmp eax, 2
jne 0x4182cf
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
call fcn.00404bbc
cmp dword [ebp - 0x78], 0
pop ecx
je 0x4182cf
xor ecx, ecx
mov dword [ebp - 0x74], ecx
xor eax, eax
inc eax
shl eax, cl
test dword [esi + 0xc], eax
je 0x4181af
lea eax, [ebp - 0x80]
add cl, 0x41
push eax
mov byte [ebp - 0x80], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4181ac
push dword [esi + 0xc]
push dword [0x49c228]
call fcn.004161fa
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
inc ecx
mov dword [ebp - 0x74], ecx
cmp ecx, 0x20
jb 0x41817d
jmp 0x4182cf
cmp eax, 0x8004
jne 0x418207
cmp dword [esi + 4], 2
jne 0x4182cf
cmp dword [esi], 0x14
jne 0x4182cf
and dword [ebp - 0x74], 0
mov ecx, dword [ebp - 0x74]
xor eax, eax
inc eax
shl eax, cl
test dword [esi + 0xc], eax
je 0x4181f9
mov al, cl
add al, 0x41
movzx eax, al
push 0
push eax
call fcn.004086e3
pop ecx
pop ecx
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 0x1a
jb 0x4181db
jmp 0x4182cf
cmp eax, 0x8001
jne 0x418277
cmp dword [esi + 4], 6
jne 0x4182cf
mov ecx, dword [esi + 0xc]
xor eax, eax
mov dword [ebp - 0x74], eax
xor edx, edx
cmp dword [edx + 0x49cce4], ecx
jne 0x41822f
cmp ecx, 0xffffffff
jne 0x418243
inc eax
add edx, 0x14
mov dword [ebp - 0x74], eax
cmp edx, 0x208
jb 0x418222
jmp 0x4182cf
imul eax, eax, 0x14
or dword [eax + 0x49cce4], 0xffffffff
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
imul eax, eax, 0x14
push dword [eax + 0x49cce8]
call fcn.0041664b
mov eax, dword [ebp - 0x74]
imul eax, eax, 0x14
and dword [eax + 0x49cce8], 0
pop ecx
jmp 0x4182cf
cmp eax, 0x8002
je 0x4182cf
cmp eax, 0x8006
jne 0x4182cf
cmp dword [esi + 4], 6
jne 0x4182cf
lea eax, [esi + 0x14]
push 0x48736c
push eax
call fcn.004090f7
pop ecx
pop ecx
test eax, eax
je 0x4182cf
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
imul eax, eax, 0x14
mov eax, dword [eax + 0x49cce4]
cmp eax, dword [esi + 0xc]
jne 0x4182c6
mov al, byte [ebp - 0x74]
add al, 0x41
movzx eax, al
push 0
push eax
call fcn.004086e3
pop ecx
pop ecx
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 0x1a
jb 0x4182a3
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0046c1d2
add ebp, 0xac
leave
ret