Function at 0x100182a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x102e1790], 1
jne 0x100182c4
push 0x95dfd3
push 0x95dfbe
push 0xe9
call fcn.100d0e40
add esp, 0xc
cmp dword [0x102e16b8], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x100184ee
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89c6
call edi
lea eax, [ebp - 4]
mov byte [0x5b89c6], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89c6
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89cc
call edi
lea eax, [ebp - 4]
mov byte [0x5b89cc], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89cc
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89d2
call edi
lea eax, [ebp - 4]
mov byte [0x5b89d2], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89d2
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89d8
call edi
lea eax, [ebp - 4]
mov byte [0x5b89d8], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89d8
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89de
call edi
lea eax, [ebp - 4]
mov byte [0x5b89de], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89de
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5b89e4
call edi
lea eax, [ebp - 4]
mov byte [0x5b89e4], 0
push eax
push dword [ebp - 4]
push 1
push 0x5b89e4
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5b89ea
call edi
xor eax, eax
mov word [0x5b89ea], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 2
push 0x5b89ea
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c6316
call edi
lea eax, [ebp - 4]
mov byte [0x5c6316], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c6316
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c6329
call edi
lea eax, [ebp - 4]
mov byte [0x5c6329], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c6329
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c633c
call edi
lea eax, [ebp - 4]
mov byte [0x5c633c], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c633c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c634f
call edi
lea eax, [ebp - 4]
mov byte [0x5c634f], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c634f
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c6362
call edi
lea eax, [ebp - 4]
mov byte [0x5c6362], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c6362
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c6375
call edi
lea eax, [ebp - 4]
mov byte [0x5c6375], 0
push eax
push dword [ebp - 4]
push 1
push 0x5c6375
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5c6388
call edi
xor eax, eax
mov word [0x5c6388], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 2
push 0x5c6388
call edi
cmp dword [0x11473300], 1
jne 0x1001850c
push 0
push 0
push 0
push 0x10016180
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x11
push 0x96ae70
call edi
mov eax, 0x96ae70
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov byte [eax + 0x10], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x11
push 0x96ae70
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x96aa49
call edi
lea eax, [ebp - 4]
mov dword [0x96aa49], 0x101003c8
push eax
push dword [ebp - 4]
push 4
push 0x96aa49
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x96aad0
call edi
lea eax, [ebp - 4]
mov dword [0x96aad0], 0x101003c8
push eax
push dword [ebp - 4]
push 4
push 0x96aad0
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x96ab5c
call edi
lea eax, [ebp - 4]
mov dword [0x96ab5c], 0x101003d8
push eax
push dword [ebp - 4]
push 4
push 0x96ab5c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d1d0c
call edi
lea eax, [ebp - 4]
mov dword [0x4d1d0c], 0x101003ec
push eax
push dword [ebp - 4]
push 4
push 0x4d1d0c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7af176
call edi
lea eax, [ebp - 4]
mov byte [0x7af176], 0xa
push eax
push dword [ebp - 4]
push 1
push 0x7af176
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7af416
call edi
lea eax, [ebp - 4]
mov byte [0x7af416], 0xa
push eax
push dword [ebp - 4]
push 1
push 0x7af416
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7af796
call edi
lea eax, [ebp - 4]
mov byte [0x7af796], 0xa
push eax
push dword [ebp - 4]
push 1
push 0x7af796
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7b0316
call edi
lea eax, [ebp - 4]
mov byte [0x7b0316], 0xa
push eax
push dword [ebp - 4]
push 1
push 0x7b0316
call edi
mov esi, dword [0x102e17cc]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x405b7c
call edi
lea eax, [ebp - 4]
mov dword [0x405b7c], esi
push eax
push dword [ebp - 4]
push 4
push 0x405b7c
call edi
mov esi, dword [0x102e17cc]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40cc40
call edi
lea eax, [ebp - 4]
mov dword [0x40cc40], esi
push eax
push dword [ebp - 4]
push 4
push 0x40cc40
call edi
push 0x10018e70
push 0x40b154
push 0xe9
call fcn.100d0e40
push 0x100d0dd0
push 0x64a79a
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x64a85f
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x656e03
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x64ab3d
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x64ac02
push 0xff
call fcn.100d0e40
add esp, 0x48
push 0x100d0dd0
push 0x63ddf2
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x63df89
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x63ea4c
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x64ca0c
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x77faf9
push 0xff
call fcn.100d0e40
push 0x100d0dd0
push 0x81071b
push 0xff
call fcn.100d0e40
add esp, 0x48
push 0x100d0dd0
push 0x81079b
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x47fe31
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x59890d
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x59a399
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x59a93c
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x59b13b
push 0xff
call fcn.100d0e40
add esp, 0x48
push 0x10018df0
push 0x5a4261
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x5a4d52
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x5b6117
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x65a6ce
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x727987
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x7861f1
push 0xff
call fcn.100d0e40
add esp, 0x48
push 0x10018df0
push 0x7d32fa
push 0xff
call fcn.100d0e40
push 0x10018df0
push 0x7d3b0d
push 0xff
call fcn.100d0e40
push 0x10018ef0
push 0x8317bd
push 0xe9
call fcn.100d0e40
push 0x10018f20
push 0x7d2b0c
push 0xe8
call fcn.100d0e40
add esp, 0x30
cmp dword [0x102e17dc], 1
pop esi
jne 0x10018942
push 0x10019030
push 0x6d92d9
push 0xe9
call fcn.100d0e40
add esp, 0xc
cmp dword [0x114732fc], 1
jne 0x10018974
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d0e17
call edi
lea eax, [ebp - 4]
mov dword [0x4d0e17], 0x10016010
push eax
push dword [ebp - 4]
push 4
push 0x4d0e17
call edi
cmp dword [0x102e1844], 1
jne 0x100189a8
push 0x100438a0
push 0x634215
push 0xe8
call fcn.100d0e40
push fcn.100436c0
push 0x402320
push 0xe9
call fcn.100d0e40
add esp, 0x18
push 0x10019070
push 0x4dad88
push 0xe8
call fcn.100d0e40
push 0x10018f60
push 0x401d17
push 0xe9
call fcn.100d0e40
push 0x100191c0
push 0x5528a0
push 0xe9
call fcn.100d0e40
add esp, 0x24
cmp dword [0x102e16bc], 1
jne 0x10018a16
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5528a0
call edi
lea eax, [ebp - 4]
mov byte [0x5528a0], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x5528a0
call edi
cmp dword [0x114732f8], 0
je 0x10018a45
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x77135c
call edi
lea eax, [ebp - 4]
mov byte [0x77135c], 0
push eax
push dword [ebp - 4]
push 1
push 0x77135c
call edi
cmp dword [0x114732f4], 0
je 0x10018a74
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x74cd82
call edi
lea eax, [ebp - 4]
mov byte [0x74cd82], 0
push eax
push dword [ebp - 4]
push 1
push 0x74cd82
call edi
cmp dword [0x114732f0], 0
je 0x10018aa6
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x72d1bd
call edi
lea eax, [ebp - 4]
mov dword [0x72d1bd], 0x1f4
push eax
push dword [ebp - 4]
push 4
push 0x72d1bd
call edi
cmp dword [0x11336fec], 0
je 0x10018b36
cmp dword [0x102e1988], 0
jne 0x10018b10
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x51ec90
call edi
lea eax, [ebp - 4]
mov byte [0x51ec90], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x51ec90
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x588661
call edi
mov eax, 0x588661
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x588661
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4efeb0
call edi
lea eax, [ebp - 4]
mov byte [0x4efeb0], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x4efeb0
call edi
push 0x100c7680
push 0x63cec5
push 0xe8
call fcn.100d0e40
push 0x5e620a
push 0x5e49f2
push 0xe9
call fcn.100d0e40
push 0x10018db0
push 0x786a2d
push 0xe8
call fcn.100d0e40
add esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x49af65
call edi
lea eax, [ebp - 4]
mov byte [0x49af65], 0x64
push eax
push dword [ebp - 4]
push 1
push 0x49af65
call edi
cmp dword [0x102e18b0], 1
jne 0x10018bcf
push 0x831999
push 0x831936
push 0xe9
call fcn.100d0e40
push 0x832ace
push 0x832a6b
push 0xe9
call fcn.100d0e40
add esp, 0x18
cmp dword [0x102e18dc], 1
jne 0x10018c03
push 0x100195f0
push 0x8318fa
push 0xe9
call fcn.100d0e40
push 0x10019620
push 0x8329b6
push 0xe9
call fcn.100d0e40
add esp, 0x18
push 0x100195e0
push 0x6340c5
push 0xe8
call fcn.100d0e40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5b57ed
call edi
lea eax, [ebp - 4]
mov dword [0x5b57ed], 0x400
push eax
push dword [ebp - 4]
push 4
push 0x5b57ed
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x589dbe
call edi
lea eax, [ebp - 4]
mov dword [0x589dbe], 0x400
push eax
push dword [ebp - 4]
push 4
push 0x589dbe
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d2cb2
call edi
lea eax, [ebp - 4]
mov dword [0x4d2cb2], 0x3800
push eax
push dword [ebp - 4]
push 4
push 0x4d2cb2
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d2d9c
call edi
lea eax, [ebp - 4]
mov dword [0x4d2d9c], 0x3800
push eax
push dword [ebp - 4]
push 4
push 0x4d2d9c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd487a8
call edi
lea eax, [ebp - 4]
mov dword [0xd487a8], 0x42c66666
push eax
push dword [ebp - 4]
push 4
push 0xd487a8
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd487a8
call edi
lea eax, [ebp - 4]
mov dword [0xd487a8], 0x42c66666
push eax
push dword [ebp - 4]
push 4
push 0xd487a8
call edi
push 0x10019650
push 0x5977ef
push 0xe8
call fcn.100d0e40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x78f575
call edi
lea eax, [ebp - 4]
mov byte [0x78f575], 0x8d
push eax
push dword [ebp - 4]
push 1
push 0x78f575
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x78f570
call edi
lea eax, [ebp - 4]
mov byte [0x78f570], 0x20
push eax
push dword [ebp - 4]
push 1
push 0x78f570
call edi
cmp dword [0x102e19bc], 1
jne 0x10018da2
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7f14d9
call edi
lea eax, [ebp - 4]
mov byte [0x7f14d9], 1
push eax
push dword [ebp - 4]
push 1
push 0x7f14d9
call edi
pop edi
mov esp, ebp
pop ebp
ret