Function at 0x41cb1c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [0x446ac8]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x10
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 2
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
push 0
push 0xffffffffffffffff
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 4
mov eax, dword [ebp - 4]
push eax
push 0x41c4ec
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
push 0x41c4d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405290
push eax
call sub.advapi32.dll_RegisterServiceCtrlHandlerA
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov edx, 0x3e8
mov eax, dword [ebp - 4]
call fcn.0041cacc
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x41cc10
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44], 0
jne 0x41cc74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
sub eax, 2
je 0x41cc29
dec eax
je 0x41cc55
jmp 0x41cc74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], 5
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041cacc
jmp 0x41cc74
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44], 0
je 0x41cbf1
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 3
mov edx, 0x3e8
mov eax, dword [ebp - 4]
call fcn.0041cacc
push 0x7530
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.kernel32.dll_WaitForSingleObject
sub eax, 0x102
jne 0x41ccbf
mov cl, 1
mov edx, 0x41cd04
mov eax, dword [ebp - 4]
call fcn.0041c7c0
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041cacc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.kernel32.dll_CloseHandle
mov esp, ebp
pop ebp
ret