Function at 0x70e808a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x70e95a78
push 0x70e888d0
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x70e97050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x40], 0x7afd000c
xor edi, edi
cmp dword [0x70ea15e8], edi
jne 0x70e80df4
mov dword [0x70ea15e8], 1
call fcn.70e80f10
cmp dword [0x70ea0ea8], 0x601
jb 0x70e8090d
push 0x70e93924
jmp 0x70e80912
push 0x70e935d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x70e8092f
push str.GetModuleHandleExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x70ea1624], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov dword [0x70ea0eac], eax
mov dword [0x70ea0eb0], eax
mov dword [0x70ea0eb4], eax
mov dword [0x70ea0eb8], eax
mov dword [0x70ea0ebc], eax
mov dword [0x70ea0ec0], eax
mov dword [0x70ea0ec4], eax
mov dword [0x70ea0ec8], eax
mov dword [0x70ea0ecc], eax
push 0x70e935d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call ebx
mov esi, eax
mov eax, str.GetNativeSystemInfo
call fcn.70e731f0
mov dword [0x70ea1608], eax
cmp eax, edi
je 0x70e8098e
push 0x70ea0eac
call eax
push 0x114
push edi
push 0x70ea0ed0
call fcn.70e899f0
add esp, 0xc
mov dword [0x70ea0ed0], 0x114
push 0x70ea0ed0
call dword [0x70ea11b8]
mov eax, dword [0x70ea0ed4]
shl eax, 8
or eax, dword [0x70ea0ed8]
mov dword [0x70ea0ea8], eax
push 0x70e90b5c
call ebx
mov esi, eax
mov eax, str.NtDeviceIoControlFile
call fcn.70e731f0
mov esi, eax
cmp esi, edi
je 0x70e80a08
push 0x40
push 0x3000
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x70ea123c], eax
cmp eax, edi
je 0x70e80a08
mov ecx, 0xc
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
push str.._aswSP_Open
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call esi
mov dword [0x70ea15f4], eax
cmp eax, 0xffffffff
jne 0x70e80a34
mov dword [0x70ea15f4], edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push str.._aswSnx
call esi
mov dword [0x70ea15f0], eax
cmp eax, 0xffffffff
jne 0x70e80a5b
xor eax, eax
mov dword [0x70ea15f0], eax
cmp dword [0x70ea15f4], edi
jne 0x70e80a71
cmp eax, edi
jne 0x70e80a71
mov eax, 5
jmp 0x70e80df6
cmp dword [0x70ea0ea8], 0x502
jne 0x70e80b9f
mov ecx, 9
cmp cx, word [0x70ea0eac]
jne 0x70e80b9f
mov dword [ebp - 0x40], 0x7afd0008
mov dword [ebp - 4], edi
push edi
call ebx
mov ebx, eax
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x70e80b91
cmp dword [eax + 0x74], 1
jbe 0x70e80b91
cmp dword [eax + 0x84], edi
je 0x70e80b91
mov eax, dword [eax + 0x80]
cmp eax, edi
je 0x70e80b91
lea esi, [eax + ebx - 0x58]
cmp dword [esi], 0x20424949
jne 0x70e80b91
cmp dword [esi + 4], edi
je 0x70e80b91
push edi
push 0x1c
lea edx, [ebp - 0x84]
push edx
push edi
push 0xfffffffffffffffe
call dword [0x70ea11b4]
mov dword [ebp - 0x68], eax
cmp eax, edi
jl 0x70e80b91
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x64], eax
xor edi, edi
lea eax, [esi + 0x58]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edi
cmp dword [eax + 0xc], 0
je 0x70e80b2b
add eax, 0x14
inc edi
jmp 0x70e80b19
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
cmp edx, dword [eax + 4]
jae 0x70e80b91
lea ecx, [esi + 0x6c]
mov edx, dword [ebp - 0x34]
cmp dword [edx], ecx
jb 0x70e80b82
lea eax, [edi + edi*4]
lea ecx, [esi + eax*4 + 0x58]
mov edx, dword [ebp - 0x34]
cmp dword [edx], ecx
jae 0x70e80b82
mov eax, 0xffffff94
sub eax, esi
mov ecx, dword [ebp - 0x34]
add eax, dword [ecx]
xor edx, edx
mov ecx, 0x14
div ecx
test edx, edx
jne 0x70e80b82
mov edx, dword [esi + 4]
sub edx, esi
lea ecx, [edx + ebx - 0x6c]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, ecx
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
add dword [ebp - 0x34], 4
jmp 0x70e80b31
mov dword [ebp - 4], 0xfffffffe
xor edi, edi
mov eax, dword [0x70ea15f0]
push edi
lea esi, [ebp - 0x38]
xor ecx, ecx
cmp eax, edi
je 0x70e80bcd
mov ebx, dword [ebp - 0x40]
push ebx
push eax
xor eax, eax
xor edx, edx
call fcn.70e73160
add esp, 0xc
test eax, eax
jne 0x70e80be3
mov eax, dword [0x70ea15f4]
cmp eax, edi
je 0x70e80be3
push edi
push ebx
xor ecx, ecx
jmp 0x70e80bd6
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [0x70ea15f4]
push eax
xor eax, eax
xor edx, edx
call fcn.70e73160
add esp, 0xc
cmp dword [0x70ea15f4], edi
je 0x70e80c67
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x50], 0x70e9f278
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
lea ecx, [ebp - 0x58]
push ecx
push 0x20019
lea edx, [ebp - 0x3c]
push edx
call dword [0x70ea1188]
cmp eax, edi
jl 0x70e80c67
lea eax, [ebp - 0x38]
push eax
push 0x14
lea ecx, [ebp - 0x30]
push ecx
push 2
push 0x70e9f280
mov edx, dword [ebp - 0x3c]
push edx
call dword [0x70ea1194]
cmp eax, edi
jl 0x70e80c5d
mov eax, 4
cmp dword [ebp - 0x2c], eax
jne 0x70e80c5d
cmp dword [ebp - 0x28], eax
jne 0x70e80c5d
xor eax, eax
cmp dword [ebp - 0x24], 1
sete al
or dword [0x70ea1600], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [0x70ea11a4]
cmp dword [0x70ea15f0], edi
je 0x70e80c90
mov ecx, 0x70ea0fe8
call fcn.70e85f30
test eax, eax
jne 0x70e80c90
mov edx, dword [0x70ea0fec]
neg edx
sbb edx, edx
and edx, 2
or dword [0x70ea1600], edx
test byte [0x70ea1600], 3
je 0x70e80a67
call fcn.70e81710
mov al, byte [0x70ea1600]
test al, 1
je 0x70e80d97
test al, 2
jne 0x70e80d97
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x50], 0x70e9f278
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
lea eax, [ebp - 0x58]
push eax
push 0x20019
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x70ea1188]
cmp eax, edi
jl 0x70e80d97
lea edx, [ebp - 0x38]
push edx
push edi
push edi
push 2
push 0x70e9f288
mov eax, dword [ebp - 0x3c]
push eax
call dword [0x70ea1194]
cmp eax, 0xc0000023
jne 0x70e80d8d
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.70e866e8
add esp, 4
mov dword [0x70ea1604], eax
cmp eax, edi
je 0x70e80d8d
mov esi, eax
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x38]
push eax
push esi
push 2
push 0x70e9f288
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [0x70ea1194]
cmp eax, edi
jl 0x70e80d8d
cmp dword [ebp - 0x38], 0x10
jbe 0x70e80d8d
cmp dword [esi + 4], 7
jne 0x70e80d8d
xor eax, eax
test dword [esi + 8], 0xfffffffe
jbe 0x70e80d72
lea edi, [esi + 0xc]
mov ecx, edi
nop
mov dl, byte [ecx]
mov byte [edi + eax], dl
inc eax
add ecx, 2
mov edx, dword [esi + 8]
shr edx, 1
cmp eax, edx
jb 0x70e80d60
mov eax, dword [esi + 8]
shr eax, 1
push eax
add esi, 0xc
push esi
mov ecx, dword [0x70ea1604]
push ecx
call fcn.70e86c80
add esp, 0xc
xor edi, edi
mov edx, dword [ebp - 0x3c]
push edx
call dword [0x70ea11a4]
test byte [0x70ea1600], 2
je 0x70e80dd8
push edi
push edi
push edi
push 0x70e81200
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x70e80dbd
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x70ea0970
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call esi
push 0x70ea0988
call esi
push 0x70ea0908
call esi
mov eax, dword [0x70ea11bc]
cmp eax, edi
je 0x70e80def
push 0x70ea15ec
push edi
push 0x70e78560
push edi
call eax
call fcn.70e72660
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.70e8654c
mov esp, ebp
pop ebp
ret