Function at 0x1000fd20
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x558ea8
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x558ea8], 0xa0
mov edx, dword [ebp - 8]
push edx
push 1
push 0x558ea8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x406f36
call esi
mov bl, 0xeb
lea ecx, [ebp - 8]
push ecx
mov byte [0x406f36], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x406f36
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x406f5f
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x406f5f], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x406f5f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x406f9b
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x406f9b], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x406f9b
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x41ecb5
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x41ecb5], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x41ecb5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x41ed25
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x41ed25], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x41ed25
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x41ed5e
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x41ed5e], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x41ed5e
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x41efb5
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x41efb5], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x41efb5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x53d90b
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x53d90b], bl
mov edx, dword [ebp - 8]
push edx
push 1
push 0x53d90b
call esi
mov al, byte [0x100dd6c0]
inc al
mov byte [ebp - 4], al
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x55961c
call esi
movzx ecx, byte [ebp - 4]
lea edx, [ebp - 8]
push edx
mov byte [0x55961c], cl
mov eax, dword [ebp - 8]
push eax
push 1
push 0x55961c
call esi
mov al, byte [0x100dd6c2]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 1
add al, 2
push 0x55961d
mov byte [ebp - 4], al
call esi
movzx edx, byte [ebp - 4]
lea eax, [ebp - 8]
mov byte [0x55961d], dl
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x55961d
call esi
mov al, byte [0x100dd6c3]
lea edx, [ebp - 8]
push edx
push 0x40
push 1
add al, 3
push 0x55961e
mov byte [ebp - 4], al
call esi
movzx eax, byte [ebp - 4]
lea ecx, [ebp - 8]
push ecx
mov byte [0x55961e], al
mov edx, dword [ebp - 8]
push edx
push 1
push 0x55961e
call esi
mov al, byte [0x100dd6c5]
add al, 4
mov byte [ebp - 4], al
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x55961f
call esi
movzx ecx, byte [ebp - 4]
lea edx, [ebp - 8]
push edx
mov byte [0x55961f], cl
mov eax, dword [ebp - 8]
push eax
push 1
push 0x55961f
call esi
mov al, byte [0x100dd6c6]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 1
add al, 5
push 0x559620
mov byte [ebp - 4], al
call esi
movzx edx, byte [ebp - 4]
lea eax, [ebp - 8]
push eax
mov byte [0x559620], dl
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x559620
call esi
mov di, word [0x100dd6be]
lea edx, [ebp - 8]
push edx
push 0x40
push 2
push 0x5615bc
call esi
lea eax, [ebp - 8]
push eax
mov word [0x5615bc], di
mov ecx, dword [ebp - 8]
push ecx
push 2
push 0x5615bc
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 4
push 0x5267b2
call esi
mov dword [0x5267b2], 0x100dd6f9
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push 0x5267b2
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 0x20
push 0x558ed8
call esi
push 0x20
push 0x100dd69e
push 0x558ed8
call sub.MSVCR100.dll_memcpy
mov ecx, dword [ebp - 8]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ecx
push 0x20
push 0x558ed8
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 0x11
push 0x559624
call esi
mov ecx, dword [0x100dd6c8]
mov eax, 0x559624
mov dword [eax], ecx
mov edx, dword [0x100dd6cc]
mov dword [eax + 4], edx
mov ecx, dword [0x100dd6d0]
mov dword [eax + 8], ecx
mov edx, dword [0x100dd6d4]
mov dword [eax + 0xc], edx
movzx ecx, byte [0x100dd6d8]
lea edx, [ebp - 8]
push edx
mov byte [eax + 0x10], cl
mov eax, dword [ebp - 8]
push eax
push 0x11
push 0x559624
call esi
lea ecx, [ebp - 8]
push ecx
push 0x40
push 5
push 0x4127b0
call esi
mov ecx, 0x4127b0
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 8]
push edx
mov byte [ecx + 4], al
mov eax, dword [ebp - 8]
push eax
push 5
push ecx
call esi
lea ecx, [ebp - 8]
push ecx
push 0x40
push 1
push 0x41f0ac
call esi
lea edx, [ebp - 8]
push edx
mov byte [0x41f0ac], 4
mov eax, dword [ebp - 8]
push eax
push 1
push 0x41f0ac
call esi
lea ecx, [ebp - 8]
push ecx
push 0x40
push 1
push 0x41f0ed
call esi
lea edx, [ebp - 8]
push edx
mov byte [0x41f0ed], 4
mov eax, dword [ebp - 8]
push eax
push 1
push 0x41f0ed
call esi
lea ecx, [ebp - 8]
push ecx
push 0x40
push 1
push 0x41f12e
call esi
lea edx, [ebp - 8]
push edx
mov byte [0x41f12e], 4
mov eax, dword [ebp - 8]
push eax
push 1
push 0x41f12e
call esi
push 0x524231
push 0x524146
push 0xe9
call fcn.10026600
push 0x522953
push 0x52292e
push 0xe9
call fcn.10026600
push 0x5242b8
push 0x524293
push 0xe9
call fcn.10026600
add esp, 0x24
lea ecx, [ebp - 8]
push ecx
push 0x40
push 2
push 0x444b76
call esi
mov edx, 0x19eb
lea eax, [ebp - 8]
push eax
mov word [0x444b76], dx
mov ecx, dword [ebp - 8]
push ecx
push 2
push 0x444b76
call esi
push 0x100104a0
push 0x526a5a
push 0xe9
call fcn.10026600
add esp, 0xc
push 0
push 0
push 0
push 0x100104c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x430b9f
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x430b9f], 0x90
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x430b9f
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 7
push 0x430bbd
call esi
mov eax, 0x90909090
mov ecx, 0x430bbd
mov dword [ecx], eax
mov word [ecx + 4], ax
mov byte [ecx + 6], al
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 7
push 0x430bbd
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x4335fc
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x4335fc], 0x90
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x4335fc
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x433621
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x433621], 0x90
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x433621
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 6
push 0x433635
call esi
mov eax, 0x90909090
mov ecx, 0x433635
mov dword [ecx], eax
mov word [ecx + 4], ax
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 6
push 0x433635
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x492ebd
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x492ebd], 0x90
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x492ebd
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 7
push 0x492edb
call esi
mov eax, 0x90909090
mov ecx, 0x492edb
mov dword [ecx], eax
mov word [ecx + 4], ax
mov byte [ecx + 6], al
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 7
push 0x492edb
call esi
push 0x10010500
push 0x4cbb15
push 0xe9
call fcn.10026600
add esp, 0xc
lea edx, [ebp - 8]
push edx
push 0x40
push 7
push 0x42f2df
call esi
mov eax, 0x90909090
mov ecx, 0x42f2df
mov dword [ecx], eax
mov word [ecx + 4], ax
mov byte [ecx + 6], al
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push 7
push 0x42f2df
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x515bf7
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x515bf7], bl
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x515bf7
call esi
push 0x10010550
push 0x42b33d
push 0xe8
call fcn.10026600
push 0x10010580
push 0x483ac5
push 0xe9
call fcn.10026600
push 0x100105a0
push 0x4424b4
push 0xe9
call fcn.10026600
add esp, 0x24
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x50e5f9
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x50e5f9], bl
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x50e5f9
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 4
push 0x50e624
call esi
lea eax, [ebp - 8]
push eax
mov dword [0x50e624], 0x10029d08
mov ecx, dword [ebp - 8]
push ecx
push 4
push 0x50e624
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 4
push 0x50e649
call esi
lea eax, [ebp - 8]
push eax
mov dword [0x50e649], 0x10029d24
mov ecx, dword [ebp - 8]
push ecx
push 4
push 0x50e649
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 1
push 0x50e663
call esi
lea eax, [ebp - 8]
push eax
mov byte [0x50e663], bl
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x50e663
call esi
lea edx, [ebp - 8]
push edx
push 0x40
push 4
push 0x50e68e
call esi
lea eax, [ebp - 8]
push eax
mov dword [0x50e68e], 0x10029d40
mov ecx, dword [ebp - 8]
push ecx
push 4
push 0x50e68e
call esi
push 0x100105f0
push 0x50e636
push 0xe8
call fcn.10026600
push 0x100107d0
push 0x50e658
push 0xe8
call fcn.10026600
push 0x10010a50
push 0x50e6a0
push 0xe8
call fcn.10026600
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret