Function at 0x77cafd9b
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
cmp dword [ebx], eax
mov dword [ebp - 8], eax
jbe 0x77c92853
lea eax, [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x38], edx
jmp 0x77c92822
cmp dword [ebp - 0x30], 1
je 0x77ce73d8
jmp 0x77caff66
mov dword [ebp + 0xc], 0x425
jmp 0x77caff66
pause
jmp 0x77cafeb8
cmp dword [ebp - 0x30], ecx
je 0x77cab484
jmp 0x77ce7405
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x77c92822
sub eax, dword [ebp - 0x38]
push ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
call fcn.77c9286e
test eax, eax
je 0x77ce7365
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 0x1c], 4
cmp eax, dword [ebx]
jb 0x77c927e3
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1c], 0x77cab9d5
je 0x77cabc16
jmp 0x77caff66
push edi
push ebx
call fcn.77c96834
test eax, eax
mov dword [ebp + 0xc], eax
je 0x77caff66
jmp 0x77ce73bc
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x77c998fd
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [edi + 4], eax
je 0x77ce7354
mov ecx, ebx
lea edx, [ecx + 2]
mov dword [ebp + 0xc], edx
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x77c9992b
sub ecx, dword [ebp + 0xc]
push ebx
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call fcn.77c99960
call fcn.77cabe4e
test eax, eax
mov dword [ebp + 0xc], eax
je 0x77cabbec
jmp 0x77caff66
push 0
push 0
jmp 0x77caff23
cmp eax, 0x20
jne 0x77cafe27
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ecx
push eax
push 0x4d3
push dword [ebp - 0x1c]
jmp 0x77caff78
pop ebx
pop edi
pop esi
leave
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x77caffa1
jmp 0x77ce740c
cmp eax, 0x51
ja 0x77ce7337
test byte [edi + 0x14], 1
mov dword [ebp - 0x30], ecx
jne 0x77cac32d
mov eax, dword [edi + 8]
mov ebx, dword [ebp - 4]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x1c], eax
xor eax, eax
cmp dword [0x77d2a68c], eax
mov dword [ebp - 0x1c], 0x77cab9d5
jne 0x77c927d6
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call fcn.77caba16
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x77c927f2
lea eax, [ebp - 0x20]
push eax
push 4
push dword [ebp - 4]
push dword [ebp - 0x1c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x77ce7371
push dword [esi + 0xc]
mov dword [ebp - 0x10], 1
push dword [esi + 8]
push dword [ebp - 0x18]
push dword [0x77d2a694]
call fcn.77cabcb9
test eax, eax
mov dword [edi + 0x10], eax
je 0x77ce737d
mov dword [ebp - 0x34], 1
cmp dword [ebp + 0xc], 0
jne 0x77c927f2
test byte [esi + 0x10], 1
jne 0x77c96818
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x77ce739e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
je 0x77caff66
jmp 0x77c927f2
or dword [edi + 0x14], 1
jmp 0x77cafe39
push ebx
push dword [edi]
call sub.ntdll.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
je 0x77cabbec
mov eax, ebx
lea edx, [eax + 2]
jmp 0x77c998fd
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
xor edi, edi
xor esi, esi
inc esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], esi
call fcn.77cabe21
push esi
push edi
push edi
call sym.ADVAPI32.dll_OpenSCManagerA
cmp eax, edi
mov dword [0x77d2a694], eax
je 0x77ce730c
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, edi
xor eax, eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x4d3
push esi
push dword [ebp + 8]
call fcn.77caffb8
test eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
jne 0x77ce7317
mov ebx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
xor ecx, ecx
add ebx, esi
cmp eax, 0x52
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
je 0x77cafe51
cmp word [ebx], cx
je 0x77cab475
cmp eax, 0x51
mov edi, dword [0x77d2a7a4]
mov dword [ebp - 0xc], edi
je 0x77cac324
test byte [edi + 0x14], 1
jne 0x77cafe51
push ebx
lea eax, [ebp - 0xc]
push eax
call fcn.77cafd5c
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp dword [ebp - 0x2c], 1
jne 0x77c92814
cmp dword [ebp - 0x1c], ecx
jne 0x77c92814
mov eax, dword [esi + 4]
cmp eax, 0x50
jae 0x77cabbd6
xor ebx, ebx
push ebx
lea eax, [edi + 0xc]
push ebx
push eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x77c92801
lea eax, [edi + 0x14]
mov dword [ebp - 8], ebx
test byte [eax], 4
mov dword [ebp - 0x38], eax
jne 0x77cafeb8
mov eax, dword [esi + 4]
cmp eax, 1
je 0x77cd9e9b
cmp eax, 5
je 0x77cd9e9b
cmp eax, 0xf
je 0x77cd9e9b
mov ecx, dword [0x7ffe0324]
mov edx, dword [0x7ffe0320]
mov eax, dword [0x7ffe0328]
cmp ecx, eax
jne 0x77c9280d
mov eax, dword [0x7ffe0004]
mul edx
shrd eax, edx, 0x18
shr edx, 0x18
mov ebx, eax
mov eax, dword [0x7ffe0004]
mov edi, edx
mul ecx
push 0
push 0x100
push edx
push eax
call fcn.77cb0191
add ebx, eax
mov eax, dword [ebp - 0x38]
adc edi, edx
test byte [eax], 2
mov dword [ebp - 0x40], edi
mov edi, dword [ebp - 0xc]
je 0x77cb02e7
cmp dword [ebp - 4], 0
push dword [edi + 0x18]
je 0x77c9aa1b
mov eax, dword [ebp - 4]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
call dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [edi + 4]
push dword [esi + 4]
push dword [esi + 0x18]
push dword [ebp - 0x40]
push ebx
call fcn.77cb01b3
mov eax, dword [esi + 4]
cmp eax, 5
je 0x77cd9eb7
cmp eax, 0xf
je 0x77cd9eb7
cmp eax, 1
je 0x77cd9eb7
cmp dword [ebp - 8], 0
jne 0x77cd9ec7
cmp dword [esi + 4], 5
je 0x77caff80
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp - 0x24]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.77cb002a
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
jne 0x77caff98
cmp dword [ebp - 4], ebx
je 0x77caff98
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], ebx
jne 0x77cabbc8
cmp dword [ebp - 0x2c], 1
jne 0x77cab499
mov ebx, dword [ebp - 0x18]
jmp 0x77cafdd9
mov eax, dword [esi + 4]
cmp eax, 1
jb 0x77ce73e7
cmp eax, 0xa
ja 0x77ce73e7
mov dword [ebp - 0x28], edi
mov edi, esp
push dword [esi + 4]
call dword [ebp - 0x1c]
mov esp, edi
mov edi, dword [ebp - 0x28]
mov edi, dword [ebp - 0xc]
jmp 0x77caff2c
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x1c]
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x77cafeb8
jmp 0x77c92801
push 0
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x77caff5c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x77caff66
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x77cab49a
cmp dword [ebp - 0x30], 8
je 0x77ce732e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1e
jbe 0x77ce732e
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 4], 0
jmp 0x77cafe4f
cmp eax, 0x52
jne 0x77cafe70
push dword [esi + 0xc]
push dword [esi + 8]
push ebx
push dword [ebp + 8]
call fcn.77d14765
jmp 0x77cafdd9
mov eax, dword [edi]
mov dword [edi + 4], eax
mov dword [ebp + 0xc], 8
jmp 0x77caff66
mov dword [ebp + 0xc], 8
jmp 0x77c92845
mov dword [ebp + 0xc], 0x41e
jmp 0x77c927f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
jmp 0x77cabc7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x41e
push ebx
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [ebp - 0x10], 0
jmp 0x77cabc9e
push 0x41e
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
jmp 0x77cabca5
push 0
push 0
push edi
call fcn.77caba16
jmp 0x77caff66
cmp eax, 0x80
jb 0x77ce73f9
cmp eax, 0xff
jbe 0x77cb02fc
mov dword [ebp - 0x24], 0x78
jmp 0x77caff2c
xor eax, eax
jmp 0x77cab48a
push dword [edi + 0x10]
call sym.ADVAPI32.dll_CloseServiceHandle
mov dword [edi + 0x10], ebx
jmp 0x77caffa1