Function at 0x43813b
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x58
push ebx
mov ebx, dword [esp + 0x60]
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
push edi
push ebx
push str.DeviceRemoved__s___u_...
xor ebp, ebp
push ebp
call fcn.004453fb
add esp, 0x10
cmp dword [0x4fc540], ebp
je 0x438bd6
cmp dword [0x4fa850], ebp
jne 0x438bd6
cmp edi, ebp
jne 0x438185
push ebp
push ebx
call fcn.0044429d
mov edi, eax
mov dword [esp + 0x70], edi
cmp edi, dword [0x506588]
jne 0x438193
mov dword [0x506588], ebp
cmp edi, ebp
je 0x4381a6
mov ecx, dword [0x4fc540]
push ebp
push edi
call fcn.004072a3
jmp 0x4381bb
cmp ebx, ebp
je 0x4381c1
cmp word [ebx], bp
je 0x4381c1
mov ecx, dword [0x4fc540]
push ebx
call fcn.00406fde
mov esi, eax
cmp esi, ebp
jne 0x4381f6
cmp dword [0x492a60], ebp
je 0x4381dc
push str._no_treenode_found____ignore
push 3
call fcn.004453fb
pop ecx
pop ecx
jmp 0x438bd6
push str._no_treenode_found____try_child_devices
push 3
call fcn.004453fb
pop ecx
pop ecx
push edi
push ebx
call fcn.00434c93
jmp 0x438bd9
push dword [esi + 0x81c]
push str.treenode_s
push 3
call fcn.004453fb
xor eax, eax
inc eax
add esp, 0xc
mov dword [esi + 0xcdc], eax
cmp dword [0x4fc574], ebp
je 0x438273
cmp dword [esi + 8], ebp
je 0x438273
cmp dword [esi + 0xff8], ebp
jne 0x438273
cmp dword [0x492a54], ebp
jne 0x438236
cmp dword [esi + 0x10], eax
je 0x438273
push edi
call fcn.004440fd
test eax, eax
je 0x438273
push edi
call fcn.0044346e
test eax, eax
jne 0x438273
push dword [esi + 8]
push 9
push 0x110b
push dword [0x4fa148]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x438273
mov ecx, dword [esi + 0xd48]
cmp ecx, ebp
je 0x438273
call fcn.00406cb0
mov edi, dword [esi + 0xfc0]
cmp edi, ebp
jne 0x4382cc
push str._treenode_found_but_has_no_deviceinfo
push 3
call fcn.004453fb
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
pop ecx
pop ecx
push str.a5dcbf10_6530_11d2_901f_00c04fb951ed
push ebx
call esi
test eax, eax
jne 0x4382c5
push str.f18a0e88_c30c_11d0_8815_00a0c906bed8
push ebx
call esi
test eax, eax
jne 0x4382c5
push str.3abf6f2d_71c4_462a_8a92_1e6861e6af27
push ebx
call esi
test eax, eax
jne 0x4382c5
push str.ROOT_HUB
push ebx
call esi
test eax, eax
je 0x438bd6
xor eax, eax
jmp 0x438bd9
push ebp
lea eax, [edi + 0x10]
push dword [eax]
lea ecx, [edi + 0x39e4]
push ecx
lea ebx, [edi + 0x39e0]
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_Status]
push dword [ebx]
mov ecx, dword [esp + 0x18]
push dword [ecx]
mov dword [esp + 0x18], eax
push eax
call fcn.00440629
mov ebx, dword [esp + 0x28]
push eax
push dword [ebx]
push str.CM_Get_DevNode_Status__u___cret_S_problem_u_status0x_08x
push 3
call fcn.004453fb
add esp, 0x18
cmp dword [ebx], ebp
je 0x438342
cmp dword [esp + 0x70], ebp
jne 0x438342
push str.looks_like_a_just_uninstalled_device____fake_CR_NO_SUCH_DEVINST__CM_PROB_PHANTOM
push 3
call fcn.004453fb
mov ebx, dword [esp + 0x1c]
pop ecx
pop ecx
mov dword [esp + 0x10], 0xd
mov dword [ebx], 0x2d
jmp 0x438346
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebp
cmp dword [esp + 0x10], ebp
jne 0x4383c7
cmp dword [ebx], ebp
jne 0x43836a
push str._device_is_present_again
push 3
call fcn.004453fb
pop ecx
pop ecx
mov dword [esp + 0x1c], 1
push dword [ebx]
call fcn.0044479c
xor ebx, ebx
inc ebx
test eax, eax
je 0x43838c
push ebp
push 0x43327a
push dword [esi + 8]
mov dword [esi + 0xffc], ebx
call fcn.0042e731
cmp dword [edi + 0x3a28], ebp
je 0x4383b4
lea eax, [edi + 0x3a74]
mov ecx, dword [eax]
