Function at 0x77c8f533
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
cmp dword [edi], eax
mov dword [ebp - 0xc], eax
jbe 0x77c81fc2
lea eax, [edi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x38], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x77c81f91
sub eax, dword [ebp - 0x38]
push ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
call fcn.77c81fe0
test eax, eax
je 0x77cd877e
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x1c], 4
cmp eax, dword [edi]
jb 0x77c81f84
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1c], 0x77c8f36f
jne 0x77c8f6fc
mov edi, dword [ebp - 4]
jmp 0x77c8f96b
push ebx
push edi
call fcn.77c88f1e
test eax, eax
mov dword [ebp + 0xc], eax
je 0x77c8f6fc
jmp 0x77cd87d5
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x77c8cb20
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebx + 4], eax
je 0x77cd876d
mov ecx, dword [ebp - 8]
lea edi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x77c8cb4c
push dword [ebp - 8]
sub ecx, edi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call fcn.77c8cb85
call fcn.77c8e60d
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x77c8f6fc
mov edi, dword [ebp - 4]
jmp 0x77c8f944
or dword [ebx + 0x14], 1
jmp 0x77c8f5cd
push dword [ebp - 8]
push dword [ebx]
call sub.ntdll.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
je 0x77c8f944
mov eax, dword [ebp - 8]
lea edx, [eax + 2]
jmp 0x77c8cb20
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], esi
call fcn.77c8e569
push esi
push ebx
push ebx
call sym.ADVAPI32.dll_OpenSCManagerA
cmp eax, ebx
mov dword [0x77d1e650], eax
je 0x77cd871c
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
xor edi, edi
push esi
push dword [ebp + 8]
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x24], 0x4d3
call fcn.77c8f4c1
cmp eax, edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
jne 0x77cd8746
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 4]
add eax, esi
cmp ecx, 0x52
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
je 0x77c8f5e3
cmp word [eax], di
je 0x77cc9aca
cmp ecx, 0x51
mov ebx, dword [0x77d1e6fc]
mov dword [ebp - 0x18], ebx
je 0x77c8e9ae
test byte [ebx + 0x14], 1
jne 0x77c8f5e3
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.77c8f2cc
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 4]
cmp dword [ebp - 0x2c], 1
jne 0x77cc9762
cmp dword [ebp - 0x1c], 0
jne 0x77cc9762
mov eax, dword [esi + 4]
cmp eax, 0x50
jae 0x77c8f92d
push 0
lea eax, [ebx + 0xc]
push 0
push eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x77cc974f
and dword [ebp - 0xc], 0
lea edi, [ebx + 0x14]
test byte [edi], 4
jne 0x77c8f645
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x77cc974f
mov ecx, dword [0x7ffe0324]
mov edx, dword [0x7ffe0320]
mov eax, dword [0x7ffe0328]
cmp ecx, eax
jne 0x77cc975b
mov eax, dword [0x7ffe0004]
mul edx
shrd eax, edx, 0x18
shr edx, 0x18
mov ebx, eax
mov eax, dword [0x7ffe0004]
mov dword [ebp - 0x44], edx
mul ecx
push 0
push 0x100
push edx
push eax
call fcn.77c9e322
add ebx, eax
mov eax, dword [ebp - 0x44]
adc eax, edx
test byte [edi], 2
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
je 0x77cd8800
mov eax, dword [ebp - 4]
test eax, eax
push dword [ebx + 0x18]
je 0x77cc9727
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
call dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebx + 4]
push dword [esi + 4]
push dword [esi + 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.77c8d988
mov eax, dword [esi + 4]
cmp eax, 5
je 0x77cc9730
cmp eax, 0xf
je 0x77cc9730
cmp eax, 1
je 0x77cc9730
cmp dword [ebp - 0xc], 0
je 0x77c8f6fc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 4], 5
je 0x77c8f716
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp - 0x24]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.77c8f74d
xor edi, edi
cmp dword [ebp - 0x10], edi
jne 0x77c8f72e
cmp dword [ebp - 4], edi
je 0x77c8f72e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], edi
cmp dword [ebp - 0x34], edi
jne 0x77c8f91f
cmp dword [ebp - 0x2c], 1
je 0x77c8f56f
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [ebp + 0xc], edi
je 0x77c8f737
jmp 0x77cd8845
cmp eax, 0x51
ja 0x77cd8727
and dword [ebp - 0x30], 0
test byte [ebx + 0x14], 1
jne 0x77c8e9b7
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x1c], eax
xor eax, eax
cmp dword [0x77d1e648], eax
mov dword [ebp - 0x1c], 0x77c8f36f
jne 0x77c81f77
lea eax, [ebp - 0x30]
push eax
push 1
push ebx
call fcn.77c8f3ec
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x77cc9740
lea eax, [ebp - 0x20]
push eax
push 4
push edi
push dword [ebp - 0x1c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x77cd878a
push dword [esi + 0xc]
mov dword [ebp - 0x10], 1
push dword [esi + 8]
push dword [ebp - 8]
push dword [0x77d1e650]
call fcn.77c8fa0c
test eax, eax
mov dword [ebx + 0x10], eax
je 0x77cd8796
mov dword [ebp - 0x34], 1
cmp dword [ebp + 0xc], 0
jne 0x77cc9740
test byte [esi + 0x10], 1
jne 0x77c88f02
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x77cd87b7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
je 0x77c8f6fc
jmp 0x77cc9740
push 0
push 0
jmp 0x77c8f6b2
push 0
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x77c8f6ed
cmp dword [ebp - 0x30], 1
je 0x77cd87f1
jmp 0x77c8f6fc
mov dword [ebp + 0xc], 0x425
jmp 0x77c8f6fc
pause
jmp 0x77c8f645
cmp dword [ebp - 0x38], 0
je 0x77cc9ad9
jmp 0x77cd883c
cmp ecx, 0x20
jne 0x77c8f5bb
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ecx
push eax
push 0x4d3
push dword [ebp - 0x1c]
jmp 0x77c8f70e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x77c8f742
cmp eax, 0x52
jne 0x77c8f606
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.77d08022
jmp 0x77c8f56f
cmp eax, 8
je 0x77cd8763
cmp eax, 0x5aa
je 0x77cd8763
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1e
jbe 0x77cd8763
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov dword [ebp - 4], edi
jmp 0x77c8f5e6
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov dword [ebp + 0xc], 8
jmp 0x77c8f6fc
mov dword [ebp + 0xc], 8
jmp 0x77c81fb4
mov dword [ebp + 0xc], 0x41e
jmp 0x77cc9740
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
jmp 0x77c8f9cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x41e
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [ebp - 0x10], 0
jmp 0x77c8f9f1
push 0x41e
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
jmp 0x77c8f9f8
push 0
push 0
push ebx
call fcn.77c8f3ec
jmp 0x77c8f6fc
mov eax, dword [esi + 4]
cmp eax, 1
jb 0x77cd880d
cmp eax, 0xa
jbe 0x77cd881b
cmp eax, 0x80
jb 0x77cd8830
cmp eax, 0xff
ja 0x77cd8830
mov dword [ebp - 0x28], edi
mov edi, esp
push dword [esi + 4]
call dword [ebp - 0x1c]
mov esp, edi
mov edi, dword [ebp - 0x28]
jmp 0x77c8f6bb
mov dword [ebp - 0x24], 0x78
jmp 0x77c8f6bb
xor eax, eax
xor ecx, ecx
jmp 0x77cc9adf
push dword [ebx + 0x10]
call sym.ADVAPI32.dll_CloseServiceHandle
mov dword [ebx + 0x10], edi
jmp 0x77c8f737