Function at 0x401152
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x1c]
push ebx
lea ebx, [ebp - 0x24]
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x42f110]
test eax, eax
jne 0x4011ae
mov eax, dword [0x42f00c]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40119a
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
mov dword [0x42f00c], eax
mov dword [esp + 4], str.NtAllocateVirtualMemory
mov dword [esp], eax
call edi
push ecx
push ecx
mov dword [0x42f110], eax
xor edx, edx
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], 0xffffffff
call eax
test eax, eax
jne 0x40139f
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.0040112d
test eax, eax
je 0x40139f
mov eax, dword [0x42f120]
lea ebx, [ebp - 0x20]
test eax, eax
jne 0x401240
mov eax, dword [0x42f00c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40122c
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
mov dword [0x42f00c], eax
mov dword [esp + 4], str.NtCreateThreadEx
mov dword [esp], eax
call esi
push ecx
push ecx
mov dword [0x42f120], eax
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x24]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1fffff
mov dword [esp], ebx
call eax
test eax, eax
jne 0x40139f
mov eax, dword [0x42f14c]
test eax, eax
jne 0x4012c3
mov eax, dword [0x42f00c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4012af
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov dword [0x42f00c], eax
mov dword [esp + 4], str.NtQueueApcThread
mov dword [esp], eax
call ebx
push ebx
push ebx
mov dword [0x42f14c], eax
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call eax
test eax, eax
jne 0x40139f
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x401357
mov eax, dword [0x42f170]
test eax, eax
jne 0x401341
mov eax, dword [0x42f00c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40131a
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
mov dword [0x42f00c], eax
mov dword [esp + 4], str.NtWaitForSingleObject
xor edi, edi
mov dword [esp], eax
call ebx
push esi
push esi
mov dword [0x42f170], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov edx, dword [ebp - 0x20]
jmp 0x40134f
xor ebx, ebx
mov dword [esp + 4], 1
mov dword [esp + 8], ebx
mov dword [esp], edx
call eax
sub esp, 0xc
mov eax, dword [0x42f114]
test eax, eax
jne 0x401396
mov eax, dword [0x42f00c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401382
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ecx
mov dword [0x42f00c], eax
mov dword [esp + 4], str.NtClose
mov dword [esp], eax
call ebx
push edx
push edx
mov dword [0x42f114], eax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call eax
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret