Function at 0x100082b0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10008f20
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
cmp eax, 1
jne 0x100085d6
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtProtectVirtualMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1006ba44], eax
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1006ba44]
movsd xmm0, qword [eax]
movsd qword [0x1006ba48], xmm0
movzx eax, word [eax + 8]
mov word [0x1006ba50], ax
lea esi, [ebp - 0x238]
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.aura3_br__s_br__ls
push esi
call fcn.100056e0
add esp, 0x10
mov dword [ebp - 0x10], 0
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x1000839d
mov byte [0x1006bace], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.kick_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x100083eb
mov byte [0x1006ba5c], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.invis_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x10008439
mov byte [0x1006bac9], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.upstats1_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x10008487
mov byte [0x1006bacb], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.upstats2_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x100084d5
mov byte [0x1006bacd], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.dmgp_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x10008523
mov byte [0x1006ba24], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.exp_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x10008571
mov byte [0x1006ba76], 1
push dword [0x1006bad0]
push dword [0x1006b0ac]
push str.multiprof_br__s_br__ls
lea esi, [ebp - 0x238]
push esi
call fcn.100056e0
add esp, 0x10
push esi
call fcn.10038130
add esp, 4
push eax
push str.http:__www.xhook.net_handler_kfunc
call fcn.10038090
add esp, 8
push 1
push eax
call fcn.100382e0
add esp, 8
cmp byte [eax], 0x31
jne 0x100085bf
mov byte [0x1006bacf], 1
push 0
push 0
push 0
push 0x10008170
push 0
push 0
call fcn.10043c55
add esp, 0x18
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, 1
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc