Function at 0x403566
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x40e6b4], 0
mov esi, dword [ebp + 0xc]
je 0x40359f
movzx eax, byte [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push str._nRemoveDevice__s___s___s___i_
call fcn.004049f0
add esp, 0x14
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.00404900
lea eax, [ebp - 0x68]
push 0x5c
push eax
call fcn.00404471
add esp, 0x10
cmp byte [esi], 0
mov edi, 0x104
je 0x4035d0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, eax
push esi
jmp 0x403620
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x403855
and byte [ebp - 0x16c], 0
lea ecx, [ebp - 0x16c]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp byte [0x40e6b4], 0
mov ebx, eax
je 0x403619
push dword [ebp + 0x10]
push str._nVolumes_DosDeviceName_s
call fcn.004049f0
pop ecx
pop ecx
lea eax, [ebp - 0x16c]
push eax
call fcn.00403a93
push dword [ebp + 0x10]
mov esi, eax
push ebx
push esi
call fcn.00403b03
add esp, 0x10
cmp byte [0x40e6b4], 0
mov dword [ebp + 0xc], eax
je 0x40365c
push esi
push str._nVolumes_DeviceNumber_i
call fcn.004049f0
pop ecx
pop ecx
push dword [ebp + 0xc]
push str._nDevs_DevInst_i
call fcn.004049f0
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x403855
mov esi, dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
push 0
lea eax, [ebp - 0x270]
push edi
push eax
push dword [ebp + 0xc]
call esi
cmp byte [0x40e6b4], 0
je 0x403697
lea eax, [ebp - 0x270]
push eax
push str._nDevice_to_remove_n__ID_s_n
call fcn.004049f0
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.00403a2c
mov ebx, eax
pop ecx
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x4036d2
cmp byte [0x40e6b4], 0
je 0x4036d2
push 0
lea eax, [ebp - 0x270]
push edi
push eax
push ebx
call esi
lea eax, [ebp - 0x270]
push eax
push str.Found_removable_parent_Device_to_remove_n__ID_s_n
call fcn.004049f0
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov dword [ebp - 0xc], eax
call fcn.00403c50
pop ecx
mov byte [ebp - 4], al
push 1
mov esi, 0x1f4
pop ebx
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.0040385c
add esp, 0xc
mov edi, eax
dec eax
je 0x40379f
dec eax
je 0x403855
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jle 0x4036ed
test edi, edi
jne 0x4037b2
cmp byte [0x40e6b7], 0
je 0x4037b2
mov ebx, str.CiSvc
push ebx
call fcn.00403c89
cmp eax, 4
pop ecx
jne 0x4037b2
push str._nstopping_indexing_service...
call fcn.004049f0
push ebx
call fcn.00403d4d
pop ecx
test al, al
pop ecx
je 0x4037a7
push str._OK_ntry_again...
call fcn.004049f0
pop ecx
mov byte [0x40e6b6], 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop ebx
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.0040385c
add esp, 0xc
mov edi, eax
dec eax
je 0x40379f
dec eax
je 0x403855
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jle 0x403773
jmp 0x4037b2
push 1
pop eax
jmp 0x403857
push str._failed_n
call fcn.004049f0
pop ecx
cmp byte [ebp + 0x14], 0
je 0x40384b
test edi, edi
jne 0x40384b
push str._nremoval_failed_n
call fcn.004049f0
mov eax, dword [ebp + 0x10]
pop ecx
cmp byte [eax], 0
je 0x4037e8
push eax
push dword [ebp + 8]
push str.check_for_open_files_on__s_or__s_n
call fcn.004049f0
add esp, 0xc
push str.Press_CtrlC_to_cancel._Trying..
call fcn.004049f0
pop ecx
mov ecx, dword [0x40e6b0]
call fcn.0040108b
test al, al
jne 0x40384b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, esi
sub ecx, eax
cmp ecx, 0x834
jae 0x403827
sub eax, esi
add eax, 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40d708
call fcn.004049f0
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.0040385c
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4037f3
xor eax, eax
cmp edi, 1
sete al
jmp 0x403857
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret