Function at 0x10021a60
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x10021b0a
push str.windmode.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 2
lea eax, [ebp - 0x30]
mov word [ebp - 0x30], 0x9066
push eax
push 0x41f86a
call edi
push eax
call esi
push 0
push 2
lea eax, [ebp - 0x30]
push eax
push 0x48b06d
call edi
push eax
call esi
push 0
push 2
lea eax, [ebp - 0x30]
push eax
push 0x41f86a
call edi
push eax
call esi
push 0
push 2
lea eax, [ebp - 0x30]
push eax
push 0x5e0edb
call edi
push eax
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x45e9e2
call ebx
lea eax, [ebp - 8]
mov byte [0x45e9e2], 3
push eax
push dword [ebp - 0xc]
push 1
push 0x45e9e2
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
push 0x4f064c
call ebx
mov eax, 0x4f064c
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 8
push 0x4f064c
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
push 0x4f58e1
call ebx
mov eax, 0x4f58e1
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 8
push 0x4f58e1
call ebx
push 0
push 1
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0xeb
push eax
push 0x4f4c88
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0xeb
push eax
push 0x4f8b14
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0xeb
push eax
push 0x4f4ce1
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0xeb
push eax
push 0x4f8b70
call edi
push eax
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x45121b
call ebx
mov eax, 0x45121b
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x45121b
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x4578e1
call ebx
mov eax, 0x4578e1
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x4578e1
call ebx
push 0
push 0xd
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x65746e69
push eax
push 0x65c470
mov dword [ebp - 0x18], 0x63616672
mov dword [ebp - 0x14], 0x7372642e
mov byte [ebp - 0x10], 0
call edi
push eax
call esi
call fcn.10021840
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x41bcd5
call ebx
mov byte [0x41bcd5], 0xe9
mov eax, 0x10021a20
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 0xffbe4326
mov dword [0x41bcd6], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x41bcd5
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4dabe5
call ebx
mov byte [0x4dabe5], 0xe9
mov eax, 0x10022000
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 0xffb25416
mov dword [0x4dabe6], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4dabe5
call ebx
call fcn.10021e00
push 0
push 1
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0xfa
push eax
push 0x4fe097
call edi
push eax
call esi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x4e5010
call ebx
mov byte [0x4e5010], 0xe9
mov eax, 0x10021db0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add eax, 0xffb1afeb
mov dword [0x4e5011], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push 5
push 0x4e5010
call ebx
push 0
push 6
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x5489f28b
push eax
push 0x4dddf4
mov word [ebp - 0x20], 0x1424
call edi
push eax
call esi
push 0
push 6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x5489f631
push eax
push 0x4dde03
mov word [ebp - 0x28], 0x1424
call edi
push eax
call esi
push 0
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0xe98bf98b
push eax
push 0x4e5063
call edi
push eax
call esi
push 0
push 7
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1bdff31
push eax
push 0x4e506c
mov word [ebp - 8], 0
mov byte [ebp - 6], 0
call edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret