Function at 0x40e3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
jne 0x40168d
xor eax, eax
ret
jmp 0x43abc0
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
je 0x40177f
jmp 0x43b110
ret
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
je 0x40178f
jmp 0x43b1e0
ret
sub esp, 8
push edi
mov edi, ecx
call fcn.0044f100
test eax, eax
je 0x401f67
mov eax, dword [0x492074]
test eax, eax
jne 0x401f67
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.004236f0
add esp, 4
test eax, eax
je 0x401f93
mov eax, dword [esp + 4]
test eax, eax
jne 0x401f93
mov ecx, dword [0x4920b0]
push 0x14ce
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x49e994]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x401e90
mov dword [esp + 0x1c], 0
call fcn.00424010
add esp, 0x14
test eax, eax
jne 0x401f5b
mov ecx, dword [0x4910e8]
test dword [edi + 0x138], ecx
je 0x401f93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HotPlugProcessThread_creation_failed._err_d
call fcn.0040a4a0
add esp, 8
pop edi
add esp, 8
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
add esp, 8
ret
mov edx, dword [0x4910e8]
test dword [edi + 0x138], edx
je 0x401f82
push str.OnHotplugRetryTimer._session_not_active_or_g_ulPnpTrigger._EXIT
call fcn.0040a4a0
add esp, 4
mov eax, dword [0x4920b0]
push 0x14ce
push eax
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
add esp, 8
ret
mov eax, ecx
mov ecx, dword [eax + 0x12c]
test ecx, ecx
je 0x401fb1
jmp 0x43ada0
mov ecx, dword [0x4910e8]
test dword [eax + 0x138], ecx
je 0x401fca
push str.CATIExtEvent::OnADCPendingRequestTimer:_ERROR_m_pDriverMessage_is_NULL
call fcn.0040a4a0
pop ecx
ret
mov eax, dword [0x4910e8]
test eax, eax
je 0x40a886
push str.OnSwitchingModeTimer_for_RefreshDisplaySettings
call fcn.0040a4a0
add esp, 4
push esi
push edi
mov edi, 1
xor esi, esi
nop
mov ecx, dword [0x4920b8]
push esi
call fcn.00402090
cmp eax, 0xffffffff
je 0x40a8c1
mov ecx, dword [0x4920b8]
push eax
call fcn.004020d0
test eax, eax
je 0x40a8bf
mov ecx, dword [0x4920b8]
push esi
call fcn.00402030
jmp 0x40a8c1
xor edi, edi
inc esi
cmp esi, 5
jb 0x40a890
test edi, edi
pop edi
pop esi
je 0x40a8f2
mov eax, dword [0x4920b0]
push 0x14d1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x4910e8]
test eax, eax
je 0x40a8f2
push str.OnSwitchingModeTimer_RefreshDisplaySettings_returns_TRUE__timer_was_killed
call fcn.0040a4a0
pop ecx
ret
call fcn.0044f100
test eax, eax
je 0x40b402
mov eax, dword [0x4910e8]
test eax, eax
je 0x40b3af
push str.OnQuerySessionTimer:_Session_Active_detected
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x40b3e6
mov eax, dword [0x49eaf4]
push 0
push 0
push 1
push 2
push eax
call fcn.00421cb0
test eax, eax
jne 0x40b3e6
mov eax, dword [0x4910e8]
test eax, eax
je 0x40b3e6
push str.OnQuerySessionTimer.__g_aAutoDisplay.Apply_failed
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x4920b0]
push 0x14cb
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x4920dc], 0
ret
mov eax, dword [esp + 4]
cmp eax, 0x4d2
jne 0x40e3fb
mov eax, dword [0x4920b4]
test eax, eax
je 0x40e504
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40e504
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret
cmp eax, 0x4d3
jne 0x40e415
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40e504
jmp 0x401770
cmp eax, 0x14c9
jne 0x40e42f
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40e504
jmp 0x401780
cmp eax, 0x4d4
jne 0x40e443
mov dword [esp + 4], 1
jmp fcn.0040b770
cmp eax, 0x14ca
jne 0x40e453
mov dword [esp + 4], eax
jmp 0x416f00
cmp eax, 0x14cb
jne 0x40e45f
jmp 0x40b390
cmp eax, 0x14ce
jne 0x40e479
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40e504
jmp 0x401eb0
cmp eax, 0x14cc
jne 0x40e48f
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40e504
jmp 0x401fa0
cmp eax, 0x14cf
jne 0x40e4a5
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x40e504
jmp 0x419520
cmp eax, 0x14d0
jne 0x40e4b1
jmp fcn.0040b250
cmp eax, 0x14d1
jne 0x40e4bd
jmp 0x40a870
cmp eax, 0x14d2
jne 0x40e4cd
mov dword [esp + 4], eax
jmp 0x417010
cmp eax, 0x14d3
jne 0x40e4e3
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x40e504
jmp 0x401680
cmp eax, 0x14d5
jne 0x40e504
call fcn.0040dfd0
test eax, eax
jne 0x40e504
mov eax, dword [0x4920b0]
push 0x14d5
push eax
call dword [sym.imp.USER32.dll_KillTimer]
ret
push str.OnAutoDisplayConfigLogOnTimer_got_called_n
call fcn.0040a4a0
mov al, byte [0x49216c]
add esp, 4
test al, 2
je 0x416f35
mov eax, dword [esp + 4]
mov ecx, dword [0x4920b0]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer_should_not_be_called_by_Client_session_process
jmp fcn.0040a4a0
mov eax, dword [0x49215c]
test eax, eax
jne 0x416f5c
mov edx, dword [esp + 4]
mov eax, dword [0x4920b0]
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer:_g_bSessionsControlEnabled_is_false
jmp fcn.0040a4a0
mov eax, dword [0x49fcb0]
cmp eax, 0xffffffff
