Function at 0x42965c
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x31c
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x334]
mov edi, dword [esp + 0x338]
add esp, 0xfffffff4
mov eax, dword [esp + 0x33c]
push eax
call fcn.00429414
add esp, 0x10
test eax, eax
jne 0x4296d4
cmp edi, 0xff
jg 0x4296d4
xor ecx, ecx
lea ebp, [esp + 0x220]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], edx
cmp ecx, edi
jge 0x429648
mov ebx, ebp
mov eax, edi
and eax, 3
test edi, edi
jle 0x429612
test eax, eax
je 0x429620
cmp eax, 1
jle 0x429612
cmp eax, 2
jle 0x42960b
mov al, byte [esi]
mov byte [esp + 0x220], al
inc ecx
mov al, byte [ecx + esi]
mov byte [ecx + ebp], al
inc ecx
mov al, byte [ecx + esi]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jge 0x429648
lea esi, [esi]
mov al, byte [ecx + esi]
mov byte [ecx + ebx], al
lea edx, [ecx + 1]
mov al, byte [edx + esi]
mov byte [edx + ebx], al
lea edx, [ecx + 2]
mov al, byte [edx + esi]
mov byte [edx + ebx], al
lea edx, [ecx + 3]
mov al, byte [edx + esi]
mov byte [edx + ebx], al
add ecx, 4
cmp ecx, edi
jl 0x429620
mov byte [edi + ebp], 0
add esp, 0xfffffff8
push 0xff
mov eax, dword [esp + 0x24]
push eax
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov edx, dword [esp + 0x338]
mov dword [edx], 0
add esp, 0xfffffff4
push 0
push pe_nt_image_headers32
mov eax, 3
cmp dword [esp + 0x358], 0
je 0x429693
mov eax, 4
push eax
push 0
mov eax, 3
cmp dword [esp + 0x360], 0
je 0x4296aa
mov eax, 1
push eax
mov eax, 0x80000000
cmp dword [esp + 0x364], 0
je 0x4296bf
mov eax, 0xc0000000
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x4296e6
add esp, 0xfffffff4
push 0
call fcn.00419400
add esp, 0x10
jmp 0x4297f5
add esp, 0xfffffff8
push 0x30
push 1
call fcn.004f1e60
mov ebx, eax
mov edx, dword [esp + 0x340]
mov dword [edx + 4], ebx
add esp, 0x10
test ebx, ebx
jne 0x429720
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_CloseHandle
push 0
call fcn.00419400
add esp, 0x10
jmp 0x4297f5
mov eax, dword [0x4f8984]
mov edx, dword [esp + 0x330]
mov dword [edx], eax
mov dword [ebx], esi
mov eax, dword [esp + 0x33c]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x340]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 8], eax
add esp, 0xfffffff8
lea eax, [esp + 0x24]
push eax
push 4
push ebx
push 0x4292a0
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebx + 4], eax
add esp, 8
test eax, eax
jne 0x4297a0
add esp, 0xfffffff4
push 0x42954c
jmp 0x4297dc
add esp, 0xfffffff8
push 2
push eax
call sub.KERNEL32.dll_SetThreadPriority
add esp, 8
test eax, eax
jne 0x4297c2
add esp, 0xfffffff4
push 0x429562
call fcn.00421298
add esp, 0x10
add esp, 0xfffffff4
push dword [ebx + 4]
call sub.KERNEL32.dll_ResumeThread
add esp, 0xc
test eax, eax
jne 0x4297f0
add esp, 0xfffffff4
push 0x42957d
call fcn.00421298
add esp, 0xfffffff4
push 0
call fcn.00419400
add esp, 0x20
jmp 0x4297f5
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x31c
ret