Function at 0x10002850
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b097
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10071008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1007235c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 1
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x10021234
mov word [ecx], ax
call fcn.10001860
lea ecx, [ebp - 0x30]
call fcn.10004ff0
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 0x1000
push 0x401000
mov dword [ebp - 0x14], 0
call edi
mov eax, dword [0x10072348]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
ja case.default.0x10002938
jmp dword [eax*4 + 0x100036f0]
push ecx
push 0x55f2a8
mov edx, 0x100723ac
mov dword [0x10072374], 0x6db164
mov ecx, 0x10002820
call fcn.10006180
add esp, 8
test al, al
jne 0x10002975
push 0
push 0x10020fc0
push str.EnterSendPacket
push 0
call esi
push ecx
push 0x55f36d
mov edx, 0x100723a8
mov ecx, fcn.10002120
call fcn.10006180
add esp, 8
test al, al
jne 0x100029a1
push 0
push 0x10020fc0
push str.COutPacket
push 0
call esi
push ecx
push 0x40f287
mov edx, 0x10072350
mov ecx, 0x100021c0
call fcn.10006180
add esp, 8
test al, al
jne 0x100029cd
push 0
push 0x10020fc0
push str.Encode1
push 0
call esi
push ecx
push 0x402ffd
mov edx, 0x10072354
mov ecx, 0x10002210
call fcn.10006180
add esp, 8
test al, al
jne 0x100029f9
push 0
push 0x10020fc0
push str.Encode2
push 0
call esi
push ecx
push 0x403025
mov edx, 0x1007238c
mov ecx, 0x10002260
call fcn.10006180
add esp, 8
test al, al
jne 0x10002a25
push 0
push 0x10020fc0
push str.Encode4
push 0
call esi
push ecx
push 0x40f435
mov edx, 0x10072398
mov ecx, 0x100022f0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002a51
push 0
push 0x10020fc0
push str.EncodeWStr1
push 0
call esi
push ecx
push 0x55f357
mov edx, 0x10072388
mov ecx, 0x100023b0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002a7d
push 0
push 0x10020fc0
push str.DecodeHeader
push 0
call esi
push ecx
push 0x402efe
mov edx, 0x10072390
mov ecx, 0x10002450
call fcn.10006180
add esp, 8
test al, al
jne 0x10002aa9
push 0
push 0x10020fc0
push str.Decode1
push 0
call esi
push ecx
push 0x402f30
mov edx, 0x1007239c
mov ecx, 0x100024a0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002ad5
push 0
push 0x10020fc0
push str.Decode2
push 0
call esi
push ecx
push 0x402f63
mov edx, 0x10072358
mov ecx, 0x10002530
call fcn.10006180
add esp, 8
test al, al
jne 0x10002b01
push 0
push 0x10020fc0
push str.Decode4
push 0
call esi
push ecx
push 0x45bbcd
mov edx, 0x10072384
mov ecx, 0x100025c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002b2d
push 0
push 0x10020fc0
push str.DecodeWStr1
push 0
call esi
push ecx
push 0x40921a
mov edx, 0x100723a4
mov ecx, 0x10002660
call fcn.10006180
add esp, 8
test al, al
jne 0x10002b59
push 0
push 0x10020fc0
push str.DecodeWStr2
push 0
call esi
push ecx
push 0x402fc7
mov edx, 0x100723a0
mov ecx, 0x10002700
call fcn.10006180
add esp, 8
test al, al
jne 0x10002b85
push 0
push 0x10020fc0
push str.Decode8
push 0
call esi
push ecx
push 0x402f95
mov edx, 0x100723b0
mov ecx, 0x10002790
call fcn.10006180
add esp, 8
test al, al
jne 0x10002bb1
push 0
push 0x10020fc0
push str.DecodeFloat
push 0
call esi
mov dword [0x1007234c], 0x6db190
mov dword [0x10072380], 0x4c91b4
jmp case.default.0x10002938
push ecx
push 0x56aadb
mov edx, 0x100723ac
mov dword [0x10072374], 0x6faf44
mov ecx, 0x10002820
call fcn.10006180
add esp, 8
test al, al
jne 0x10002c00
push 0
push 0x10020fc0
push str.EnterSendPacket
push 0
call esi
push ecx
push 0x56aba0
mov edx, 0x100723a8
mov ecx, fcn.10002120
call fcn.10006180
add esp, 8
test al, al
jne 0x10002c2c
push 0
push 0x10020fc0
push str.COutPacket
push 0
call esi
push ecx
push 0x40eeb6
mov edx, 0x10072350
mov ecx, 0x100021c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002c58
push 0
push 0x10020fc0
push str.Encode1
push 0
call esi
push ecx
push 0x40346a
mov edx, 0x10072354
mov ecx, 0x10002210
call fcn.10006180
add esp, 8
test al, al
jne 0x10002c84
push 0
push 0x10020fc0
push str.Encode2
push 0
call esi
push ecx
push 0x403492
mov edx, 0x1007238c
mov ecx, 0x10002260
call fcn.10006180
add esp, 8
test al, al
jne 0x10002cb0
push 0
push 0x10020fc0
push str.Encode4
push 0
call esi
push ecx
push 0x413ecc
mov edx, 0x10072398
mov ecx, 0x100022f0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002cdc
push 0
push 0x10020fc0
push str.EncodeWStr1
push 0
call esi
push ecx
push 0x56ab8a
mov edx, 0x10072388
mov ecx, 0x100023b0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002d08
push 0
push 0x10020fc0
push str.DecodeHeader
push 0
call esi
push ecx
push 0x40336b
mov edx, 0x10072390
mov ecx, 0x10002450
call fcn.10006180
add esp, 8
test al, al
jne 0x10002d34
push 0
push 0x10020fc0
push str.Decode1
push 0
call esi
push ecx
push 0x40339d
mov edx, 0x1007239c
mov ecx, 0x100024a0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002d60
push 0
push 0x10020fc0
push str.Decode2
push 0
call esi
push ecx
push 0x4033d0
mov edx, 0x10072358
mov ecx, 0x10002530
call fcn.10006180
add esp, 8
test al, al
jne 0x10002d8c
push 0
push 0x10020fc0
push str.Decode4
push 0
call esi
push ecx
push 0x45cb52
mov edx, 0x10072384
mov ecx, 0x100025c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002db8
push 0
push 0x10020fc0
push str.DecodeWStr1
push 0
call esi
push ecx
push 0x408eef
mov edx, 0x100723a4
mov ecx, 0x10002660
call fcn.10006180
add esp, 8
test al, al
jne 0x10002de4
push 0
push 0x10020fc0
push str.DecodeWStr2
push 0
call esi
push ecx
push 0x403434
mov edx, 0x100723a0
mov ecx, 0x10002700
call fcn.10006180
add esp, 8
test al, al
jne 0x10002e10
push 0
push 0x10020fc0
push str.Decode8
push 0
call esi
push ecx
push 0x403402
mov edx, 0x100723b0
mov ecx, 0x10002790
call fcn.10006180
add esp, 8
test al, al
jne 0x10002e3c
push 0
push 0x10020fc0
push str.DecodeFloat
push 0
call esi
mov dword [0x1007234c], 0x6faf70
mov dword [0x10072380], 0x4cbe34
jmp case.default.0x10002938
push ecx
push 0x5ac927
mov edx, 0x100723ac
mov dword [0x10072374], 0x75cf84
mov ecx, 0x10002820
call fcn.10006180
add esp, 8
test al, al
jne 0x10002e8b
push 0
push 0x10020fc0
push str.EnterSendPacket
push 0
call esi
push ecx
push 0x5ac9ec
mov edx, 0x100723a8
mov ecx, fcn.10002120
call fcn.10006180
add esp, 8
test al, al
jne 0x10002eb7
push 0
push 0x10020fc0
push str.COutPacket
push 0
call esi
push ecx
push 0x417d30
mov edx, 0x10072350
mov ecx, 0x100021c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002ee3
push 0
push 0x10020fc0
push str.Encode1
push 0
call esi
push ecx
push 0x402262
mov edx, 0x10072354
mov ecx, 0x10002210
call fcn.10006180
add esp, 8
test al, al
jne 0x10002f0f
push 0
push 0x10020fc0
push str.Encode2
push 0
call esi
push ecx
push 0x40228a
mov edx, 0x1007238c
mov ecx, 0x10002260
call fcn.10006180
add esp, 8
test al, al
jne 0x10002f3b
push 0
push 0x10020fc0
push str.Encode4
push 0
call esi
push ecx
push 0x40fc19
mov edx, 0x10072398
mov ecx, 0x100022f0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002f67
push 0
push 0x10020fc0
push str.EncodeWStr1
push 0
call esi
push ecx
push 0x5ac9d6
mov edx, 0x10072388
mov ecx, 0x100023b0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002f93
push 0
push 0x10020fc0
push str.DecodeHeader
push 0
call esi
push ecx
push 0x402163
mov edx, 0x10072390
mov ecx, 0x10002450
call fcn.10006180
add esp, 8
test al, al
jne 0x10002fbf
push 0
push 0x10020fc0
push str.Decode1
push 0
call esi
push ecx
push 0x402195
mov edx, 0x1007239c
mov ecx, 0x100024a0
call fcn.10006180
add esp, 8
test al, al
jne 0x10002feb
push 0
push 0x10020fc0
push str.Decode2
push 0
call esi
push ecx
push 0x4021c8
mov edx, 0x10072358
mov ecx, 0x10002530
call fcn.10006180
add esp, 8
test al, al
jne 0x10003017
push 0
push 0x10020fc0
push str.Decode4
push 0
call esi
push ecx
push 0x43b921
mov edx, 0x10072384
mov ecx, 0x100025c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10003043
push 0
push 0x10020fc0
push str.DecodeWStr1
push 0
call esi
push ecx
push 0x469777
mov edx, 0x100723a4
mov ecx, 0x10002660
call fcn.10006180
add esp, 8
test al, al
jne 0x1000306f
push 0
push 0x10020fc0
push str.DecodeWStr2
push 0
call esi
push ecx
push 0x40222c
mov edx, 0x100723a0
mov ecx, 0x10002700
call fcn.10006180
add esp, 8
test al, al
jne 0x1000309b
push 0
push 0x10020fc0
push str.Decode8
push 0
call esi
push ecx
push 0x4021fa
mov edx, 0x100723b0
mov ecx, 0x10002790
call fcn.10006180
add esp, 8
test al, al
jne 0x100030c7
push 0
push 0x10020fc0
push str.DecodeFloat
push 0
call esi
mov dword [0x1007234c], 0x75cfac
mov dword [0x10072380], 0x4bb0a5
jmp case.default.0x10002938
push ecx
push 0x5cba0f
mov edx, 0x100723ac
mov dword [0x10072374], 0x75e184
mov ecx, 0x10002820
call fcn.10006180
add esp, 8
test al, al
jne 0x10003116
push 0
push 0x10020fc0
push str.EnterSendPacket
push 0
call esi
push ecx
push 0x5cbad4
mov edx, 0x100723a8
mov ecx, fcn.10002120
call fcn.10006180
add esp, 8
test al, al
jne 0x10003142
push 0
push 0x10020fc0
push str.COutPacket
push 0
call esi
push ecx