je 0x416feb
push 1
push eax
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x416f87
lea eax, [eax + eax*8]
shl eax, 5
add eax, 0x49fcbc
jmp 0x416f89
xor eax, eax
mov ecx, dword [0x492164]
push 1
push 0
push 0x11
push ecx
push eax
call fcn.00423640
add esp, 0x14
test eax, eax
jne 0x416fb8
call fcn.00409750
push eax
push str.OnAutoDisplayConfigLogOnTimer_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040a4a0
add esp, 8
jmp 0x416fdc
call fcn.00409750
push eax
push str.OnAutoDisplayConfigLogOnTimer_success_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040a4a0
mov edx, dword [esp + 0xc]
mov eax, dword [0x4920b0]
add esp, 8
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x4920b8]
test ecx, ecx
je 0x41700a
jmp fcn.004023c0
mov ecx, dword [esp + 4]
mov edx, dword [0x4920b0]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer:_active_client_session_id_is_invalide
jmp fcn.0040a4a0
ret
push str.OnAutoDisplayConfigNonLogOnTimer_got_called_n
call fcn.0040a4a0
mov eax, dword [0x4920d8]
add esp, 4
test eax, eax
je 0x41704e
test byte [0x49216c], 2
je 0x41704e
mov eax, dword [esp + 4]
mov ecx, dword [0x4920b0]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer_should_not_be_called_by_Client_session_process
jmp fcn.0040a4a0
mov eax, dword [0x49215c]
test eax, eax
jne 0x417075
mov edx, dword [esp + 4]
mov eax, dword [0x4920b0]
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer:_g_bSessionsControlEnabled_is_false
jmp fcn.0040a4a0
mov eax, dword [0x49fcb0]
cmp eax, 0xffffffff
je 0x4170f1
push 1
push eax
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x41709c
lea eax, [eax + eax*8]
shl eax, 5
add eax, 0x49fcbc
jmp 0x41709e
xor eax, eax
mov ecx, dword [0x492164]
push 1
push 0
push 0x3b
push ecx
push eax
call fcn.00423640
add esp, 0x14
test eax, eax
jne 0x4170cc
call fcn.00409750
push eax
push str.OnAutoDisplayConfigNonLogOnTimer_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040a4a0
add esp, 8
ret
call fcn.00409750
push eax
push str.OnAutoDisplayConfigNonLogOnTimer_success_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040a4a0
mov edx, dword [esp + 0xc]
mov eax, dword [0x4920b0]
add esp, 8
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
ret
mov ecx, dword [esp + 4]
mov edx, dword [0x4920b0]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer:_active_client_session_id_is_invalide
jmp fcn.0040a4a0
mov eax, dword [0x4920b0]
push 0x14cf
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x2a
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageA]
ret
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x422730
mov dword [esp + 0x14], 0
call fcn.00424010
add esp, 0x14
test eax, eax
je 0x42277c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x358]
cmp ecx, 0xffffffff
mov eax, 1
je 0x43ac14
push edi
push ecx
mov ecx, esi
call fcn.0043aa20
mov edi, eax
test edi, edi
je 0x43ac11
mov eax, dword [esi + 0x35c]
test eax, eax
mov dword [esi + 0x358], 0xffffffff
je 0x43ac11
mov dword [esi + 0x35c], 0
mov eax, dword [0x4920b0]
push 0x14d3
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [0x4920b0]
push 0x14cc
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x43adc0
jmp 0x422750
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0x354]
test eax, eax
mov ecx, 0x492a60
je 0x43b15b
call fcn.0042e4e0
test eax, eax
je 0x43b14f
lea ecx, [esi + 0x160]
call fcn.004010d0
test eax, eax
je 0x43b143
cmp eax, 1
jne 0x43b1dc
push 0
mov ecx, 0x492a60
call fcn.0042e4b0
mov dword [esi + 0x354], 0
pop esi
ret
push edi
mov edi, dword [0x49eaf4]
call fcn.0042e4e0
test eax, eax
je 0x43b186
push 5
push 0xffffffffffffffff
push edi
mov ecx, 0x492a60
call fcn.004304a0
push eax
lea ecx, [esi + 0x160]
call fcn.00401320
push 1
push edi
mov ecx, 0x492a60
call fcn.00430550
cmp eax, dword [0x49eaf0]
pop edi
jae 0x43b1b0
push 0
push 0
push eax
mov ecx, 0x492a60
call fcn.00430e50
cmp eax, 6
je 0x43b1dc
mov eax, dword [0x4910e8]
test dword [0x49151c], eax
je 0x43b1ca
push str.CLargeDesktop::bRemoveFromLargeDesktop_returns_TRUE
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x4920b0]
push 0x4d3
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
ret
mov eax, dword [0x4910e8]
test dword [0x49151c], eax
je 0x43b1fa
push str.OnPsudoLargeDesktopRSSupportTimer__remove_bRemoveFromPseudoLargeDesktop
call fcn.0040a4a0
add esp, 4
mov eax, dword [0x49eaf4]
push eax
mov ecx, 0x492a60
call fcn.004304a0
push eax
call fcn.00425e70
add esp, 4
test eax, eax
je 0x43b245
mov ecx, dword [0x4920b0]
push 0x14c9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x4910e8]
test dword [0x49151c], edx
je 0x43b25d
push str.bRemoveFromPsudoLargeDesktop_returns_TRUE__timer_was_killed
call fcn.0040a4a0
add esp, 4
ret
mov eax, dword [0x4910e8]
test dword [0x49151c], eax
je 0x43b25d
push str.FAILURE:_bRemoveFromPsudoLargeDesktop_returns_FALSE
call fcn.0040a4a0
pop ecx
ret