Function at 0x4b5e60
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x502558]
push esi
push edi
push 0xa
mov dword [ebp - 0x5e4], eax
mov eax, dword [0x50255c]
push 0
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5e8], ecx
mov ecx, dword [0x502560]
mov dword [ebp - 0x5d0], edx
mov edx, dword [0x502564]
push 0
lea eax, [ebp - 0x5d0]
push eax
mov dword [ebp - 0x5c8], ecx
mov dword [ebp - 0x5c4], edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov esi, eax
mov dword [ebp - 0x5dc], esi
test esi, esi
jne 0x4b5ee2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push 0x1c
call fcn.004e5379
add esp, 4
mov edi, eax
push edi
push 0
push esi
mov dword [ebp - 0x5d8], edi
mov dword [edi], 0x1c
mov dword [ebp - 0x5d4], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x4b629b
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x1be]
push edx
mov word [ebp - 0x1c0], cx
call fcn.004e8ba0
add esp, 0xc
push 0
push 0x7f
lea eax, [ebp - 0x1c0]
push eax
push 0
push 0xc
push edi
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
jne 0x4b5f63
push eax
push 0x7f
lea ecx, [ebp - 0x1c0]
push ecx
push eax
push eax
push edi
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
lea edx, [ebp - 0x1c0]
push str.USB_Device
push edx
call fcn.004e571a
add esp, 8
test eax, eax
je 0x4b6270
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x3be]
push ecx
mov word [ebp - 0x3c0], ax
call fcn.004e8ba0
add esp, 0xc
push 0
push 0x100
lea edx, [ebp - 0x3c0]
push edx
push edi
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
je 0x4b6270
xor eax, eax
lea ecx, [ebp - 0x3c0]
push ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x5e0]
mov word [ebp - 0x40], ax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
mov dword [ebp - 0x5e0], eax
call fcn.004ae280
add esp, 8
test eax, eax
je 0x4b6270
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x5e0], eax
jne 0x4b6270
xor eax, eax
lea ecx, [ebp - 0x5f0]
push ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x4b6270
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edx, ecx
or edx, eax
je 0x4b6270
shl eax, 0x16
shr ecx, 0xa
add ecx, eax
xor eax, eax
ja 0x4b6088
jb 0x4b6078
cmp ecx, 0x800
jae 0x4b6088
push eax
push ecx
push 0x526cc8
lea eax, [ebp - 0xc0]
push eax
jmp 0x4b609d
shrd ecx, eax, 0xa
shr eax, 0xa
push eax
push ecx
push 0x526cd8
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, ebx
add esp, 0x10
lea edx, [eax + 2]
jmp 0x4b60b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b60b0
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x1c0]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b60d0
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0xc0]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b60f0
sub eax, esi
sar eax, 1
add eax, edx
lea edx, [eax + edi + 4]
cmp edx, 0x1000
jae 0x4b628f
mov esi, dword [ebp - 0x5e4]
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6120
sub eax, edx
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x3c0]
push edx
sar eax, 1
lea eax, [esi + eax*2]
push str._s__s__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x40]
add esp, 0x10
mov ecx, eax
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4b6154
sub eax, ecx
mov esi, ecx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4b6166
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6185
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
sub eax, edx
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x1c0]
push edx
sar eax, 1
lea eax, [ebx + eax*2]
push str._s__s_
push eax
call edi
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x5be]
push edx
mov word [ebp - 0x5c0], cx
call fcn.004e8ba0
lea eax, [ebp - 0x5c0]
push eax
lea edx, [ebp - 0x40]
call fcn.004b5a70
mov eax, ebx
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b61e5
sub eax, edx
lea ecx, [ebp - 0x5c0]
sar eax, 1
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4b6200
sub ecx, esi
sar ecx, 1
lea ecx, [ecx + eax + 4]
cmp ecx, 0x1000
jae 0x4b628f
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6220
sub eax, edx
lea edx, [ebp - 0x5c0]
push edx
sar eax, 1
lea eax, [ebx + eax*2]
push str.__s_
push eax
call edi
add esp, 0xc
lea edi, [ebx - 2]
jmp 0x4b6250
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4b6250
mov ecx, dword [0x51ca08]
mov esi, dword [ebp - 0x5dc]
mov dword [edi], ecx
mov edi, dword [ebp - 0x5d8]
inc dword [ebp - 0x5d4]
mov edx, dword [ebp - 0x5d4]
push edi
push edx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4b5f16
jmp 0x4b629b
mov edi, dword [ebp - 0x5d8]
mov esi, dword [ebp - 0x5dc]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], eax
call fcn.004e4fab
add esp, 4
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
jmp 0x4b62e0
movzx ecx, word [eax + 0x526204]
mov word [ebp + eax - 0x20], cx
add eax, 2
test cx, cx
jne 0x4b62e0
lea ecx, [ebp - 0x20]
lea eax, [esi + 0x41]
push ecx
mov word [ebp - 0x20], ax
call edi
xor ecx, ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
push 0xa
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push eax
mov word [ebp - 0x10], dx
call fcn.004e534f
mov dx, word [ebp - 0x10]
mov eax, dword [ebp - 0x5e8]
mov word [eax + esi*2], dx
inc esi
add esp, 0xc
cmp esi, 0x1a
jl 0x4b62d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004e4746
mov esp, ebp
pop ebp
ret