Function at 0x40e030
Capabilities:
Check for time delay via gettickcount
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5886e3
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x5f3fcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Resume_device_manager
push dword [0x5fd6d0]
xor eax, eax
mov dword [ebp - 0x70], eax
call fcn.0040b090
mov edi, dword [esi + 0x40]
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call ebx
cmp eax, 0xffffffff
setne al
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x40]
cmp dword [eax + 0x44], 0
jne 0x40e0a9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x40]
cmp dword [eax + 0x44], 0
je 0x40e098
push str.Resume_usb_detector
push dword [0x5fd6d0]
call fcn.0040b090
mov edi, dword [esi + 0x44]
add esp, 8
push dword [edi + 4]
call ebx
cmp eax, 0xffffffff
push str.Screen_Detector_start
setne al
mov byte [edi + 0xc], al
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 8
cmp byte [esi + 0xd], 0
jne 0x40e902
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x5fd6f8], 0
je 0x40e109
mov ecx, esi
mov byte [0x5fd6f8], 0
call fcn.0040f940
mov eax, dword [esi + 0x38]
cmp dword [esi + 0x24], eax
je 0x40e1a0
push eax
push str.Sleep_change_detected_to__d
push dword [0x5fd6d0]
mov dword [esi + 0x24], eax
call fcn.0040b090
add esp, 0xc
cmp dword [esi + 0x24], 0
je 0x40e188
mov edi, dword [esi + 0x48]
cmp dword [edi + 4], 2
jne 0x40e167
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [edi + 4]
cmp eax, 3
je 0x40e167
push 3
push eax
push str.ScreenCapture_state_change_from__d_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0x10
mov dword [edi + 4], 3
mov eax, dword [esi + 0x44]
push ecx
mov dword [eax + 0x1c], 1
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
call fcn.00410230
mov eax, dword [esi + 0x14]
add esp, 4
mov dword [esi + 0x18], eax
jmp 0x40e1a0
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x70], 0
mov dword [eax + 0x1c], 0
mov dword [esi + 0x28], 0
cmp dword [esi + 0x24], 0
jne 0x40e0e0
inc dword [esi + 0x3c]
cmp dword [esi + 0x3c], 0x258
jl 0x40e1c2
call fcn.0040f790
mov dword [esi + 0x3c], 0
mov eax, dword [0x5fdd78]
xor ebx, ebx
test eax, eax
jne 0x40e1e5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5fdd78], eax
test eax, eax
je 0x40e26c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5d104c
push eax
call edi
push str.CloseDesktop
push dword [0x5fdd78]
mov dword [ebp - 0x64], eax
call edi
push str.SwitchDesktop
push dword [0x5fdd78]
mov edi, eax
mov dword [ebp - 0x68], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
test ecx, ecx
je 0x40e26c
test edi, edi
je 0x40e26c
test eax, eax
je 0x40e26c
push 0x100
push 0
push 0
push str.Default
call ecx
mov dword [ebp - 0x64], eax
test eax, eax
je 0x40e26c
push eax
call dword [ebp - 0x6c]
push dword [ebp - 0x64]
mov edi, eax
xor ebx, ebx
test edi, edi
sete bl
call dword [ebp - 0x68]
test edi, edi
jne 0x40e26c
push str.fnSwitchDesktop_locked_
push dword [0x5fd6d0]
call fcn.0040b0f0
add esp, 8
test ebx, ebx
jne 0x40e2f5
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [sym.imp.POWRPROF.dll_PowerGetActiveScheme]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
lea eax, [ebp - 0x20]
push eax
push 0x5c6834
push 0x5c6844
push dword [ebp - 0x60]
push ebx
cmp byte [ebp - 0x5c], bl
jne 0x40e2a8
call dword [sym.imp.POWRPROF.dll_PowerReadDCValueIndex]
jmp 0x40e2ae
call dword [sym.imp.POWRPROF.dll_PowerReadACValueIndex]
cmp dword [ebp - 0x20], 0
ja 0x40e2b8
xor ebx, ebx
jmp 0x40e2f5
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 8
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
mov eax, dword [esi + 0x34]
cmp eax, dword [ebp - 0x24]
jbe 0x40e2de
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi + 0x34]
jmp 0x40e2e9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20], 0x3e8
cmp ecx, eax
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x70], ebx
je 0x40e44d
push ebx
push str.Lock_change_detected_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0xc
mov dword [ebp - 0x70], ebx
test ebx, ebx
je 0x40e3cf
cmp dword [esi + 0x28], 0
jne 0x40e0e0
mov edi, dword [esi + 0x48]
cmp dword [edi + 4], 2
jne 0x40e35c
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [edi + 4]
cmp eax, 3
je 0x40e35c
push 3
push eax
push str.ScreenCapture_state_change_from__d_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0x10
mov dword [edi + 4], 3
mov edi, dword [esi + 0x40]
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x1c]
cmp dword [ecx + 8], eax
je 0x40e394
mov dword [eax], 3
mov dword [eax + 4], 0
add dword [ecx + 4], 8
jmp 0x40e39e
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.004076a0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 8]
mov eax, dword [esi + 0x40]
push ecx
mov dword [eax + 0x48], 1
mov dword [esi + 0x28], 1
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
call fcn.00410230
mov eax, dword [esi + 0x14]
add esp, 4
mov dword [esi + 0x18], eax
jmp 0x40e44d
cmp dword [esi + 0x28], 0
jne 0x40e3e8
push str.unlock_status_at_falling_edge_
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0x40]
mov dword [esi + 0x34], eax
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x34], 0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x1c]
cmp dword [ecx + 8], eax
je 0x40e429
mov dword [eax], 4
mov dword [eax + 4], 0
add dword [ecx + 4], 8
jmp 0x40e433
lea edx, [ebp - 0x38]
push edx
push eax
call fcn.004076a0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 8]
mov eax, dword [esi + 0x40]
mov dword [eax + 0x48], 0
mov dword [esi + 0x28], 0
cmp dword [esi + 0x28], 0
jne 0x40e0e0
mov eax, dword [esi + 0x48]
cmp dword [eax + 4], 2
jne 0x40e54d
mov eax, dword [eax]
cmp byte [eax + 4], 0
je 0x40e54d
push str.Handle_screen_capture_error...
push dword [0x5fd6d0]
call fcn.0040b090
mov edx, dword [esi + 0x18]
add esp, 4
mov ecx, dword [esi + 0x14]
call fcn.00410230
mov eax, dword [esi + 0x14]
add esp, 4
mov dword [esi + 0x18], eax
mov eax, dword [0x5fd6ec]
inc dword [eax + 0x1c]
mov edi, dword [esi + 0x48]
cmp dword [edi + 4], 2
jne 0x40e4d4
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [edi + 4]
cmp eax, 3
je 0x40e4d4
push 3
push eax
push str.ScreenCapture_state_change_from__d_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0x10
mov dword [edi + 4], 3
push str.m_dm__display_pause
push dword [0x5fd6d0]
call fcn.0040b090
mov edi, dword [esi + 0x40]
add esp, 8
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x3c], 0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x1c]
cmp dword [ecx + 8], eax
je 0x40e530
mov dword [eax], 3
mov dword [eax + 4], 0
add dword [ecx + 4], 8
lea ecx, [edi + 0x28]
mov eax, dword [edi + 0x28]
call dword [eax + 8]
push str.m_dm__display_paused
jmp 0x40e0d2
lea edx, [ebp - 0x40]
push edx
push eax
call fcn.004076a0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 8]
push str.m_dm__display_paused
jmp 0x40e0d2
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [0x5fd6f4]
test eax, eax
jne 0x40e5c9
lea eax, [ebp - 0x94]
push eax
call fcn.0040eef0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x64], eax
xor edi, edi
xor ebx, ebx
cmp ecx, eax
je 0x40e5be
call fcn.0040fe20
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
mov eax, dword [ecx + 8]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov edi, edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x94]
jmp 0x40e656
cmp eax, 2
jne 0x40e613
lea eax, [ebp - 0xa0]
push eax
call fcn.0040eb30
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x64], eax
xor edi, edi
xor ebx, ebx
cmp ecx, eax
je 0x40e60b
call fcn.0040fe20
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
mov eax, dword [ecx + 8]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov edi, edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xa0]
jmp 0x40e656
lea eax, [ebp - 0xac]
push eax
call fcn.0040f3a0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x64], eax
xor edi, edi
xor ebx, ebx
cmp ecx, eax
je 0x40e650
call fcn.0040fe20
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
mov eax, dword [ecx + 8]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov edi, edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xac]
call fcn.0040fe20
mov ecx, dword [esi + 0x14]
sub edi, ebx
mov edx, dword [esi + 0x18]
sub edx, ecx
sar edi, 5
sar edx, 5
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], edx
cmp edx, edi
jne 0x40e767
xor eax, eax
mov dword [ebp - 0x74], eax
test edx, edx
je 0x40e8ee
mov edi, dword [ebp - 0x18]
lea edx, [ebx + 4]
sub edi, ebx
mov dword [ebp - 0x68], edx
mov ebx, dword [ebp - 0x64]
sar edi, 5
mov dword [ebp - 0x78], edi
nop word [eax + eax]
cmp edi, eax
jbe 0x40e923
cmp ebx, eax
jbe 0x40e923
mov eax, dword [ecx + 4]
cmp eax, dword [edx]
jne 0x40e767
mov eax, dword [ecx]
cmp eax, dword [edx - 4]
jne 0x40e767
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 4]
jne 0x40e767
mov eax, dword [ecx + 0xc]
cmp eax, dword [edx + 8]
jne 0x40e767
mov eax, dword [ecx + 0x10]
cmp eax, dword [edx + 0xc]
jne 0x40e767
mov ebx, dword [ecx + 0x14]
mov edi, dword [ecx + 0x18]
mov eax, dword [edx + 0x14]
sub edi, ebx
mov ecx, dword [edx + 0x10]
sub eax, ecx
sar eax, 3
sar edi, 3
mov dword [ebp - 0x7c], eax
cmp edi, eax
jne 0x40e767
xor edx, edx
test edi, edi
je 0x40e73b
sub ebx, ecx
nop
cmp edi, edx
jbe 0x40e91e
cmp eax, edx
jbe 0x40e91e
mov eax, dword [ebx + ecx]
cmp eax, dword [ecx]
jne 0x40e767
mov eax, dword [ebx + ecx + 4]
cmp eax, dword [ecx + 4]
jne 0x40e767
mov eax, dword [ebp - 0x7c]
inc edx
add ecx, 8
cmp edx, edi
jb 0x40e710
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x68]
inc eax
mov ecx, dword [ebp - 0x6c]
add edx, 0x20
mov ebx, dword [ebp - 0x64]
add ecx, 0x20
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x6c], ecx
cmp eax, ebx
jae 0x40e8ee
mov edi, dword [ebp - 0x78]
jmp 0x40e6a0
mov eax, dword [0x5fd6ec]
lea ecx, [esi + 0x14]
inc dword [eax + 0x18]
lea eax, [ebp - 0x1c]
cmp ecx, eax
je 0x40e787
push dword [ebp - 0x78]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004103c0
push str.Screen_is_changed_
push dword [0x5fd6d0]
call fcn.0040b090
mov edi, dword [esi + 0x48]
add esp, 8
cmp dword [edi + 4], 2
jne 0x40e7cf
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [edi + 4]
cmp eax, 3
je 0x40e7cf
push 3
push eax
push str.ScreenCapture_state_change_from__d_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0x10
mov dword [edi + 4], 3
mov edi, dword [esi + 0x40]
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x1c]
cmp dword [ecx + 8], eax
je 0x40e807
mov dword [eax], 3
mov dword [eax + 4], 0
add dword [ecx + 4], 8
jmp 0x40e811
lea edx, [ebp - 0x48]
push edx
push eax
call fcn.004076a0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esi + 0x40]
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x4c], 0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x1c]
cmp dword [ecx + 8], eax
je 0x40e85a
mov dword [eax], 4
mov dword [eax + 4], 0
add dword [ecx + 4], 8
jmp 0x40e864
lea edx, [ebp - 0x50]
push edx
push eax
call fcn.004076a0
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
call dword [eax + 8]
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x14]
sub eax, dword [ecx]
sar eax, 5
test eax, eax
je 0x40e8ee
push ecx
lea ecx, [ebp - 0x88]
call fcn.0040fbd0
mov edi, dword [esi + 0x48]
mov byte [ebp - 4], 1
mov eax, dword [edi + 4]
cmp eax, 1
je 0x40e89c
cmp eax, 3
jne 0x40e8e3
mov edx, dword [ebp - 0x84]
sub edx, dword [ebp - 0x88]
sar edx, 5
test edx, edx
je 0x40e8e3
mov ecx, dword [edi]
push edx
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 4]
cmp eax, 2
je 0x40e8e3
push 2
push eax
push str.ScreenCapture_state_change_from__d_to__d
push dword [0x5fd6d0]
call fcn.0040b090
add esp, 0x10
mov dword [edi + 4], 2
lea ecx, [ebp - 0x88]
call fcn.0040fe20
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040fe20
jmp 0x40e0e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567879
mov esp, ebp
pop ebp
ret
call fcn.00405130
call fcn.00405130
int3