Function at 0x100404390
Capabilities:
Create thread
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x10044bda8], 0
je 0x1004046f2
test byte [0x10044bda4], 4
jne 0x1004043bb
lea r8, str.Dump_operation_is_not_requested
jmp 0x100404633
test edx, edx
je 0x10040445f
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x10044c010], rax
test rax, rax
jne 0x1004043f4
lea rdx, str.Unable_to_create_service_event
call fcn.10040a220
xor eax, eax
add rsp, 0x48
ret
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [0x1004276d0]
lea r8, [0x10040b470]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x10044c018], rax
test rax, rax
jne 0x10040445f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_create_thread_for_service_handler___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov rcx, qword [0x10044c010]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x48
ret
mov rdx, qword [0x1004276d8]
lea rax, [0x10044bdb0]
lea rcx, [0x10044bff8]
mov qword [rsp + 0x20], rax
call fcn.10040b290
test eax, eax
je 0x10040464e
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x30], r14
xor ebx, ebx
mov qword [rsp + 0x38], rdi
lea r14d, [rbp + 1]
nop dword [rax]
test ebx, ebx
jne 0x1004044e2
mov rcx, qword [0x10044c000]
lea edx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1004044d2
cmp eax, 0x102
je 0x100404540
xor r14d, r14d
mov ebx, 1
mov eax, ebp
sub eax, esi
cmp eax, 0x7530
jb 0x1004044b0
mov rcx, qword [0x10044c000]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
test r14d, r14d
je 0x1004045a0
test eax, eax
je 0x1004045a0
mov eax, dword [rsp + 0x50]
lea r8, str.Injected_thread_completed_after_waiting_for__d_msec___d_suspended___ret_code___X
mov dword [rsp + 0x28], eax
lea rcx, [0x100422050]
mov r9d, ebp
mov dword [rsp + 0x20], esi
mov edx, 2
call fcn.100401b20
jmp 0x1004045bf
mov rcx, qword [0x10044c000]
add ebp, 0x64
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
cmp eax, 0xffffffff
je 0x1004044d7
mov rcx, qword [0x10044c000]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10040458f
mov ebx, 1
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_resume_injected_thread___d_
mov edx, ebx
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
cmp edi, 2
jbe 0x1004044d7
add esi, 0x64
jmp 0x1004044d7
mov r9d, ebp
mov dword [rsp + 0x20], esi
lea r8, str.Wait_for_injected_thread_exited_after_waiting_for__d_msec___d_suspended_
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
mov rcx, qword [0x10044c000]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x60]
test rcx, rcx
je 0x1004045db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x10044c008]
test rdx, rdx
je 0x100404622
mov rcx, qword [0x10044bff8]
mov r9d, 0x8000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x100404622
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_free_parameter_block__x
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
test r14d, r14d
mov r14, qword [rsp + 0x30]
je 0x10040464e
lea r8, str.Dump_was_completed_using_in_proc_activation
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov eax, 1
add rsp, 0x48
ret
mov ecx, dword [0x100427d40]
mov edx, dword [0x100427d44]
or ecx, 0x20
mov dword [0x100427d40], ecx
bt ecx, 0xb
jae 0x10040467f
btr ecx, 0xb
or edx, 0x1160
mov dword [0x100427d40], ecx
mov dword [0x100427d44], edx
mov eax, ecx
and eax, 0x10
test al, al
je 0x10040469a
and ecx, 0xffffffef
or edx, 2
mov dword [0x100427d40], ecx
mov dword [0x100427d44], edx
mov eax, ecx
and eax, 8
test al, al
je 0x1004046b5
and ecx, 0xfffffff7
or edx, 0x40
mov dword [0x100427d40], ecx
mov dword [0x100427d44], edx
bt ecx, 0xc
jae 0x1004046d4
btr ecx, 0xc
or ecx, 0x20
or edx, 0x1826
mov dword [0x100427d40], ecx
mov dword [0x100427d44], edx
bt ecx, 0xf
jae 0x1004046f2
or ecx, 0x8020
or edx, 0x1826
mov dword [0x100427d40], ecx
mov dword [0x100427d44], edx
xor eax, eax
add rsp, 0x48
ret