Function at 0x438938
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x58
push ebx
mov ebx, dword [esp + 0x60]
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
push edi
push ebx
push str.DeviceRemoved__s___u_...
xor ebp, ebp
push ebp
call fcn.00445f0b
add esp, 0x10
cmp dword [0x4fd5c0], ebp
je 0x43946e
cmp dword [0x4fb8d0], ebp
jne 0x43946e
cmp edi, ebp
jne 0x438982
push ebp
push ebx
call fcn.00444c5c
mov edi, eax
mov dword [esp + 0x70], edi
cmp edi, dword [0x507608]
jne 0x438990
mov dword [0x507608], ebp
cmp edi, ebp
je 0x4389a3
mov ecx, dword [0x4fd5c0]
push ebp
push edi
call fcn.00407353
jmp 0x4389b8
cmp ebx, ebp
je 0x4389be
cmp word [ebx], bp
je 0x4389be
mov ecx, dword [0x4fd5c0]
push ebx
call fcn.0040707c
mov esi, eax
cmp esi, ebp
jne 0x4389f3
cmp dword [0x493a6c], ebp
je 0x4389d9
push str._no_treenode_found____ignore
push 3
call fcn.00445f0b
pop ecx
pop ecx
jmp 0x43946e
push str._no_treenode_found____try_child_devices
push 3
call fcn.00445f0b
pop ecx
pop ecx
push edi
push ebx
call fcn.00435339
jmp 0x439471
push dword [esi + 0x81c]
push str.treenode_s
push 3
call fcn.00445f0b
xor eax, eax
inc eax
add esp, 0xc
mov dword [esi + 0xcdc], eax
cmp dword [0x4fd5f4], ebp
je 0x438a70
cmp dword [esi + 8], ebp
je 0x438a70
cmp dword [esi + 0xffc], ebp
jne 0x438a70
cmp dword [0x493a60], ebp
jne 0x438a33
cmp dword [esi + 0x10], eax
je 0x438a70
push edi
call fcn.00444abc
test eax, eax
je 0x438a70
push edi
call fcn.00443d7b
test eax, eax
jne 0x438a70
push dword [esi + 8]
push 9
push 0x110b
push dword [0x4fb1c8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x438a70
mov ecx, dword [esi + 0xd48]
cmp ecx, ebp
je 0x438a70
call fcn.00406d4e
mov edi, dword [esi + 0xfc0]
cmp edi, ebp
jne 0x438ac9
push str._treenode_found_but_has_no_deviceinfo
push 3
call fcn.00445f0b
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
pop ecx
pop ecx
push str.a5dcbf10_6530_11d2_901f_00c04fb951ed
push ebx
call esi
test eax, eax
jne 0x438ac2
push str.f18a0e88_c30c_11d0_8815_00a0c906bed8
push ebx
call esi
test eax, eax
jne 0x438ac2
push str.3abf6f2d_71c4_462a_8a92_1e6861e6af27
push ebx
call esi
test eax, eax
jne 0x438ac2
push str.ROOT_HUB
push ebx
call esi
test eax, eax
je 0x43946e
xor eax, eax
jmp 0x439471
push ebp
lea eax, [edi + 0x10]
push dword [eax]
lea ecx, [edi + 0x39e4]
push ecx
lea ebx, [edi + 0x39e0]
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_Status]
push dword [ebx]
mov ecx, dword [esp + 0x18]
push dword [ecx]
mov dword [esp + 0x18], eax
push eax
call fcn.00440f3c
mov ebx, dword [esp + 0x28]
push eax
push dword [ebx]
push str.CM_Get_DevNode_Status__u___cret_S_problem_u_status0x_08x
push 3
call fcn.00445f0b
add esp, 0x18
cmp dword [ebx], ebp
je 0x438b3f
cmp dword [esp + 0x70], ebp
jne 0x438b3f
push str.looks_like_a_just_uninstalled_device____fake_CR_NO_SUCH_DEVINST__CM_PROB_PHANTOM
push 3
call fcn.00445f0b
mov ebx, dword [esp + 0x1c]
pop ecx
pop ecx
mov dword [esp + 0x10], 0xd
mov dword [ebx], 0x2d
