Function at 0x409b50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x44b004]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsA]
mov edi, 0x44cf80
mov dword [0x44cf68], 0
mov esi, 0x44cf58
mov dword [0x44cf58], 0
mov dword [0x44cf70], 1
mov dword [0x44cf74], 0
mov dword [0x44cf80], 0x445b38
mov dword [0x44b8ac], 0x44cf58
mov ecx, dword [edi]
lea eax, [esi + 8]
push eax
push 0
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ecx
push eax
push 1
push ecx
push esi
mov dword [esp + 0x3c], 0
lea edi, [edi + 4]
push 0x404580
mov dword [esi + 0x20], ecx
call ebx
mov esi, dword [esi]
test esi, esi
jne 0x409bb7
xor edi, edi
push 6
push edi
push edi
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x409d2c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x50], 0x1c
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x50]
push eax
push ecx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x409cf2
lea eax, [esp + 0x18]
xor edi, edi
push eax
push edi
push edi
lea eax, [esp + 0x58]
mov dword [esp + 0x24], edi
push eax
push 1
lea eax, [esp + 0x64]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x409cdd
nop
call ebx
cmp eax, 0x7a
jne 0x409c96
push dword [esp + 0x18]
call fcn.0041556b
add esp, 4
mov edi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x54]
push edi
push eax
push 1
lea eax, [esp + 0x64]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x409c60
test edi, edi
je 0x409cdd
cmp byte [edi], 0
mov esi, edi
je 0x409cd0
push esi
push str.ACPIASUS1000
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x409cc8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409cb6
sub eax, edx
inc esi
add esi, eax
cmp byte [esi], cl
jne 0x409ca1
jmp 0x409cd0
mov dword [esp + 0x14], 1
push edi
call fcn.004152d1
mov esi, dword [esp + 0x20]
add esp, 4
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x10], ecx
test edi, edi
je 0x409c21
call ebx
test eax, eax
je 0x409cfa
call ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test edi, edi
je 0x409d2c
push str._DevAct__ServiceProc___exit_because_MyASUS_is_exist
call fcn.00404620
add esp, 4
push str._DevAct__ServiceProc___set_service_start_type_to_demand_start
call fcn.00404620
mov ebx, dword [esp + 0x10]
mov ecx, ebx
call fcn.00401360
jmp 0x409ea1
call fcn.004088c0
test al, al
je 0x409e9d
push 0x7f00
push 0
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 0x4097c0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x44], 6
mov dword [esp + 0x48], str.91a1a1ee_f634_49a5_9f23_dd9e3dc31f65
mov dword [esp + 0x4c], str.91a1a1ee_f634_49a5_9f23_dd9e3dc31f65
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x409e90
push 0
push 0
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push str.91a1a1ee_f634_49a5_9f23_dd9e3dc31f65
push str.91a1a1ee_f634_49a5_9f23_dd9e3dc31f65
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x409e90
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0xea60
push 0x413
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0xc]
cmp byte [eax + 0x10], 0
jne 0x409e87
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
nop dword [eax]
cmp byte [0x44cf42], 0
jne 0x409e83
push 1
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
je 0x409e71
nop dword [eax]
lea eax, [esp + 0x50]
push eax
call edi
lea eax, [esp + 0x50]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
jne 0x409e50
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
cmp byte [eax + 0x10], 0
je 0x409e30
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x409e9d
push str._DevAct__ServiceProc___cannot_create_invisible_window
call fcn.00404620
add esp, 4
mov ebx, dword [esp + 0xc]
cmp byte [0x44cf42], 0
je 0x409ebb
push str._DevAct__ServiceProc___set_service_start_type_to_demand_start
call fcn.00404620
mov ecx, ebx
call fcn.00401360
mov esi, dword [0x44b8ac]
cmp esi, 0x44b8ac
je 0x409f01
test esi, esi
je 0x409ef7
mov edi, dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
je 0x409ef1
push ecx
push edx
call edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov esi, dword [esi]
test esi, esi
jne 0x409ed3
mov dword [0x44b8ac], 0x44b8ac
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041525a
mov esp, ebp
pop ebp
ret