cmp ecx, ebp
je 0x4383b4
xor edx, edx
mov word [ecx + 0x930], dx
mov eax, dword [eax]
xor ecx, ecx
mov word [eax + 0x848], cx
push ebx
mov ecx, esi
mov dword [esi + 0xcdc], ebx
call fcn.00409ef4
jmp 0x438556
mov dword [ebx], 0x2d
mov dword [edi + 8], ebp
cmp dword [esi + 0x10], 6
jl 0x4383dd
mov dword [esi + 0x10], 8
xor eax, eax
mov word [esi + 0x18], ax
mov word [esi + 0x41c], ax
mov word [esi + 0x860], ax
mov word [esi + 0xa5c], ax
mov word [esi + 0xdac], ax
cmp dword [edi + 0x3a28], ebp
je 0x438420
cmp dword [edi + 0x3a74], ebp
je 0x438420
mov eax, dword [0x4fc544]
push dword [esp + 0x6c]
mov ecx, dword [eax + 8]
call fcn.00405b5f
mov ecx, dword [edi + 0x24]
cmp ecx, ebp
je 0x43842f
push edi
call fcn.004010e0
jmp 0x438436
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x828]
cmp eax, ebp
je 0x4384ec
mov ecx, 0x200
cmp eax, ecx
jb 0x43844f
mov eax, ecx
dec eax
cmp eax, ebp
mov dword [esp + 0x6c], eax
jl 0x4384ec
lea eax, [edi + eax*4 + 0x28]
mov dword [esp + 0x18], eax
cmp dword [0x506bac], 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
jl 0x438497
lea eax, [ebx + 0xc2c]
push eax
push dword [ebx + 8]
lea eax, [ebx + 0xe34]
push eax
push dword [esp + 0x78]
push str.Child__i___s_present_i_devpath_s
push 4
call fcn.004453fb
add esp, 0x18
cmp dword [ebx + 8], ebp
je 0x4384d9
lea eax, [ebx + 0xc2c]
mov dword [esp + 0x24], eax
cmp word [eax], bp
jne 0x4384d9
push dword [ebx + 0x10]
call fcn.00444048
test eax, eax
jne 0x4384d9
lea eax, [ebx + 0xe34]
push eax
push str.fake_removal_event_for_child_device_without_interface:__s
push 4
call fcn.004453fb
add esp, 0xc
push dword [ebx + 0x10]
push dword [esp + 0x28]
call fcn.0043813b
dec dword [esp + 0x6c]
sub dword [esp + 0x18], 4
cmp dword [esp + 0x6c], ebp
jge 0x438464
mov eax, dword [esi + 0xfcc]
cmp eax, ebp
je 0x438556
mov ecx, dword [0x4fc544]
push eax
call fcn.004011ae
test eax, eax
jne 0x438523
lea eax, [esi + 0x41c]
push eax
push dword [esi + 0xfcc]
push str.pTNI__pDeviceInfoParent0x_08Ix_is_invalid__pTNI_s
push ebp
call fcn.004453fb
add esp, 0x10
jmp 0x438556
mov eax, dword [esi + 0xfcc]
cmp word [eax + 0xc2c], bp
jne 0x438556
cmp dword [eax + 8], ebp
je 0x438556
push dword [eax + 0x10]
call fcn.00444048
test eax, eax
jne 0x438556
mov eax, dword [esi + 0xfcc]
push dword [eax + 0x10]
push 0x449d34
call fcn.0043813b
mov eax, dword [0x4fa1e0]
mov ecx, dword [0x4fa1dc]
add eax, ecx
je 0x43861a
mov dword [esi + 0xfe0], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.set_JustArrivedRemovedJUST_REMOVED_ArrivalRemovalT_u
push 4
mov dword [esi + 0xfdc], eax
call fcn.004453fb
add esp, 0xc
mov ecx, esi
call fcn.00409ea4
cmp dword [0x506bac], 4
mov ebx, fcn.00433f97
jl 0x4385ca
push dword [esi + 0x81c]
push dword [esi + 8]
push ebx
push dword [0x4fa1dc]
push esi
push dword [0x4fa140]
push str.SetTimer_0x_08Ix__0x_08Ix___u__0x_08Ix_EndOfTreeNodeHighlight_TimerProc___hTreeItem0x_08Ix___s
push 4
call fcn.004453fb
add esp, 0x20
push ebx
push dword [0x4fa1dc]
push esi
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4fa1e8], ebp
je 0x438632
push dword [esi + 8]
call fcn.0042f912
test eax, eax
je 0x438632
cmp dword [esi + 0x10], 1
jne 0x438603
mov ecx, esi
call fcn.00406d9c
test eax, eax
je 0x438632
push dword [esi + 8]
push ebp
push 0x1114
push dword [0x4fa148]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x438632
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
push 0x113
push dword [0x4fa140]
call fcn.00433f97
cmp dword [esp + 0x1c], ebp