jmp 0x438b43
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebp
cmp dword [esp + 0x10], ebp
jne 0x438bc4
cmp dword [ebx], ebp
jne 0x438b67
push str._device_is_present_again
push 3
call fcn.00445f0b
pop ecx
pop ecx
mov dword [esp + 0x1c], 1
push dword [ebx]
call fcn.0044515b
xor ebx, ebx
inc ebx
test eax, eax
je 0x438b89
push ebp
push 0x433830
push dword [esi + 8]
mov dword [esi + 0x1000], ebx
call fcn.0042ea62
cmp dword [edi + 0x3a28], ebp
je 0x438bb1
lea eax, [edi + 0x3a74]
mov ecx, dword [eax]
cmp ecx, ebp
je 0x438bb1
xor edx, edx
mov word [ecx + 0x930], dx
mov eax, dword [eax]
xor ecx, ecx
mov word [eax + 0x848], cx
push ebx
mov ecx, esi
mov dword [esi + 0xcdc], ebx
call fcn.0040a12e
jmp 0x438e00
mov dword [ebx], 0x2d
mov dword [edi + 8], ebp
cmp dword [0x4fb25c], ebp
jne 0x438c04
cmp dword [esi + 0x10], 6
jl 0x438be2
mov dword [esi + 0x10], 8
xor eax, eax
mov word [esi + 0x18], ax
mov word [esi + 0x41c], ax
mov word [esi + 0x860], ax
mov word [esi + 0xa5c], ax
mov word [esi + 0xdac], ax
cmp dword [edi + 0x3a28], ebp
je 0x438c25
cmp dword [edi + 0x3a74], ebp
je 0x438c25
mov eax, dword [0x4fd5c4]
push dword [esp + 0x6c]
mov ecx, dword [eax + 8]
call fcn.00405bf2
mov ecx, dword [edi + 0x24]
cmp ecx, ebp
je 0x438c34
push edi
call fcn.004010e0
jmp 0x438c3b
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x828]
cmp eax, ebp
je 0x438cf1
mov ecx, 0x200
cmp eax, ecx
jb 0x438c54
mov eax, ecx
dec eax
cmp eax, ebp
mov dword [esp + 0x6c], eax
jl 0x438cf1
lea eax, [edi + eax*4 + 0x28]
mov dword [esp + 0x18], eax
cmp dword [0x507a24], 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
jl 0x438c9c
lea eax, [ebx + 0xc2c]
push eax
push dword [ebx + 8]
lea eax, [ebx + 0xe34]
push eax
push dword [esp + 0x78]
push str.Child__i___s_present_i_devpath_s
push 4
call fcn.00445f0b
add esp, 0x18
cmp dword [ebx + 8], ebp
je 0x438cde
lea eax, [ebx + 0xc2c]
mov dword [esp + 0x24], eax
cmp word [eax], bp
jne 0x438cde
push dword [ebx + 0x10]
call fcn.00444955
test eax, eax
jne 0x438cde
lea eax, [ebx + 0xe34]
push eax
push str.fake_removal_event_for_child_device_without_interface:__s
push 4
call fcn.00445f0b
add esp, 0xc
push dword [ebx + 0x10]
push dword [esp + 0x28]
call fcn.00438938
dec dword [esp + 0x6c]
sub dword [esp + 0x18], 4
cmp dword [esp + 0x6c], ebp
jge 0x438c69
mov eax, dword [esi + 0xfcc]
cmp eax, ebp
je 0x438d7a
mov ecx, dword [0x4fd5c4]
push eax
call fcn.004011ae
test eax, eax
jne 0x438d28
lea eax, [esi + 0x41c]
push eax
push dword [esi + 0xfcc]
push str.pTNI__pDeviceInfoParent0x_08Ix_is_invalid__pTNI_s
push ebp
call fcn.00445f0b
add esp, 0x10
jmp 0x438d7a
mov eax, dword [esi + 0xfcc]
cmp word [eax + 0xc2c], bp
jne 0x438d7a
cmp dword [eax + 8], ebp
je 0x438d7a
push dword [eax + 0x10]
call fcn.00444955
test eax, eax
jne 0x438d7a
mov eax, dword [esi + 0xfcc]
lea ecx, [eax + 0xe34]
push ecx
push dword [eax + 0x10]
push str.calling_DeviceRemoved_for__u___s__because_parent_device_without_an_interface
