Function at 0x100013f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push esi
mov esi, dword [0x1004a5e0]
push edi
push eax
push 0x40
push 6
add esi, 0x90f85
push esi
call ebx
mov eax, dword [0x100412a4]
mov dword [esi], eax
movzx eax, word [0x100412a8]
mov word [esi + 4], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
add esi, 0xb6565
push esi
call ebx
mov eax, dword [0x100412ac]
mov dword [esi], eax
movzx eax, byte [0x100412b0]
mov byte [esi + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 5
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 7
add esi, 0x4ace3
push esi
call ebx
mov eax, dword [0x100412b4]
mov dword [esi], eax
movzx eax, word [0x100412b8]
mov word [esi + 4], ax
movzx eax, byte [0x100412ba]
mov byte [esi + 6], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
add esi, 0x94e23
push esi
call ebx
movq xmm0, qword [0x100412bc]
movq qword [esi], xmm0
movzx eax, word [0x100412c4]
mov word [esi + 8], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0xa
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
add esi, 0xac2a0
push eax
push 0x40
push 7
push esi
call ebx
mov eax, dword [0x100412c8]
mov dword [esi], eax
movzx eax, word [0x100412cc]
mov word [esi + 4], ax
movzx eax, byte [0x100412ce]
mov byte [esi + 6], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
add esi, 0x1737d7
push esi
call ebx
mov eax, dword [0x100412d0]
mov dword [esi], eax
movzx eax, word [0x100412d4]
mov word [esi + 4], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
add esi, 0x178dc7
push esi
call ebx
mov eax, dword [0x100412d8]
mov dword [esi], eax
movzx eax, word [0x100412dc]
mov word [esi + 4], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call ebx
mov esi, dword [0x1004a5e0]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
add esi, 0x266391
push esi
call ebx
mov eax, dword [0x100412e0]
mov dword [esi], eax
movzx eax, word [0x100412e4]
mov word [esi + 4], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov eax, dword [0x1004a5dc]
push 4
push 4
add eax, 0x49c368
mov dword [ebp - 0x14], 0
push eax
call ebx
mov eax, dword [0x1004a5dc]
lea ecx, [ebp - 0x14]
add eax, 0x49c368
push ecx
mov dword [eax], 0x49742400
push dword [ebp - 0x10]
push 4
push eax
call ebx
cmp byte [0x1004a4c8], 0
je 0x10001785
mov esi, dword [0x1004a4dc]
test esi, esi
je 0x10001627
mov eax, dword [esi + 0x74]
mov dword [ebp - 8], eax
jmp 0x1000162e
mov dword [ebp - 8], 0
lea ebx, [esi + 8]
test esi, esi
je 0x1000163a
mov edi, dword [esi + 0x74]
jmp 0x1000163c
xor edi, edi
cmp dword [edi + 0x48], 0
lea eax, [edi + 0x48]
je 0x1000165b
push eax
push 1
call dword [0x1004a528]
mov esi, dword [0x1004a4dc]
mov dword [edi + 0x48], 0
cmp dword [edi + 0x4c], 0
lea eax, [edi + 0x4c]
je 0x1000167a
push eax
push 1
call dword [0x1004a528]
mov esi, dword [0x1004a4dc]
mov dword [edi + 0x4c], 0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x10001695
push eax
call dword [0x1004a52c]
mov esi, dword [0x1004a4dc]
mov dword [edi + 0x30], 0
test esi, esi
je 0x1000169e
mov edi, dword [esi + 0x74]
jmp 0x100016a0
xor edi, edi
add edi, 0x2c
cmp dword [edi], 0
je 0x100016c7
push edi
push 1
call dword [0x1004a534]
mov eax, dword [esi + 0x2c]
mov esi, dword [0x1004a4dc]
mov dword [eax + 4], 0
mov dword [edi], 0
and dword [ebx + 4], 0xfffffff7
mov eax, dword [ebp - 8]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x6c], 0
test eax, eax
je 0x100016fa
test esi, esi
je 0x100016ea
dec dword [esi + 0xb0]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [0x1004a4dc]
add esp, 4
test esi, esi
je 0x10001703
mov ebx, dword [esi + 0x70]
jmp 0x10001705
xor ebx, ebx
mov eax, dword [ebx + 0x28]
lea edi, [esi + 8]
test eax, eax
je 0x1000171c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x1004a4dc]
and dword [edi + 4], 0xfffffff8
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
test esi, esi
je 0x10001738
dec dword [esi + 0xb0]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call edi
mov esi, dword [0x1004a4dc]
add esp, 4
mov dword [0x1004a4dc], esi
call fcn.10008f30
mov dword [0x1004a4dc], 0
test esi, esi
je 0x1000177f
mov ecx, esi
call fcn.1001dc50
mov eax, dword [0x1004a4dc]
test eax, eax
je 0x10001779
dec dword [eax + 0xb0]
push esi
call edi
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x1004a4c0]
push 0xfffffffffffffffc
push dword [0x1004a4a4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [0x1004a4b0]
push str.SwapBuffers
push str.GDI32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, 0xffffffff
je 0x100017e6
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 7
push esi
call ebx
cmp eax, 0xffffffff
je 0x100017e6
mov eax, dword [edi]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov al, byte [edi + 6]
mov byte [esi + 6], al
push 0
push 0
push 0
push 0x100013d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003f434
mov esp, ebp
pop ebp
ret