jne 0x438bd6
mov ecx, esi
call fcn.0040bba7
cmp dword [edi + 0x3a2c], ebp
je 0x43865b
xor eax, eax
or dword [edi + 0x3a20], 0xffffffff
mov word [edi + 0x3a34], ax
mov dword [edi + 0x3a78], ebp
mov ecx, dword [0x4fc544]
push edi
call fcn.00404767
push 0x46b5ac
push ebp
push 0x7f8a
call fcn.0042eaf5
xor ecx, ecx
cmp dword [edi + 0x828], ebp
jle 0x4386ad
lea eax, [edi + 0x28]
cmp dword [eax], ebp
je 0x4386a1
mov edx, dword [eax]
mov ebx, dword [esp + 0x14]
mov dword [edx + 8], ebp
mov edx, dword [eax]
mov ebx, dword [ebx]
mov dword [edx + 0x39e4], ebx
inc ecx
add eax, 4
cmp ecx, dword [edi + 0x828]
jl 0x43868a
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], ebp
cmp dword [esi + 0xfac], ebp
je 0x43870f
mov eax, dword [esi + 0xfb0]
cmp eax, ebp
je 0x43870f
mov eax, dword [eax + 0x40]
cmp eax, ebp
je 0x43870f
mov dword [esp + 0x6c], ebp
jle 0x438704
push 0x30
pop ebx
mov eax, dword [esi + 0xfb0]
mov eax, dword [ebx + eax]
cmp eax, ebp
je 0x4386ee
mov ecx, dword [0x4fc540]
push eax
call fcn.004076ae
inc dword [esp + 0x6c]
mov eax, dword [esi + 0xfb0]
mov ecx, dword [esp + 0x6c]
add ebx, 4
cmp ecx, dword [eax + 0x40]
jl 0x4386d5
mov ecx, dword [0x4fc540]
call fcn.0040878e
mov eax, dword [esi + 0xfb4]
cmp eax, ebp
je 0x43879d
mov eax, dword [eax + 0x10c]
cmp eax, ebp
je 0x438744
mov ebx, dword [eax]
push eax
mov dword [eax], ebp
call fcn.0043f6b6
pop ecx
mov eax, ebx
cmp ebx, ebp
jne 0x438727
mov eax, dword [esi + 0xfb4]
mov dword [eax + 0x10c], ebp
cmp dword [edi + 8], ebp
jne 0x43879d
lea ebx, [esi + 0x1000]
mov eax, dword [ebx]
mov dword [esp + 0x6c], ebp
cmp eax, ebp
je 0x438773
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebx]
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], ebp
cmp dword [esp + 0x10], ebp
je 0x43879d
cmp dword [esp + 0x6c], ebp
jne 0x438797
mov ebx, dword [esi + 0xfb4]
cmp ebx, ebp
je 0x438797
mov ecx, ebx
call fcn.00406ab5
push ebx
call fcn.0043f6b6
pop ecx
mov dword [esi + 0xfb4], ebp
cmp dword [esi + 0xfac], ebp
je 0x438865
cmp dword [esp + 0x10], ebp
jne 0x4387bd
push 1
mov ecx, esi
call fcn.00409ef4
jmp 0x438bcc
mov eax, dword [esi + 0xd48]
cmp eax, ebp
je 0x438808
add eax, 0xcf6
cmp word [eax], bp
push eax
mov eax, dword [esi + 0xfc0]
je 0x4387e5
add eax, 0x1834
push eax
push str._s_removed_from_port__s
jmp 0x4387f0
add eax, 0x1834
push eax
push str._s_removed
push dword [0x492a44]
push 1
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x18
jmp 0x438823
push str.Device_removed
push dword [0x492a44]
push 1
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x10
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fc544]
call fcn.00404122
mov esi, dword [esi + 0xfb0]
cmp esi, ebp
je 0x43884b
mov esi, dword [esi + 0x10]
cmp esi, ebp
je 0x43884b
mov dword [esi + 0x1f], ebp
call fcn.0042e378
call fcn.00432320
call fcn.004353ad
push ebp
call fcn.0042e506
jmp 0x438bcc
mov eax, dword [esi + 0xd48]
cmp eax, ebp
je 0x438abb
cmp dword [esi + 0xfcc], ebp
je 0x438abb
cmp dword [eax + 0xfac], ebp
je 0x438abb
push 0x42dd12
push 0xa
push 0x12340003
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_SetTimer]
cmp edi, dword [esi + 0xfc0]
je 0x4388d2
push str.DeviceRemoved
push 0x1d87
push str..UsbTreeView.cpp
push str.INT3_in__S_line__u__function__S
push 1
call fcn.004453fb
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
int3
cmp dword [esp + 0x10], ebp
jne 0x43897f
xor ebx, ebx
inc ebx
push ebx
mov ecx, esi
call fcn.00409ef4
mov edi, dword [esp + 0x14]
