Function at 0x40e9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
jne 0x40169d
xor eax, eax
ret
jmp 0x43a1c0
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
je 0x40178f
jmp 0x43a710
ret
mov ecx, dword [ecx + 0x12c]
test ecx, ecx
je 0x40179f
jmp 0x43a7e0
ret
sub esp, 8
push edi
mov edi, ecx
call fcn.0044e940
test eax, eax
je 0x401f77
mov eax, dword [0x491074]
test eax, eax
jne 0x401f77
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.004232e0
add esp, 4
test eax, eax
je 0x401fa3
mov eax, dword [esp + 4]
test eax, eax
jne 0x401fa3
mov ecx, dword [0x4910b0]
push 0x14ce
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x4929e0]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x401ea0
mov dword [esp + 0x1c], 0
call fcn.00423c00
add esp, 0x14
test eax, eax
jne 0x401f6b
mov ecx, dword [0x4900e8]
test dword [edi + 0x138], ecx
je 0x401fa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HotPlugProcessThread_creation_failed._err_d
call fcn.0040aab0
add esp, 8
pop edi
add esp, 8
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
add esp, 8
ret
mov edx, dword [0x4900e8]
test dword [edi + 0x138], edx
je 0x401f92
push str.OnHotplugRetryTimer._session_not_active_or_g_ulPnpTrigger._EXIT
call fcn.0040aab0
add esp, 4
mov eax, dword [0x4910b0]
push 0x14ce
push eax
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
add esp, 8
ret
mov eax, ecx
mov ecx, dword [eax + 0x12c]
test ecx, ecx
je 0x401fc1
jmp 0x43a3a0
mov ecx, dword [0x4900e8]
test dword [eax + 0x138], ecx
je 0x401fda
push str.CATIExtEvent::OnADCPendingRequestTimer:_ERROR_m_pDriverMessage_is_NULL
call fcn.0040aab0
pop ecx
ret
mov eax, dword [0x4900e8]
test eax, eax
je 0x40ae96
push str.OnSwitchingModeTimer_for_RefreshDisplaySettings
call fcn.0040aab0
add esp, 4
push esi
push edi
mov edi, 1
xor esi, esi
nop
mov ecx, dword [0x4910b8]
push esi
call fcn.004020a0
cmp eax, 0xffffffff
je 0x40aed1
mov ecx, dword [0x4910b8]
push eax
call fcn.004020e0
test eax, eax
je 0x40aecf
mov ecx, dword [0x4910b8]
push esi
call fcn.00402040
jmp 0x40aed1
xor edi, edi
inc esi
cmp esi, 5
jb 0x40aea0
test edi, edi
pop edi
pop esi
je 0x40af02
mov eax, dword [0x4910b0]
push 0x14d1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x4900e8]
test eax, eax
je 0x40af02
push str.OnSwitchingModeTimer_RefreshDisplaySettings_returns_TRUE__timer_was_killed
call fcn.0040aab0
pop ecx
ret
call fcn.0044e940
test eax, eax
je 0x40ba12
mov eax, dword [0x4900e8]
test eax, eax
je 0x40b9bf
push str.OnQuerySessionTimer:_Session_Active_detected
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x4910d8]
test ecx, ecx
je 0x40b9f6
mov eax, dword [0x492b40]
push 0
push 0
push 1
push 2
push eax
call fcn.00421890
test eax, eax
jne 0x40b9f6
mov eax, dword [0x4900e8]
test eax, eax
je 0x40b9f6
push str.OnQuerySessionTimer.__g_aAutoDisplay.Apply_failed
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x4910b0]
push 0x14cb
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x4910dc], 0
ret
mov eax, dword [esp + 4]
cmp eax, 0x4d2
jne 0x40e9eb
mov eax, dword [0x4910b4]
test eax, eax
je 0x40eaf4
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40eaf4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret
cmp eax, 0x4d3
jne 0x40ea05
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x40eaf4
jmp 0x401780
cmp eax, 0x14c9
jne 0x40ea1f
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x40eaf4
jmp 0x401790
cmp eax, 0x4d4
jne 0x40ea33
mov dword [esp + 4], 1
jmp fcn.0040bd80
cmp eax, 0x14ca
jne 0x40ea43
mov dword [esp + 4], eax
jmp 0x416e70
cmp eax, 0x14cb
jne 0x40ea4f
jmp 0x40b9a0
cmp eax, 0x14ce
jne 0x40ea69
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x40eaf4
jmp 0x401ec0
cmp eax, 0x14cc
jne 0x40ea7f
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x40eaf4
jmp 0x401fb0
cmp eax, 0x14cf
jne 0x40ea95
mov ecx, dword [0x4910d8]
test ecx, ecx
je 0x40eaf4
jmp 0x419460
cmp eax, 0x14d0
jne 0x40eaa1
jmp fcn.0040b860
cmp eax, 0x14d1
jne 0x40eaad
jmp 0x40ae80
cmp eax, 0x14d2
jne 0x40eabd
mov dword [esp + 4], eax
jmp 0x416f80
cmp eax, 0x14d3
jne 0x40ead3
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x40eaf4
jmp 0x401690
cmp eax, 0x14d5
jne 0x40eaf4
call fcn.0040e5c0
test eax, eax
jne 0x40eaf4
mov eax, dword [0x4910b0]
push 0x14d5
push eax
call dword [sym.imp.USER32.dll_KillTimer]
ret
push str.OnAutoDisplayConfigLogOnTimer_got_called_n
call fcn.0040aab0
mov al, byte [0x49116c]
add esp, 4
test al, 2
je 0x416ea5
mov eax, dword [esp + 4]
mov ecx, dword [0x4910b0]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer_should_not_be_called_by_Client_session_process
jmp fcn.0040aab0
mov eax, dword [0x49115c]
test eax, eax
jne 0x416ecc
mov edx, dword [esp + 4]
mov eax, dword [0x4910b0]
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer:_g_bSessionsControlEnabled_is_false
jmp fcn.0040aab0
mov eax, dword [0x493d00]
cmp eax, 0xffffffff
je 0x416f5b
push 1
push eax
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x416ef7
lea eax, [eax + eax*8]
shl eax, 5
add eax, 0x493d0c
jmp 0x416ef9
xor eax, eax
mov ecx, dword [0x491164]
push 1
push 0
push 0x11
push ecx
push eax
call fcn.00423240
add esp, 0x14
test eax, eax
jne 0x416f28
call fcn.00409d60
push eax
push str.OnAutoDisplayConfigLogOnTimer_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040aab0
add esp, 8
jmp 0x416f4c
call fcn.00409d60
push eax
push str.OnAutoDisplayConfigLogOnTimer_success_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040aab0
mov edx, dword [esp + 0xc]
mov eax, dword [0x4910b0]
add esp, 8
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x4910b8]
test ecx, ecx
je 0x416f7a
jmp fcn.004023d0
mov ecx, dword [esp + 4]
mov edx, dword [0x4910b0]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigLogOnTimer:_active_client_session_id_is_invalide
jmp fcn.0040aab0
ret
push str.OnAutoDisplayConfigNonLogOnTimer_got_called_n
call fcn.0040aab0
mov eax, dword [0x4910d8]
add esp, 4
test eax, eax
je 0x416fbe
test byte [0x49116c], 2
je 0x416fbe
mov eax, dword [esp + 4]
mov ecx, dword [0x4910b0]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer_should_not_be_called_by_Client_session_process
jmp fcn.0040aab0
mov eax, dword [0x49115c]
test eax, eax
jne 0x416fe5
mov edx, dword [esp + 4]
mov eax, dword [0x4910b0]
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer:_g_bSessionsControlEnabled_is_false
jmp fcn.0040aab0
mov eax, dword [0x493d00]
cmp eax, 0xffffffff
je 0x417061
push 1
push eax
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x41700c
lea eax, [eax + eax*8]
shl eax, 5
add eax, 0x493d0c
jmp 0x41700e
xor eax, eax
mov ecx, dword [0x491164]
push 1
push 0
push 0x3b
push ecx
push eax
call fcn.00423240
add esp, 0x14
test eax, eax
jne 0x41703c
call fcn.00409d60
push eax
push str.OnAutoDisplayConfigNonLogOnTimer_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040aab0
add esp, 8
ret
call fcn.00409d60
push eax
push str.OnAutoDisplayConfigNonLogOnTimer_success_CallAtiNamedPipe_EXTEVENT_REQTYPE_AUTODISPLAY__s.
