Function at 0x422bb0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10b720
mov dword [ebp - 0x34], ecx
mov ebx, 0x80004005
mov dword [0x47396c], 0
call fcn.00424244
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
add esp, 4
mov dword [0x473b70], esi
test esi, esi
je 0x422d40
push 0x10b720
call fcn.00424244
add esp, 4
mov dword [0x473b74], eax
test eax, eax
je 0x422d40
push 0x10b720
push 0
push esi
call fcn.00424e90
mov eax, dword [0x473b70]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
add esp, 0xc
mov dword [eax], 1
cmp dword [0x473bd4], 0
jne 0x422c97
mov eax, dword [0x4497b0]
push 0x473bb4
push dword [0x473bb0]
mov dword [0x473bc8], eax
inc eax
mov dword [0x473bbc], 0
mov dword [0x473bb8], 2
mov dword [0x473bc0], 0
mov dword [0x473bcc], 0xbb8
mov dword [0x4497b0], eax
call esi
test eax, eax
jne 0x422c97
push 0x43bfcc
call fcn.0041f760
add esp, 4
jmp 0x422d40
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call ebx
mov dword [0x473938], eax
test eax, eax
je 0x422fac
push 0
push 0
push 1
push 0
call ebx
mov dword [0x473940], eax
test eax, eax
je 0x422fac
mov ecx, dword [ebp - 0x34]
push 0
call fcn.00422000
mov dword [ebp - 0x30], eax
test eax, eax
js 0x422d3d
cmp dword [0x473bd4], 0
jne 0x422e35
push 0x473bb4
push dword [0x473bb0]
mov dword [0x473bbc], 1
mov dword [0x473bb8], 4
mov dword [0x473bc0], 0
mov dword [0x473bcc], 0
mov dword [0x473bc8], 0
call esi
test eax, eax
jne 0x422e35
push 0x43bfcc
call fcn.0041f760
add esp, 4
mov ebx, dword [ebp - 0x30]
call fcn.0041ef30
xor esi, esi
jmp 0x422d50
mov eax, dword [0x473b70]
mov eax, dword [esi + eax + 0x7a030]
test eax, eax
je 0x422d63
push eax
call edi
add esi, 0xa1c
cmp esi, 0x28700
jl 0x422d50
mov eax, dword [0x473940]
test eax, eax
je 0x422d7d
push eax
call edi
mov eax, dword [0x47393c]
test eax, eax
je 0x422d89
push eax
call edi
mov eax, dword [0x473938]
test eax, eax
je 0x422d95
push eax
call edi
mov eax, dword [0x473b90]
test eax, eax
je 0x422da1
push eax
call edi
mov eax, dword [0x47396c]
test eax, eax
je 0x422dad
push eax
call edi
mov eax, dword [0x473b70]
test eax, eax
je 0x422dc9
push eax
call fcn.0042420c
add esp, 4
mov dword [0x473b70], 0
mov eax, dword [0x473b74]
test eax, eax
je 0x422de5
push eax
call fcn.0042420c
add esp, 4
mov dword [0x473b74], 0
test ebx, ebx
js 0x422fdc
mov esi, dword [0x4dda94]
mov edx, dword [0x4dda98]
xor eax, eax
cmp esi, edx
jae 0x422fca
mov edi, dword [sym.imp.ole32.dll_CoRevokeClassObject]
lea esp, [esp]
test eax, eax
jne 0x422fca
mov ecx, dword [esi]
test ecx, ecx
je 0x422fbf
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 4]
test eax, eax
jne 0x422fb6
jmp 0x422fbf
xor esi, esi
push 0
push 0
push 0
push 0
call ebx
mov ecx, dword [0x473b70]
mov dword [esi + ecx + 0x7a030], eax
mov eax, dword [0x473b70]
cmp dword [esi + eax + 0x7a030], 0
je 0x422d3d
add esi, 0xa1c
cmp esi, 0x28700
jl 0x422e37
lea eax, [ebp - 0x2c]
push 1
push eax
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalCOM.WDC.WDDriveServiceStopEvent
push 0
push 0
lea eax, [ebp - 0x40]
push eax
call ebx
mov dword [0x47393c], eax
test eax, eax
je 0x422d3d
push str.GlobalCOM.WDC.WDDriveServiceMemoryMutex
push 0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x473b90], eax
test eax, eax
je 0x422d3d
push str.GlobalCOM.WDC.WDDriveServiceFileMap
push 0x10b720
push 0
push 4
lea eax, [ebp - 0x40]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x47396c], eax
test eax, eax
je 0x422d3d
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x4224f0
push 0
lea eax, [ebp - 0x40]
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x422d3d
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4218a0
push 0
lea eax, [ebp - 0x40]
push eax
call esi
mov esi, eax
test esi, esi
je 0x422f6f
call fcn.004130c0
push 1
push dword [0x47396c]
push dword [0x473b90]
call fcn.0041aa00
add esp, 0xc
call fcn.0041e080
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x34]
mov dword [0x473dd8], eax
call fcn.00422490
push dword [0x473938]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call edi
test esi, esi
je 0x422d3d
push dword [0x473938]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
jmp 0x422d3d
mov ebx, 0x80004005
jmp 0x422d40
push eax
call edi
mov edx, dword [0x4dda98]
add esi, 4
cmp esi, edx
jb 0x422e10
mov eax, dword [ebp - 0x34]
cmp byte [eax + 0x3c], 0
je 0x422fdc
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424839
mov esp, ebp
pop ebp
ret 8