push 4
call fcn.00445f0b
mov eax, dword [esi + 0xfcc]
add esp, 0x10
push dword [eax + 0x10]
push 0x44ad64
call fcn.00438938
cmp dword [edi + 0x828], ebp
mov dword [esp + 0x18], ebp
jle 0x438e00
lea eax, [edi + 0x28]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax]
mov ecx, dword [0x4fd5c4]
push ebx
call fcn.004011ae
test eax, eax
je 0x438deb
cmp word [ebx + 0xc2c], bp
jne 0x438deb
cmp dword [ebx + 8], ebp
je 0x438deb
cmp dword [ebx + 0x39e4], ebp
jne 0x438deb
push dword [ebx + 0x10]
call fcn.00444a0a
test eax, eax
jne 0x438deb
lea eax, [ebx + 0xe34]
push eax
push dword [ebx + 0x10]
push str.calling_DeviceRemoved_for__u___s__because_child_device_without_an_interface
push 4
call fcn.00445f0b
add esp, 0x10
push dword [ebx + 0x10]
push 0x44ad64
call fcn.00438938
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add dword [esp + 0x6c], 4
cmp eax, dword [edi + 0x828]
jl 0x438d8d
mov eax, dword [0x4fb260]
mov ecx, dword [0x4fb25c]
add eax, ecx
je 0x438ec4
mov dword [esi + 0xfe0], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.set_JustArrivedRemovedJUST_REMOVED_ArrivalRemovalT_u
push 4
mov dword [esi + 0xfdc], eax
call fcn.00445f0b
add esp, 0xc
mov ecx, esi
call fcn.0040a0c7
cmp dword [0x507a24], 4
mov ebx, fcn.00434579
jl 0x438e74
push dword [esi + 0x81c]
push dword [esi + 8]
push ebx
push dword [0x4fb25c]
push esi
push dword [0x4fb1c0]
push str.SetTimer_0x_08Ix__0x_08Ix___u__0x_08Ix_EndOfTreeNodeHighlight_TimerProc___hTreeItem0x_08Ix___s
push 4
call fcn.00445f0b
add esp, 0x20
push ebx
push dword [0x4fb25c]
push esi
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4fb268], ebp
je 0x438edc
push dword [esi + 8]
call fcn.0042fc44
test eax, eax
je 0x438edc
cmp dword [esi + 0x10], 1
jne 0x438ead
mov ecx, esi
call fcn.00406e3a
test eax, eax
je 0x438edc
push dword [esi + 8]
push ebp
push 0x1114
push dword [0x4fb1c8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x438edc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push 0x113
push dword [0x4fb1c0]
call fcn.00434579
cmp dword [esp + 0x1c], ebp
jne 0x43946e
mov ecx, esi
call fcn.0040bf92
cmp dword [edi + 0x3a2c], ebp
je 0x438f05
xor eax, eax
or dword [edi + 0x3a20], 0xffffffff
mov word [edi + 0x3a34], ax
mov dword [edi + 0x3a78], ebp
mov ecx, dword [0x4fd5c4]
push edi
call fcn.004047f1
push 0x46c9d0
push ebp
push 0x7f8a
call fcn.0042ee26
xor ecx, ecx
cmp dword [edi + 0x828], ebp
jle 0x438f57
lea eax, [edi + 0x28]
cmp dword [eax], ebp
je 0x438f4b
mov edx, dword [eax]
mov ebx, dword [esp + 0x14]
mov dword [edx + 8], ebp
mov edx, dword [eax]
mov ebx, dword [ebx]
mov dword [edx + 0x39e4], ebx
inc ecx
add eax, 4
cmp ecx, dword [edi + 0x828]
jl 0x438f34
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], ebp
cmp dword [esi + 0xfac], ebp
je 0x438fb9
mov eax, dword [esi + 0xfb0]
cmp eax, ebp
je 0x438fb9
mov eax, dword [eax + 0x40]
cmp eax, ebp
je 0x438fb9
mov dword [esp + 0x6c], ebp
jle 0x438fae
push 0x30
pop ebx