push 0x40705b
mov edx, 0x10072350
mov ecx, 0x100021c0
call fcn.10006180
add esp, 8
test al, al
jne 0x1000316e
push 0
push 0x10020fc0
push str.Encode1
push 0
call esi
push ecx
push 0x402249
mov edx, 0x10072354
mov ecx, 0x10002210
call fcn.10006180
add esp, 8
test al, al
jne 0x1000319a
push 0
push 0x10020fc0
push str.Encode2
push 0
call esi
push ecx
push 0x402271
mov edx, 0x1007238c
mov ecx, 0x10002260
call fcn.10006180
add esp, 8
test al, al
jne 0x100031c6
push 0
push 0x10020fc0
push str.Encode4
push 0
call esi
push ecx
push 0x4143dc
mov edx, 0x10072398
mov ecx, 0x100022f0
call fcn.10006180
add esp, 8
test al, al
jne 0x100031f2
push 0
push 0x10020fc0
push str.EncodeWStr1
push 0
call esi
push ecx
push 0x5cbabe
mov edx, 0x10072388
mov ecx, 0x100023b0
call fcn.10006180
add esp, 8
test al, al
jne 0x1000321e
push 0
push 0x10020fc0
push str.DecodeHeader
push 0
call esi
push ecx
push 0x40214a
mov edx, 0x10072390
mov ecx, 0x10002450
call fcn.10006180
add esp, 8
test al, al
jne 0x1000324a
push 0
push 0x10020fc0
push str.Decode1
push 0
call esi
push ecx
push 0x40217c
mov edx, 0x1007239c
mov ecx, 0x100024a0
call fcn.10006180
add esp, 8
test al, al
jne 0x10003276
push 0
push 0x10020fc0
push str.Decode2
push 0
call esi
push ecx
push 0x4021af
mov edx, 0x10072358
mov ecx, 0x10002530
call fcn.10006180
add esp, 8
test al, al
jne 0x100032a2
push 0
push 0x10020fc0
push str.Decode4
push 0
call esi
push ecx
push 0x44c2be
mov edx, 0x10072384
mov ecx, 0x100025c0
call fcn.10006180
add esp, 8
test al, al
jne 0x100032ce
push 0
push 0x10020fc0
push str.DecodeWStr1
push 0
call esi
push ecx
push 0x47b50e
mov edx, 0x100723a4
mov ecx, 0x10002660
call fcn.10006180
add esp, 8
test al, al
jne 0x100032fa
push 0
push 0x10020fc0
push str.DecodeWStr2
push 0
call esi
push ecx
push 0x402213
mov edx, 0x100723a0
mov ecx, 0x10002700
call fcn.10006180
add esp, 8
test al, al
jne 0x10003326
push 0
push 0x10020fc0
push str.Decode8
push 0
call esi
push ecx
push 0x4021e1
mov edx, 0x100723b0
mov ecx, 0x10002790
call fcn.10006180
add esp, 8
test al, al
jne 0x10003352
push 0
push 0x10020fc0
push str.DecodeFloat
push 0
call esi
mov dword [0x1007234c], 0x75e1ac
mov dword [0x10072380], 0x4d017c
jmp case.default.0x10002938
push ecx
push 0x593f4b
mov edx, 0x100723ac
mov dword [0x10072374], 0x731764
mov ecx, 0x10002820
call fcn.10006180
add esp, 8
test al, al
jne 0x100033a1
push 0
push 0x10020fc0
push str.EnterSendPacket
push 0
call esi
push ecx
push 0x594010
mov edx, 0x100723a8
mov ecx, fcn.10002120
call fcn.10006180
add esp, 8
test al, al
jne 0x100033cd
push 0
push 0x10020fc0
push str.COutPacket
push 0
call esi
push ecx
push 0x417d2c
mov edx, 0x10072350
mov ecx, 0x100021c0
call fcn.10006180
add esp, 8
test al, al
jne 0x100033f9
push 0
push 0x10020fc0
push str.Encode1
push 0
call esi
push ecx
push 0x401f89
mov edx, 0x10072354
mov ecx, 0x10002210
call fcn.10006180
add esp, 8
test al, al
jne 0x10003425
push 0
push 0x10020fc0
push str.Encode2
push 0
call esi
push ecx
push 0x401fb1
