Function at 0x1006015
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [0x102e008]
push esi
push edi
mov dword [ebp - 0xc], ebx
mov edi, 0x4000000
cmp eax, ebx
je 0x1006091
push 0x102e038
push eax
mov dword [0x102e040], 0x100
mov dword [0x102e044], ebx
mov dword [0x102e04c], ebx
mov dword [0x102e050], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x1006091
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x100607c
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x1006097
push 0x1005728
push 1
push eax
push edi
call fcn.01007e2b
add esp, 0x10
jmp 0x1006097
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
push 0x1005c20
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x10060e1
call esi
mov esi, eax
cmp esi, ebx
jle 0x10060c4
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x10060cb
mov esi, 0x80004005
push 0x1006598
push 1
push esi
push edi
call fcn.01007e2b
add esp, 0x10
jmp 0x1006346
mov ecx, dword [0x102e00c]
push 0xffffffffffffffff
mov dword [ebp - 0x10], eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 2
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 8], eax
sub eax, ebx
je 0x10061bb
dec eax
je 0x1006134
call esi
mov esi, eax
cmp esi, ebx
jle 0x1006120
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x1006127
mov esi, 0x80004005
push dword [ebp - 8]
push 0x1006560
jmp 0x1006331
push 0x1006530
push ebx
push ebx
push edi
call fcn.01007e2b
mov eax, dword [0x102e008]
add esp, 0x10
cmp eax, ebx
je 0x10062c2
cmp dword [0x102e268], ebx
jne 0x10062c2
push 0x102e038
push eax
mov dword [0x102e040], 0x45
mov dword [0x102e044], ebx
mov dword [0x102e04c], ebx
mov dword [0x102e050], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x10062c2
call esi
cmp eax, ebx
jle 0x100619f
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x10062c2
push 0x1005728
push 1
push eax
push edi
call fcn.01007e2b
add esp, 0x10
jmp 0x10062c2
push 0x10064e0
push ebx
push ebx
push edi
call fcn.01007e2b
mov eax, dword [0x102e008]
add esp, 0x10
cmp eax, ebx
je 0x1006200
push 0x102e038
push eax
mov dword [0x102e03c], 3
mov dword [0x102e040], ebx
mov dword [0x102e044], ebx
mov dword [0x102e050], 0x7530
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push ebx
call fcn.01006aea
mov esi, 0x800705b4
cmp eax, esi
jne 0x1006258
push 0x10064a8
push ebx
push ebx
push edi
call fcn.01007e2b
add esp, 0x10
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x1006298
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1006243
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x1006298
push 0x100646c
push 1
push eax
push edi
call fcn.01007e2b
add esp, 0x10
jmp 0x1006298
cmp eax, ebx
jge 0x100626d
push 0x1006438
push 1
push eax
push edi
call fcn.01007e2b
add esp, 0x10
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x1006308
push 0x10063f0
push ebx
push ebx
push edi
call fcn.01007e2b
add esp, 0x10
call fcn.01006b6a
xor esi, esi
inc esi
push esi
push 2
call fcn.01006dda
cmp eax, ebx
jge 0x10062b7
push 0x10063b8
push esi
push eax
push edi
call fcn.01007e2b
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10062d8
mov esi, dword [ebp - 0xc]
jmp 0x100633d
call esi
mov esi, eax
cmp esi, ebx
jle 0x10062ee
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x10062f5
mov esi, 0x80004005
push 0x1006390
push 1
push esi
push edi
call fcn.01007e2b
add esp, 0x10
jmp 0x100633d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x1006322
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x1006329
mov esi, 0x80004005
push dword [ebp - 8]
push 0x1006350
push 1
push esi
push edi
call fcn.01007e2b
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4