Function at 0x1000d1e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10048400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100875ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100875a8
push 0
push 0
push 0x10001430
push 0
push 0
call esi
push 0x1008770c
push 0
push str.896501722023882812
push 0x10002e90
push 0
push 0
mov byte [0x10087704], 1
call esi
call fcn.10008e70
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x67c243
mov dword [ebp - 0xc], 0x67c243
call esi
test eax, eax
je 0x1000d293
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x100088b0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x64f700
push eax
push 0x40
push 5
push 0x64f700
call esi
test eax, eax
je 0x1000d2e6
mov eax, dword [ebp - 0xc]
mov ecx, 0x100019f0
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
call fcn.10001b10
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x560eb5
push eax
push 0x40
push 7
push 0x560eb5
call esi
test eax, eax
je 0x1000d345
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x10008930
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0xc]
call esi
call fcn.1000a670
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x61e1b7
push eax
push 0x40
push 6
push 0x61e1b7
call esi
test eax, eax
je 0x1000d39e
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x1000ba80
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x5d53c2
push eax
push 0x40
push 6
push 0x5d53c2
call esi
test eax, eax
je 0x1000d3f2
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x1000baa0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
call fcn.1000d040
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6becee
push eax
push 0x40
push 6
push 0x6becee
call esi
test eax, eax
je 0x1000d44b
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x10008780
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6c057a
push eax
push 0x40
push 8
push 0x6c057a
call esi
test eax, eax
je 0x1000d4a1
mov eax, dword [ebp - 0xc]
mov ecx, 0x100087a0
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6c0173
push eax
push 0x40
push 5
push 0x6c0173
call esi
test eax, eax
je 0x1000d4f4
mov eax, dword [ebp - 0xc]
mov ecx, 0x10008170
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6c04d6
push eax
push 0x40
push 7
push 0x6c04d6
call esi
test eax, eax
je 0x1000d54e
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x100081c0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x694df8
push eax
push 0x40
push 5
push 0x694df8
call esi
test eax, eax
je 0x1000d5a1
mov eax, dword [ebp - 0xc]
mov ecx, 0x100081f0
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
call fcn.100082e0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x624acf
push eax
push 0x40
push 9
push 0x624acf
call esi
test eax, eax
je 0x1000d603
mov eax, dword [ebp - 0xc]
mov ecx, 0x1000ccc0
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 9
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x624b4b
push eax
push 0x40
push 5
push 0x624b4b
call esi
test eax, eax
je 0x1000d656
mov eax, dword [ebp - 0xc]
mov ecx, 0x1000cd00
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6228d0
push eax
push 0x40
push 6
push 0x6228d0
call esi
test eax, eax
je 0x1000d6aa
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x1000cd10
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x6051f3
push eax
push 0x40
push 6
push 0x6051f3
call esi
test eax, eax
je 0x1000d6fe
mov eax, dword [ebp - 0xc]
mov edx, 0x90909090
mov ecx, 0x100093a0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x74b51d
push eax
push 0x40
push 8
push 0x74b51d
call esi
test eax, eax
je 0x1000d754
mov eax, dword [ebp - 0xc]
mov ecx, 0x10008b60
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x5dbd37
push eax
push 0x40
push 5
push 0x5dbd37
call esi
test eax, eax
je 0x1000d7a7
mov eax, dword [ebp - 0xc]
mov ecx, 0x10008680
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x562390
push eax
push 0x40
push 5
push 0x562390
call esi
test eax, eax
je 0x1000d7fa
mov eax, dword [ebp - 0xc]
mov ecx, 0x100014a0
sub ecx, eax
sub ecx, 5
mov dword [eax], 0x90909090
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0x90
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10017809
mov esp, ebp
pop ebp
ret