Having conquered one of the commands, we'll now tackle the other one. Try to replicate command #3, set bRequest to 0x31 and a wValue to 0xffd0 (also known as -48 for a 2-byte word)
ret = dev.ctrl_transfer(0x40, 0x31, 0xffd0, 0, [])
Running the python script made the motor move its 'head' down.
Now try command #4, 0xfff0 (also known as -16 for a 2-byte word)
ret = dev.ctrl_transfer(0x40, 0x31, 0xfff0, 0, [])
This makes the head move up. Now we have both the motor and LED under our control! Here is a video we shot a few minutes after getting the motor working, using a python script to move it up and down.