push dword [edi]
call fcn.0044479c
test eax, eax
je 0x438910
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_prepared_for_safe_removal_from_port__s
jmp 0x43892d
cmp dword [edi], 0x16
jne 0x438947
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_disabled_at_port__s
push dword [0x492a44]
push ebx
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x18
jmp 0x438a28
mov eax, dword [esi + 0xfc0]
lea ecx, [esi + 0xcf6]
push ecx
push dword [eax + 0x39e4]
add eax, 0x1834
push eax
push str._s_got_problem__u_at_port__s
push dword [0x492a44]
push ebx
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x1c
jmp 0x438a28
xor eax, eax
mov word [esi + 0x18], ax
mov word [esi + 0x41c], ax
mov word [esi + 0x860], ax
mov word [esi + 0xa5c], ax
mov word [esi + 0xdac], ax
lea eax, [esi + 0xcf6]
push eax
mov eax, dword [esi + 0xfc0]
add eax, 0x1834
push eax
push str._s_removed_from_port__s
mov dword [esi + 0x10], 8
push dword [0x492a44]
push 1
push dword [0x4fa870]
call fcn.004055ed
mov eax, dword [esi + 0xfb0]
add esp, 0x18
cmp eax, ebp
je 0x4389ea
mov eax, dword [eax + 0x10]
cmp eax, ebp
je 0x4389ea
mov dword [eax + 0x1f], ebp
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fc544]
call fcn.00404122
push dword [esi + 8]
push dword [0x4fa148]
call fcn.00425611
mov eax, dword [0x4fa864]
cmp dword [esi + 8], eax
jne 0x438a28
push eax
push dword [0x4fa148]
push dword [0x4fa14c]
call fcn.004141cd
mov eax, dword [esi + 0xfcc]
cmp eax, ebp
je 0x438b99
cmp dword [eax], 1
jne 0x438b99
add eax, 0xc2c
push eax
call fcn.004293bb
test eax, eax
je 0x438b99
mov eax, dword [esi + 0xfcc]
push ebp
push ebp
push 3
push ebp
push 3
push 0x80000000
add eax, 0xc2c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x438b99
mov eax, dword [esi + 0xd48]
mov ecx, dword [0x4fc540]
push esi
push dword [eax + 0xfac]
push edi
call fcn.0040a6f0
push dword [esi + 0xd48]
mov ecx, dword [0x4fc540]
push esi
call fcn.00408042
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebp
push esi
call fcn.004330e9
jmp 0x438b99
cmp dword [esi + 0x10], 1
jne 0x438b00
xor edi, edi
inc edi
push edi
mov ecx, esi
mov dword [esi + 0xcdc], edi
call fcn.00409ef4
mov ecx, dword [0x4fc540]
push edi
push dword [esp + 0x74]
call fcn.004072a3
cmp eax, ebp
je 0x438b99
xor ecx, ecx
inc ecx
mov dword [eax + 0xcdc], ecx
push ecx
mov ecx, eax
call fcn.00409ef4
jmp 0x438b99
mov ecx, str.removed
cmp dword [esp + 0x10], ebp
jne 0x438b4a
mov ebx, dword [esp + 0x14]
push dword [ebx]
call fcn.0043ffa8
push eax
lea eax, [esp + 0x2c]
push str.got_problem__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebx]
add esp, 0xc
sub eax, 0x15
lea ecx, [esp + 0x28]
je 0x438b45
dec eax
je 0x438be3
dec eax
dec eax
je 0x438b45
sub eax, 0x17
jne 0x438b4a
mov ecx, str.prepared_for_safe_removal
mov eax, dword [esi + 0xfc0]
push ecx
add eax, 0x1934
push eax
push str._s__S
push dword [0x492a44]
push 1
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x18
cmp dword [edi + 8], ebp
jne 0x438b99
push dword [esi + 8]
push dword [0x4fa148]
call fcn.0042f92a
mov dword [esi + 0xfc0], ebp
push dword [edi + 4]
mov ecx, dword [0x4fc544]
call fcn.00404122
mov eax, dword [esp + 0x20]
push 0x42e117
push 0x64
push dword [eax]
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0042e378
call fcn.00432320
call fcn.004353ad
push ebp
call fcn.0042e506
call fcn.004320cf
push 0xc8
call fcn.00431fd9
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 8
mov ecx, str.disabled
jmp 0x438b4a