call fcn.0040aab0
mov edx, dword [esp + 0xc]
mov eax, dword [0x4910b0]
add esp, 8
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
ret
mov ecx, dword [esp + 4]
mov edx, dword [0x4910b0]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 4], str.OnAutoDisplayConfigNonLogOnTimer:_active_client_session_id_is_invalide
jmp fcn.0040aab0
mov eax, dword [0x4910b0]
push 0x14cf
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x2a
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageA]
ret
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x422330
mov dword [esp + 0x14], 0
call fcn.00423c00
add esp, 0x14
test eax, eax
je 0x42237c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x358]
cmp ecx, 0xffffffff
mov eax, 1
je 0x43a214
push edi
push ecx
mov ecx, esi
call fcn.0043a020
mov edi, eax
test edi, edi
je 0x43a211
mov eax, dword [esi + 0x35c]
test eax, eax
mov dword [esi + 0x358], 0xffffffff
je 0x43a211
mov dword [esi + 0x35c], 0
mov eax, dword [0x4910b0]
push 0x14d3
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [0x4910b0]
push 0x14cc
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x4910d8]
test ecx, ecx
je 0x43a3c0
jmp 0x422350
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0x354]
test eax, eax
mov ecx, 0x491a60
je 0x43a75b
call fcn.0042dce0
test eax, eax
je 0x43a74f
lea ecx, [esi + 0x160]
call fcn.004010d0
test eax, eax
je 0x43a743
cmp eax, 1
jne 0x43a7dc
push 0
mov ecx, 0x491a60
call fcn.0042dcb0
mov dword [esi + 0x354], 0
pop esi
ret
push edi
mov edi, dword [0x492b40]
call fcn.0042dce0
test eax, eax
je 0x43a786
push 5
push 0xffffffffffffffff
push edi
mov ecx, 0x491a60
call fcn.0042fca0
push eax
lea ecx, [esi + 0x160]
call fcn.00401320
push 1
push edi
mov ecx, 0x491a60
call fcn.0042fd50
cmp eax, dword [0x492b3c]
pop edi
jae 0x43a7b0
push 0
push 0
push eax
mov ecx, 0x491a60
call fcn.00430650
cmp eax, 6
je 0x43a7dc
mov eax, dword [0x4900e8]
test dword [0x49051c], eax
je 0x43a7ca
push str.CLargeDesktop::bRemoveFromLargeDesktop_returns_TRUE
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x4910b0]
push 0x4d3
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
ret
mov eax, dword [0x4900e8]
test dword [0x49051c], eax
je 0x43a7fa
push str.OnPsudoLargeDesktopRSSupportTimer__remove_bRemoveFromPseudoLargeDesktop
call fcn.0040aab0
add esp, 4
mov eax, dword [0x492b40]
push eax
mov ecx, 0x491a60
call fcn.0042fca0
push eax
call fcn.00425a60
add esp, 4
test eax, eax
je 0x43a845
mov ecx, dword [0x4910b0]
push 0x14c9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x4900e8]
test dword [0x49051c], edx
je 0x43a85d
push str.bRemoveFromPsudoLargeDesktop_returns_TRUE__timer_was_killed
call fcn.0040aab0
add esp, 4
ret
mov eax, dword [0x4900e8]
test dword [0x49051c], eax
je 0x43a85d
push str.FAILURE:_bRemoveFromPsudoLargeDesktop_returns_FALSE
call fcn.0040aab0
pop ecx
ret