mov eax, dword [esi + 0xfb0]
mov eax, dword [ebx + eax]
cmp eax, ebp
je 0x438f98
mov ecx, dword [0x4fd5c0]
push eax
call fcn.00407717
inc dword [esp + 0x6c]
mov eax, dword [esi + 0xfb0]
mov ecx, dword [esp + 0x6c]
add ebx, 4
cmp ecx, dword [eax + 0x40]
jl 0x438f7f
mov ecx, dword [0x4fd5c0]
call fcn.004089c5
mov eax, dword [esi + 0xfb4]
cmp eax, ebp
je 0x439037
mov eax, dword [eax + 0x10c]
cmp eax, ebp
je 0x438fea
mov ebx, dword [eax]
push eax
mov dword [eax], ebp
call fcn.0043ffc9
pop ecx
mov eax, ebx
cmp ebx, ebp
jne 0x438fcd
mov eax, dword [esi + 0xfb4]
mov dword [eax + 0x10c], ebp
cmp dword [edi + 8], ebp
jne 0x439037
lea ebx, [esi + 0x1004]
mov eax, dword [ebx]
mov dword [esp + 0x6c], ebp
cmp eax, ebp
je 0x439019
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebx]
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], ebp
cmp dword [esp + 0x10], ebp
je 0x439037
cmp dword [esp + 0x6c], ebp
jne 0x439031
push ebp
push dword [esi + 0xfb4]
call fcn.004439a6
mov dword [esi + 0xfb4], ebp
cmp dword [esi + 0xfac], ebp
je 0x4390ff
cmp dword [esp + 0x10], ebp
jne 0x439057
push 1
mov ecx, esi
call fcn.0040a12e
jmp 0x439464
mov eax, dword [esi + 0xd48]
cmp eax, ebp
je 0x4390a2
add eax, 0xcf6
cmp word [eax], bp
push eax
mov eax, dword [esi + 0xfc0]
je 0x43907f
add eax, 0x1834
push eax
push str._s_removed_from_port__s
jmp 0x43908a
add eax, 0x1834
push eax
push str._s_removed
push dword [0x493a50]
push 1
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x18
jmp 0x4390bd
push str.Device_removed
push dword [0x493a50]
push 1
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x10
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fd5c4]
call fcn.00404183
mov esi, dword [esi + 0xfb0]
cmp esi, ebp
je 0x4390e5
mov esi, dword [esi + 0x10]
cmp esi, ebp
je 0x4390e5
mov dword [esi + 0x1f], ebp
call fcn.0042e6a9
call fcn.004328ed
call fcn.00435a53
push ebp
call fcn.0042e837
jmp 0x439464
mov eax, dword [esi + 0xd48]
cmp eax, ebp
je 0x439353
cmp dword [esi + 0xfcc], ebp
je 0x439353
cmp dword [eax + 0xfac], ebp
je 0x439353
push 0x42e154
push 0xa
push 0x12340003
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_SetTimer]
xor ebx, ebx
inc ebx
cmp edi, dword [esi + 0xfc0]
je 0x43916e
push str.DeviceRemoved
push 0x1e44
push str..UsbTreeView.cpp
push str.INT3_in__S_line__u__function__S
push ebx
call fcn.00445f0b
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
int3
cmp dword [esp + 0x10], ebp
jne 0x439218
push ebx
mov ecx, esi
call fcn.0040a12e
mov edi, dword [esp + 0x14]
push dword [edi]
call fcn.0044515b
test eax, eax
je 0x4391a9
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_prepared_for_safe_removal_from_port__s
jmp 0x4391c6
cmp dword [edi], 0x16
jne 0x4391e0
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_disabled_at_port__s
push dword [0x493a50]
push ebx
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x18
jmp 0x4392c0
mov eax, dword [esi + 0xfc0]
lea ecx, [esi + 0xcf6]
push ecx