mov edx, 0x1007238c
mov ecx, 0x10002260
call fcn.10006180
add esp, 8
test al, al
jne 0x10003451
push 0
push 0x10020fc0
push str.Encode4
push 0
call esi
push ecx
push 0x40fca4
mov edx, 0x10072398
mov ecx, 0x100022f0
call fcn.10006180
add esp, 8
test al, al
jne 0x1000347d
push 0
push 0x10020fc0
push str.EncodeWStr1
push 0
call esi
push ecx
push 0x593ffa
mov edx, 0x10072388
mov ecx, 0x100023b0
call fcn.10006180
add esp, 8
test al, al
jne 0x100034a9
push 0
push 0x10020fc0
push str.DecodeHeader
push 0
call esi
push ecx
push 0x401e8a
mov edx, 0x10072390
mov ecx, 0x10002450
call fcn.10006180
add esp, 8
test al, al
jne 0x100034d5
push 0
push 0x10020fc0
push str.Decode1
push 0
call esi
push ecx
push 0x401ebc
mov edx, 0x1007239c
mov ecx, 0x100024a0
call fcn.10006180
add esp, 8
test al, al
jne 0x10003501
push 0
push 0x10020fc0
push str.Decode2
push 0
call esi
push ecx
push 0x401eef
mov edx, 0x10072358
mov ecx, 0x10002530
call fcn.10006180
add esp, 8
test al, al
jne 0x1000352d
push 0
push 0x10020fc0
push str.Decode4
push 0
call esi
push ecx
push 0x43b359
mov edx, 0x10072384
mov ecx, 0x100025c0
call fcn.10006180
add esp, 8
test al, al
jne 0x10003559
push 0
push 0x10020fc0
push str.DecodeWStr1
push 0
call esi
push ecx
push 0x468c36
mov edx, 0x100723a4
mov ecx, 0x10002660
call fcn.10006180
add esp, 8
test al, al
jne 0x10003585
push 0
push 0x10020fc0
push str.DecodeWStr2
push 0
call esi
push ecx
push 0x401f53
mov edx, 0x100723a0
mov ecx, 0x10002700
call fcn.10006180
add esp, 8
test al, al
jne 0x100035b1
push 0
push 0x10020fc0
push str.Decode8
push 0
call esi
push ecx
push 0x401f21
mov edx, 0x100723b0
mov ecx, 0x10002790
call fcn.10006180
add esp, 8
test al, al
jne 0x100035dd
push 0
push 0x10020fc0
push str.DecodeFloat
push 0
call esi
mov dword [0x1007234c], 0x73178c
mov dword [0x10072380], 0x4b202f
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 0x1000
push 0x401000
call edi
call fcn.10001c10
push 0
push 0
push 0
push 0x10004400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000362b
push eax
call edi
push 0x10
call fcn.1000e96c
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 3
xorps xmm0, xmm0
push dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, eax
push 0x100723b4
push 0x10003c50
movups xmmword [eax], xmm0
call fcn.10005fd0
mov byte [ebp - 4], 2
mov ecx, dword [0x10072550]
mov dword [ebp - 0x34], eax
cmp dword [0x10072554], ecx
je 0x1000367c
mov dword [ecx], eax
mov eax, dword [0x10072550]
add eax, 4
mov dword [0x10072550], eax
jmp 0x1000368b
lea eax, [ebp - 0x34]
push eax
push ecx
call fcn.10006220
mov eax, dword [0x10072550]
mov eax, dword [eax - 4]
cmp byte [eax + 0xc], 0
jne 0x100036a4
push 0
push 0x10020fc0
push 0x1002120c
push 0
call esi
push 0
push 0
push 0
push 0x10004270
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100036c0
push eax
call edi
lea ecx, [ebp - 0x20]
call fcn.100053f0
lea ecx, [ebp - 0x2c]
call fcn.100053f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e95b
mov esp, ebp
pop ebp
ret