Function at 0x10002023
Capabilities:
Create thread
Set current directory
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x1c]
push dword [0x1002cd58]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1002d0f4], 0x20
mov dword [0x1002d0f8], 2
mov dword [0x1002d0fc], 0x85
xorps xmm0, xmm0
movups xmmword [0x1002d100], xmm0
push 0
push 0x1000f696
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x1002d110], eax
test eax, eax
je 0x1000228d
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [0x1002d0f8], 4
cmp eax, 2
jl 0x100020ad
xor ecx, ecx
inc ecx
mov edx, dword [edi + ecx*4]
cmp word [edx], 0x73
jne 0x100020a8
cmp word [edx + 2], 0
je 0x10002232
inc ecx
cmp eax, ecx
jne 0x10002094
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp dword [0x1002d1f0], 0xa
jl 0x1000213c
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000213c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
je 0x1000211d
jmp 0x10002138
call esi
mov edi, eax
cmp dword [0x1002d1f0], 0xa
jl 0x1000213c
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100020d4
jmp 0x1000213c
call esi
cmp dword [0x1002d1f0], 0xa
jl 0x100020e1
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100020d4
jmp 0x100020e1
call esi
cmp dword [0x1002d1f0], 0xa
jl 0x10002100
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10002100
call esi
jmp 0x1000211d
push 4
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp], eax
cmp dword [0x1002d1f0], 0xa
jl 0x10002199
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10002199
mov esi, 4
mov ebp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push ebp
push edi
call ebx
push esi
push ebp
push edi
call ebx
mov dword [esp], eax
cmp dword [0x1002d1f0], 0xa
jl 0x10002199
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10002173
cmp dword [esp], 0
je 0x1000222c
mov eax, dword [0x1002cd24]
mov ecx, dword [esp]
mov dword [ecx], eax
cmp dword [0x1002d1f0], 0xa
jl 0x100021f7
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x100021f7
xor edi, edi
mov ebp, 0x10012ca4
push edi
push edi
mov ebx, dword [esp + 8]
push ebx
push ebp
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
push edi
push ebx
push ebp
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call esi
jmp 0x100021ad
xor eax, eax
push eax
push eax
push dword [esp + 8]
push 0x10012ca4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1f0], 0xa
jl 0x1000222c
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100021c6
mov esi, dword [0x1002d110]
push 0x1002d0f4
push esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x1002d1f0], 0xa
jl 0x10002283
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10002283
mov edi, 0x1002d0f4
mov ebx, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push edi
push esi
call ebx
push edi
push esi
call ebx
cmp dword [0x1002d1f0], 0xa
jl 0x10002283
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10002262
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [0x1002d0f8], 1
push 0x1002d0f4
push 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x1002d1f0], 0xa
jl 0x100022eb
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x100022eb
mov esi, 0x1002d0f4
xor edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push esi
push edi
call ebx
push esi
push edi
call ebx
cmp dword [0x1002d1f0], 0xa
jl 0x100022eb
mov eax, dword [0x1002d1f4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100022ca
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]