push dword [eax + 0x39e4]
add eax, 0x1834
push eax
push str._s_got_problem__u_at_port__s
push dword [0x493a50]
push ebx
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x1c
jmp 0x4392c0
mov dword [esi + 0x10], 8
cmp dword [0x4fb25c], ebp
je 0x43922f
mov dword [esi + 0xfe8], ebx
jmp 0x439241
cmp dword [0x4fb260], ebp
je 0x439241
mov dword [esi + 0xfe8], 2
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_removed_from_port__s
push dword [0x493a50]
push ebx
push dword [0x4fb8f0]
call fcn.00405677
mov eax, dword [esi + 0xfb0]
add esp, 0x18
cmp eax, ebp
je 0x439282
mov eax, dword [eax + 0x10]
cmp eax, ebp
je 0x439282
mov dword [eax + 0x1f], ebp
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fd5c4]
call fcn.00404183
push dword [esi + 8]
push dword [0x4fb1c8]
call fcn.00425985
mov eax, dword [0x4fb8e4]
cmp dword [esi + 8], eax
jne 0x4392c0
push eax
push dword [0x4fb1c8]
push dword [0x4fb1cc]
call fcn.00414562
mov eax, dword [esi + 0xfcc]
cmp eax, ebp
je 0x439431
cmp dword [eax], 1
jne 0x439431
add eax, 0xc2c
push eax
call fcn.0042972f
test eax, eax
je 0x439431
mov eax, dword [esi + 0xfcc]
push ebp
push ebp
push 3
push ebp
push 3
push 0x80000000
add eax, 0xc2c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439431
mov eax, dword [esi + 0xd48]
mov ecx, dword [0x4fd5c0]
push esi
push dword [eax + 0xfac]
push edi
call fcn.0040aa66
push dword [esi + 0xd48]
mov ecx, dword [0x4fd5c0]
push esi
call fcn.004080ab
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebp
push esi
call fcn.004336b6
jmp 0x439431
cmp dword [esi + 0x10], 1
jne 0x439398
xor edi, edi
inc edi
push edi
mov ecx, esi
mov dword [esi + 0xcdc], edi
call fcn.0040a12e
mov ecx, dword [0x4fd5c0]
push edi
push dword [esp + 0x74]
call fcn.00407353
cmp eax, ebp
je 0x439431
xor ecx, ecx
inc ecx
mov dword [eax + 0xcdc], ecx
push ecx
mov ecx, eax
call fcn.0040a12e
jmp 0x439431
mov ecx, str.removed
cmp dword [esp + 0x10], ebp
jne 0x4393e2
mov ebx, dword [esp + 0x14]
push dword [ebx]
call fcn.004408bb
push eax
lea eax, [esp + 0x2c]
push str.got_problem__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebx]
add esp, 0xc
sub eax, 0x15
lea ecx, [esp + 0x28]
je 0x4393dd
dec eax
je 0x43947b
dec eax
dec eax
je 0x4393dd
sub eax, 0x17
jne 0x4393e2
mov ecx, str.prepared_for_safe_removal
mov eax, dword [esi + 0xfc0]
push ecx
add eax, 0x1934
push eax
push str._s__S
push dword [0x493a50]
push 1
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x18
cmp dword [edi + 8], ebp
jne 0x439431
push dword [esi + 8]
push dword [0x4fb1c8]
call fcn.0042fc5c
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fd5c4]
call fcn.00404183
mov eax, dword [esp + 0x20]
push 0x42e448
push 0x64
push dword [eax]
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0042e6a9
call fcn.004328ed
call fcn.00435a53
push ebp
call fcn.0042e837
call fcn.00432679
push 0xc8
call fcn.00432583
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 8
mov ecx, str.disabled
jmp 0x4393e2