Function at 0x10003950
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x10003bd2
mov eax, dword [ebp + 8]
mov ecx, 1
push ebx
push esi
push edi
mov dword [0x100392e0], eax
xor edi, edi
mov ebx, 0x100396a4
xor eax, eax
lock cmpxchg dword [ebx], ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x100039a4
cmp edi, 0x20
jae 0x10003990
push 0
jmp 0x10003992
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x10003987
cmp dword [0x100396a8], 0
jne 0x100039be
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100396a8], eax
xor eax, eax
xchg dword [ebx], eax
mov ecx, dword [0x100396bc]
mov dword [0x10039228], 0xd328d0
mov dword [0x1003921c], 0xd30110
lea eax, [ecx + 0x11bd30]
mov dword [0x10039224], eax
lea eax, [ecx + 0x144480]
mov dword [0x10039220], eax
call fcn.100017c0
call fcn.10003530
call fcn.100020a0
mov ecx, dword [0x100396c0]
lea eax, [ecx + 0x233380]
mov dword [0x1003922c], eax
lea eax, [ecx + 0x233ef0]
mov dword [0x1003923c], eax
lea eax, [ecx + 0x234210]
mov dword [0x10039238], eax
lea eax, [ecx + 0x4c0c90]
mov dword [0x10039234], eax
lea eax, [ecx + 0x233ed0]
mov dword [0x10039244], eax
lea eax, [ecx + 0x242080]
mov dword [0x10039248], eax
lea eax, [ecx + 0x233f70]
mov dword [0x10039240], eax
lea eax, [ecx + 0x22b770]
mov dword [0x1003924c], eax
call fcn.10004780
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0x10001360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x100396d4]
mov edx, 0x100037d0
add ecx, 0x234610
push 0x100392dc
mov dword [0x100392e4], ecx
call fcn.1000ae8d
mov ebx, dword [0x100392e4]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x100396a4
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10003ada
cmp edi, 0x20
jae 0x10003ac1
push 0
jmp 0x10003ac3
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x100396a4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10003ab8
cmp dword [0x100396a8], 0
je 0x10003bbe
test ebx, ebx
jne 0x10003af5
call fcn.1000add7
jmp 0x10003bbe
mov ecx, dword [0x10039728]
xor edx, edx
test ecx, ecx
je 0x10003bbe
mov esi, dword [0x10039720]
mov eax, esi
nop dword [eax]
cmp ebx, dword [eax]
je 0x10003b21
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10003b10
jmp 0x10003bbe
cmp edx, 0xffffffff
je 0x10003bbe
imul edi, edx, 0x2c
test byte [edi + esi + 0x14], 2
jne 0x10003bbe
push 1
lea ecx, [ebp - 0xc]
call fcn.1000ac97
add esp, 4
test eax, eax
jne 0x10003bbe
add edi, dword [0x10039720]
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea esi, [eax - 5]
cmove esi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp + 0xc]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003bb6
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x10003b94
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
lea ecx, [ebp - 0xc]
call fcn.1000ad08
xor edx, edx
mov eax, 0x100396a4
xchg dword [eax], edx
mov ecx, dword [ebp + 8]
call fcn.10002300
pop edi
pop esi
pop ebx
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc