Function at 0x1020e700
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10295418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x1020e722
call fcn.10010dd0
movaps xmm0, xmmword [0x10290de0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x14
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x10
jb 0x1020e735
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 7], 0
push eax
push 0x10297f20
push 0x1029aae8
call fcn.1020ea90
add esp, 0xc
push 0
push str.ScreenShots
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x12441fd
mov eax, 0x1029041c
mov dword [ebp - 0x20], 0xc
sub eax, esi
mov dword [ebp - 0x24], eax
mov bl, byte [eax + esi]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x1c]
mov byte [esi], bl
push eax
push dword [ebp - 0x1c]
push 1
push esi
call edi
mov eax, dword [ebp - 0x24]
inc esi
sub dword [ebp - 0x20], 1
jne 0x1020e788
mov esi, dword [0x10295d98]
mov dword [ebp - 0x1c], 0
test esi, esi
je 0x1020e7f4
xor eax, eax
mov bl, byte [eax + 0x10295d9c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x20]
mov byte [esi], bl
push eax
push dword [ebp - 0x20]
push 1
push esi
call edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
shl eax, 3
mov esi, dword [eax + 0x10295d98]
test esi, esi
jne 0x1020e7c1
mov ebx, dword [0x10295f88]
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x1020e843
xor eax, eax
nop word [eax + eax]
mov esi, dword [eax + 0x10295f8c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push ebx
call edi
lea eax, [ebp - 0x20]
mov dword [ebx], esi
push eax
push dword [ebp - 0x20]
push 4
push ebx
call edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
shl eax, 3
mov ebx, dword [eax + 0x10295f88]
test ebx, ebx
jne 0x1020e810
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0xdbbde5
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x24], ecx
nop word [eax + eax]
mov edi, dword [eax + 0x102903c8]
mov esi, dword [eax + 0x102903c4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push edi
push ecx
call ebx
push edi
push esi
mov esi, dword [ebp - 0x24]
push esi
call fcn.10253bd0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push esi
call ebx
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x102903c0]
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x1020e860
mov dword [ebp - 0x20], ecx
xor eax, eax
mov ecx, 0x181d3d0
mov dword [ebp - 0x1c], ecx
nop word [eax + eax]
mov edi, dword [eax + 0x102903b0]
mov esi, dword [eax + 0x102903ac]
lea eax, [ebp - 0x24]
push eax
push 0x40
push edi
push ecx
call ebx
push edi
push esi
mov esi, dword [ebp - 0x1c]
push esi
call fcn.10253e60
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push esi
call ebx
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x102903a8]
mov dword [ebp - 0x1c], ecx
test ecx, ecx
jne 0x1020e8c0
push fcn.1000a560
push 0xceb249
push 0xff
call fcn.10211710
push fcn.1000a560
push 0xceb37c
push 0xff
call fcn.10211710
push fcn.1000a560
push 0xceb415
push 0xff
call fcn.10211710
push fcn.1020f430
push 0xd5dd56
push 0xff
call fcn.10211710
call fcn.10009f50
push 0x10010060
push 0xaa6713
push 0xe9
call fcn.10211710
push 0x10010100
push 0xaa5477
push 0xe9
call fcn.10211710
add esp, 0x48
push 0x10010220
push 0x870072
push 0xe9
call fcn.10211710
add esp, 0xc
call fcn.1020f300
call fcn.102107b0
call fcn.1020ec60
call fcn.10001ae0
call fcn.1020ec60
mov dword [0x181d390], 0x4e4
call fcn.1000b120
push 0
push 0
push 0
push 0x10010c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10250f5f
mov esp, ebp
pop ebp
ret