Function at 0x1000749b
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push 0xa4
mov eax, 0x1000c4ab
call fcn.1000bcec
mov ebx, 0xe8
mov edx, 0x10007328
push ebx
mov ecx, 0x44a930
xor edi, edi
call fcn.10008a3e
pop ecx
push 0x7d
pop esi
push edi
sub esp, 0xc
mov dword [ebp - 0x28], 0x7a
mov ecx, esp
mov dword [ebp - 0x24], 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0x6e
lea edx, [ebp - 0x28]
mov dword [ebp - 0x1c], esi
push ecx
push eax
push edx
mov dword [ebp - 0x18], 0x80
call fcn.10003082
lea ecx, [ebp - 0x8c]
call fcn.10008995
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1000750e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x8c]
call fcn.1000318e
push 0x72
pop ecx
sub esp, 0xc
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], ecx
lea eax, [ecx + 0x3f]
mov dword [ebp - 0x74], 0xba
lea edx, [ecx + 0xe]
mov dword [ebp - 0x50], eax
mov ecx, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x44], edx
lea edx, [ebp - 0x74]
push eax
push edx
mov dword [ebp - 0x70], 0x4d
mov dword [ebp - 0x6c], 0xae
mov dword [ebp - 0x68], 0xbd
mov dword [ebp - 0x64], 0xc0
mov dword [ebp - 0x60], 0x7c
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x7f
call fcn.10003082
lea ecx, [ebp - 0x8c]
call fcn.10008995
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x100075a4
mov eax, dword [eax]
mov edx, eax
mov ecx, 0x56c8a8
call fcn.10008b9d
lea ecx, [ebp - 0x8c]
call fcn.1000318e
push ebx
mov edx, 0x1000707b
mov ecx, 0x429175
call fcn.10008a3e
pop ecx
push ebx
mov edx, 0x100071a4
mov ecx, 0x42f88b
call fcn.10008a3e
pop ecx
mov dl, 0xeb
mov ecx, 0x43748d
call fcn.10008b19
mov dl, 0x97
mov ecx, 0x4987b8
call fcn.10008b19
mov dl, 0x30
mov ecx, 0x498cd9
call fcn.10008b19
xor dl, dl
mov ecx, 0x44d8b8
call fcn.10008b19
mov edx, 0x1000d5a4
mov ecx, 0x55eb80
call fcn.10008b9d
sub esp, 0xc
mov dword [ebp - 0x2c], 0x77
mov ecx, esp
mov dword [ebp - 0x28], 0x32
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], 0xaa
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0xa2
push ecx
push eax
push edx
mov dword [ebp - 0x1c], 0x61
mov dword [ebp - 0x18], 0x9a
call fcn.10003082
lea ecx, [ebp - 0x8c]
call fcn.10008995
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1000766f
mov eax, dword [eax]
mov edx, eax
mov ecx, 0x55f0cc
call fcn.10008b9d
lea ecx, [ebp - 0x8c]
call fcn.1000318e
push ebx
mov edx, 0x100072a0
mov ecx, 0x40ed92
call fcn.10008a3e
pop ecx
mov esi, 0x10007261
mov ecx, 0x40c939
push ebx
mov edx, esi
call fcn.10008a3e
pop ecx
push ebx
mov edx, esi
mov ecx, 0x40cb27
call fcn.10008a3e
pop ecx
push ebx
mov edx, 0x100072dd
mov ecx, 0x40f1ec
call fcn.10008a3e
pop ecx
push ebx
mov edx, 0x1000661a
mov ecx, 0x436590
call fcn.10008a3e
pop ecx
push ebx
mov edx, 0x1000662c
mov ecx, 0x42a79c
call fcn.10008a3e
pop ecx
push ebx
mov edx, 0x1000655c
mov ecx, 0x4ab834
call fcn.10008a3e
pop ecx
mov esi, 0x304
mov ecx, 0x41398f
push 2
mov edx, esi
call fcn.10008b5a
pop ecx
push 2
mov edx, esi
mov ecx, 0x4140fb
call fcn.10008b5a
pop ecx
push 4
call fcn.1000ab6e
pop ecx
mov dword [ebp - 0x9c], eax
mov dword [eax], 0x100052fe
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0x10007f78
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x100079ef
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xa0], 0
jne 0x10007773
push ecx
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
pop ecx
pop ecx
test eax, eax
je 0x1000778d
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x90]
push eax
push 4
push 4
mov esi, 0x55b5e0
mov dword [ebp - 0xa4], edi
push esi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x94], 0x10005869
call ebx
mov edi, dword [sym.imp.VCRUNTIME140.dll_memcpy]
lea eax, [ebp - 0x94]
push 4
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x90]
push 4
push esi
call ebx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 0x100058c2
push eax
push 4
push 4
add esi, 0x2c
push esi
call ebx
push 4
lea eax, [ebp - 0x94]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x90]
push 4
push esi
call ebx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 0x100057ec
push eax
push 4
push 4
mov esi, 0x55b580
push esi
call ebx
push 4
lea eax, [ebp - 0x94]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x90]
push 4
push esi
call ebx
lea eax, [ebp - 0xac]
mov esi, 0x10006225
push eax
push 0x80
push 4
mov eax, 0x4495c0
sub esi, 0x4495c4
push eax
call ebx
push 4
lea eax, [ebp - 0xa8]
push 0x4495c0
push eax
call edi
mov eax, dword [ebp - 0xa8]
add esp, 0xc
add eax, 0x4495c4
mov dword [0x10011700], eax
mov ecx, 0x4495c0
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xac]
mov dword [ecx], esi
push 5
push ecx
call ebx
lea eax, [ebp - 0x90]
push eax
push 0x40
push 0x15a000
push 0x401000
call ebx
mov esi, 0x4e1ba0
mov ecx, 0x48b7a5
push 0xe8
mov edx, esi
call fcn.10008a3e
pop ecx
push 3
pop edx
mov ecx, 0x48b7aa
call fcn.10008ace
xor edx, edx
mov dword [0x4d1624], 0xfc8a448b
inc edx
mov ecx, 0x4d1628
call fcn.10008ace
mov edi, 0xe9
mov edx, 0x55aaa0
push edi
mov ecx, 0x4d1752
call fcn.10008a3e
pop ecx
push 4
pop edx
mov ecx, 0x4d1757
call fcn.10008ace
push 0xe8
mov edx, esi
mov ecx, 0x4d177b
call fcn.10008a3e
pop ecx
mov eax, 0x489
xor edx, edx
mov word [0x4d1786], ax
inc edx
mov ecx, 0x4d1789
mov byte [0x4d1788], 0x8a
call fcn.10008ace
lea esi, [edi - 1]
mov dword [0x55aaa0], 0xbd048d3e
push esi
mov edx, 0x523817
mov byte [0x55aaa8], 0x50
mov ecx, 0x55aaa9
call fcn.10008a3e
pop ecx
push edi
mov edx, 0x4d175b
mov ecx, 0x55aaae
call fcn.10008a3e
pop ecx
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x90]
push 0x15a000
push 0x401000
call ebx
push esi
mov edx, 0x10008312
mov ecx, 0x48b7fe
call fcn.10008a3e
pop ecx
push esi
mov edx, 0x10008326
mov ecx, 0x48b7a5
call fcn.10008a3e
pop ecx
push esi
mov edx, 0x1000850c
mov ecx, 0x48d5a7
call fcn.10008a3e
cmp dword [ebp - 0xa0], 0
pop ecx
je 0x100079fc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov dword [ebp - 0xa0], edi
push 6
jmp 0x1000776d
call fcn.1000bcaa
ret