Function at 0x4028d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
cmp eax, 0x10
jne 0x40291c
push str.Received_WM_CLOSE_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
push 0
mov dword [esi + 0x38], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x2b1
jne 0x402ab2
mov eax, dword [ebp + 0x10]
cmp eax, 1
jne 0x4029be
push str.Received_WTS_CONSOLE_CONNECT_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
cmp dword [esi + 0x8c], 0
lea ecx, [ebp - 0x10]
je 0x4029ab
push str._tResuming_Event_Processing...
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov eax, dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
mov ecx, esi
call fcn.00408d50
mov dword [esi + 0x8c], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str._tDuplicate_message___Ignoring...
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
jmp 0x402a94
cmp eax, 2
jne 0x402a42
push str.Received_WTS_CONSOLE_DISCONNECT_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
cmp dword [esi + 0x8c], 0
lea ecx, [ebp - 0x10]
jne 0x402a32
push str._tSuspending_Event_Processing...
call fcn.00410900
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov ecx, dword [esi + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esi + 0x8c], 1
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str._tDuplicate_message___Ignoring...
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
jmp 0x402a94
cmp eax, 5
jne 0x402a4e
push str.Received_WTS_SESSION_LOGON_message.
jmp 0x402a88
cmp eax, 6
jne 0x402a66
push str.Received_WTS_SESSION_LOGOFF_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
jmp 0x402a94
cmp eax, 3
jne 0x402a7e
push str.Received_WTS_REMOTE_CONNECT_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
jmp 0x402a94
cmp eax, 4
jne 0x402aa6
push str.Received_WTS_REMOTE_DISCONNECT_message.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x40a
jne 0x402b1f
cmp dword [esi + 0x90], 0
je 0x402b13
cmp dword [esi + 0x8c], 0
jne 0x402b13
push str.Performing_daily_restart...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 1
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov edx, dword [esi + 0x40]
push 1
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x38], 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x40c
jne 0x402b7f
push str.WM_ENDTHREAD_MSG_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x402aa6
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WM_ENDTHREAD_MSG:_the_thread_has_been_closed...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 3
jmp 0x402a96
cmp eax, 0x16
jne 0x402c31
cmp dword [ebp + 0x10], 0
je 0x402913
push str.Session_ending.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
push 1
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov ecx, esi
call fcn.00408750
lea eax, [ebp - 0x24]
push eax
call fcn.00412f30
add esp, 4
cmp eax, 0x400
jne 0x402913
push str.Unregistering_Tinkerbell_as_a_service_process.
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 1
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x402913
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402c21
push 0
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x8c], 0
jne 0x402913
cmp eax, 0x401
jne 0x402c56
call fcn.00401470
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x402
jne 0x402d44
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x14]
mov dword [ebp + 0xc], edx
add eax, 0x10
lea edx, [ebp + 0x14]
mov dword [ebp + 0x14], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [ebp + 0x10]
sub eax, 0
je 0x402cf5
sub eax, 1
jne 0x402aa6
push str.ET_APP_SHUTDOWN_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 3
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea edx, [ebp + 0xc]
push edx
push 7
mov ecx, esi
call fcn.00408fd0
cmp dword [ebp + 0x14], 1
jne 0x402aa6
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
test eax, eax
jne 0x402aa6
push eax
mov dword [esi + 0x38], eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.ET_APP_START_message_received...
lea ecx, [ebp - 8]
call fcn.00410900
lea eax, [ebp - 8]
push eax
push 3
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 8]
call fcn.004108e0
lea ecx, [ebp + 0xc]
push ecx
push 5
mov ecx, esi
call fcn.00408fd0
cmp dword [ebp + 0x14], 2
jne 0x402aa6
push 0
mov ecx, esi
call fcn.00408d50
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x40b
jne 0x402d8f
push str.WM_CONNECTED_MSG_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov eax, dword [ebp + 0x10]
push 0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x218
jne 0x402dda
push str.WM_POWERBROADCAST_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
cmp dword [ebp + 0x10], 7
jne 0x402aa6
push 0
push 2
mov ecx, esi
call fcn.00408fd0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x4a
jne 0x402e14
push str.WM_COPYDATA_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea edx, [ebp - 0x10]
push edx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, esi
call fcn.00401fb0
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x219
jne 0x402913
push str.WM_DEVICECHANGE_message_received...
lea ecx, [ebp - 0x10]
call fcn.00410900
lea ecx, [ebp - 0x10]
push ecx
push 2
call fcn.0040d770
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004108e0
cmp dword [ebp + 0x10], 0x8000
jne 0x402aa6
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 2
jne 0x402aa6
movzx eax, word [ecx + 0x10]
test ax, ax
je 0x402e6d
test al, 1
je 0x402aa6
mov edx, dword [ecx + 0xc]
push 1
push edx
call fcn.00401330
movzx eax, al
add esp, 4
push eax
lea ecx, [ebp - 8]
call fcn.00411330
push 0x435970
lea ecx, [ebp - 8]
call fcn.00410d30
lea ecx, [ebp - 0x10]
call fcn.00410680
cmp byte [ebp - 1], 0xff
lea eax, [ebp - 8]
jne 0x402ea8
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push str.A_Removable_disk_inserted_event_was_signaled_Drive:__s
push ecx
call fcn.00411430
lea edx, [ebp - 0x10]
push edx
push 1
call fcn.0040d770
add esp, 0x14
cmp byte [ebp - 1], 0xff
lea eax, [ebp - 8]
jne 0x402ed1
mov eax, dword [ebp - 8]
push eax
push 6
mov ecx, esi
call fcn.00408fd0
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea ecx, [ebp - 8]
call fcn.004108e0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10