Function at 0x41d71c
Capabilities:
Create thread
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41d97c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x41d791
inc esi
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.004050ac
mov eax, dword [ebp - 4]
test eax, eax
je 0x41d764
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x41d78b
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
sub al, 0x2d
je 0x41d777
sub al, 2
jne 0x41d78b
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
call fcn.0040333c
cmp al, 0x4c
jne 0x41d78b
mov byte [ebx + 0x11], 1
add edi, 4
dec esi
jne 0x41d74e
cmp byte [ebx + 0x11], 0
je 0x41d7a1
mov eax, 0x41d994
call fcn.0041ccf4
mov dword [ebx + 0x14], 0x10
mov dword [ebx + 0x18], 2
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
push 0
push 0xffffffffffffffff
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebx + 0x30], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x41d164
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
mov dword [ebx + 0x38], esi
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
test al, al
je 0x41d83d
cmp byte [ebx + 0x10], 0
jne 0x41d83d
push 0x41d150
mov eax, dword [ebx + 8]
call fcn.00405360
push eax
call sub.advapi32.dll_RegisterServiceCtrlHandlerA
mov dword [ebx + 0x3c], eax
mov edx, 0x3e8
mov eax, ebx
call fcn.0041d6f4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x41d92e
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
dec eax
jne 0x41d862
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
jne 0x41d906
cmp byte [ebx + 0x11], 0
je 0x41d899
mov eax, dword [ebx + 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00408f30
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x41d9b0
call fcn.004051e8
mov eax, dword [ebp - 0x18]
call fcn.0041ccf4
mov eax, dword [ebx + 0x18]
sub eax, 2
je 0x41d8e6
dec eax
je 0x41d8ae
sub eax, 2
je 0x41d8e6
dec eax
je 0x41d8c4
jmp 0x41d906
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov byte [ebx + 4], 1
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_ResumeThread
jmp 0x41d906
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x1c], 7
xor edx, edx
mov eax, ebx
call fcn.0041d6f4
jmp 0x41d906
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebx + 0x18], 4
mov dword [ebx + 0x1c], 7
xor edx, edx
mov eax, ebx
call fcn.0041d6f4
cmp byte [ebx + 4], 0
je 0x41d84c
mov dword [ebx + 0x18], 3
mov edx, 0x3e8
mov eax, ebx
call fcn.0041d6f4
push 0xffffffffffffffff
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebx + 0x18], 1
xor edx, edx
mov eax, ebx
call fcn.0041d6f4
mov eax, dword [ebx + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x34]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d983
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404ed8
lea eax, [ebp - 4]
call fcn.00404eb4
ret