Function at 0x1000ef40
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014775
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10019008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x40d7d2
push esi
call edi
mov ecx, 0x1000ec40
mov byte [0x40d7d2], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x40d7d7
push eax
mov dword [0x40d7d3], ecx
push dword [ebp - 0x14]
push 5
push 0x40d7d2
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x40d4f9
push esi
call edi
mov ecx, 0x1000ec40
mov byte [0x40d4f9], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x40d4fe
push eax
mov dword [0x40d4fa], ecx
push dword [ebp - 0x14]
push 5
push 0x40d4f9
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x40d4f9
push esi
call edi
mov ecx, 0x1000ec50
mov byte [0x40d4f9], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x40d4fe
push eax
mov dword [0x40d4fa], ecx
push dword [ebp - 0x14]
push 5
push 0x40d4f9
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x4502fc
push esi
call edi
lea eax, [ebp - 0x20]
mov byte [0x4502fc], 0xe9
push eax
mov dword [0x4502fd], 0xfffff9a0
push dword [ebp - 0x14]
push 5
push 0x4502fc
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 1
push 0x450301
push esi
call edi
lea eax, [ebp - 0x20]
mov byte [0x450301], 0x90
push eax
push dword [ebp - 0x14]
push 1
push 0x450301
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4f6224
call ebx
lea eax, [ebp - 0x20]
mov byte [0x4f6224], 0xeb
push eax
push dword [ebp - 0x14]
push 1
push 0x4f6224
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x450217
push esi
call edi
mov ecx, 0x1000e230
mov byte [0x450217], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x45021c
push eax
mov dword [0x450218], ecx
push dword [ebp - 0x14]
push 5
push 0x450217
push esi
call edi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536da2
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536da2], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536da2
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536de2
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536de2], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536de2
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536e20
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536e20], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536e20
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536e60
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536e60], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536e60
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536c8b
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536c8b], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536c8b
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536ccb
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536ccb], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536ccb
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536d09
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536d09], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536d09
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x536d49
call ebx
lea eax, [ebp - 0x20]
mov byte [0x536d49], 0xd
push eax
push dword [ebp - 0x14]
push 1
push 0x536d49
call ebx
push 4
call fcn.1001301a
mov dword [ebp - 0x20], eax
mov dword [eax], 0x1000e560
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
push 0
push eax
push 0x1000f6f0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x1000f57e
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x1000f283
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
je 0x1000f299
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x2c], 0
push eax
push 4
push 4
mov esi, 0x593600
mov dword [ebp - 0x28], 0
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [esi], 0x1000e1f0
push eax
push dword [ebp - 0x10]
push 4
push esi
call ebx
lea eax, [ebp - 0x10]
mov esi, 0x593578
push eax
push 4
push 4
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [esi], 0x1000e170
push eax
push dword [ebp - 0x10]
push 4
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x4becc4
push esi
call edi
mov ecx, 0x1000e700
mov byte [0x4becc4], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x4becc9
push eax
mov dword [0x4becc5], ecx
push dword [ebp - 0x14]
push 5
push 0x4becc4
push esi
call edi
lea eax, [ebp - 0x14]
mov esi, 0x1000e680
push eax
push 0x80
push 4
push 0x44df46
sub esi, 0x44df4a
call ebx
mov eax, dword [0x44df46]
add eax, 0x44df4a
mov dword [0x10019748], eax
mov eax, 0x44df46
mov dword [eax], esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push 5
push 0x44df46
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x42bdc0
push esi
call edi
mov byte [0x42bdc0], 0xe8
mov ecx, 0x1000e7d0
lea eax, [ebp - 0x20]
sub ecx, 0x42bdc5
push eax
mov dword [0x42bdc1], ecx
push dword [ebp - 0x14]
push 5
push 0x42bdc0
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x439ef5
push esi
call edi
mov ecx, 0x1000e790
mov byte [0x439ef5], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x439efa
push eax
mov dword [0x439ef6], ecx
push dword [ebp - 0x14]
push 5
push 0x439ef5
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x42d81c
push esi
call edi
mov ecx, 0x1000e7b0
mov byte [0x42d81c], 0xe8
lea eax, [ebp - 0x20]
sub ecx, 0x42d821
push eax
mov dword [0x42d81d], ecx
push dword [ebp - 0x14]
push 5
push 0x42d81c
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x40d4b4
push esi
call edi
mov ebx, 0x1000ec20
mov byte [0x40d4b4], 0xe8
lea eax, [ebx - 0x40d4b9]
mov dword [0x40d4b5], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push 5
push 0x40d4b4
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x40d4bf
push esi
call edi
mov edi, 0x1000ec30
mov byte [0x40d4bf], 0xe8
lea eax, [edi - 0x40d4c4]
mov dword [0x40d4c0], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push 5
push 0x40d4bf
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x4102c6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 0x20]
mov byte [0x4102c6], 0xe8
push eax
lea ecx, [ebx - 0x4102cb]
mov dword [0x4102c7], ecx
push dword [ebp - 0x14]
push 5
push 0x4102c6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 5
push 0x4102d1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 0x20]
mov byte [0x4102d1], 0xe8
push eax
sub edi, 0x4102d6
mov dword [0x4102d2], edi
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 5
push 0x4102d1
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push 4
push 5
push 0x40f72b
push esi
call edi
lea eax, [ebp - 0x24]
mov byte [0x40f72b], 0xe8
push eax
sub ebx, 0x40f730
mov dword [0x40f72c], ebx
push dword [ebp - 0x1c]
push 5
push 0x40f72b
push esi
call edi
cmp dword [ebp - 0x28], 0
je 0x1000f58d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 6
mov dword [ebp - 0x28], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret