Function at 0x10009d60
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x1001700c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
call fcn.10003260
cmp byte [0x10017ff6], 0
jne 0x10009d90
call fcn.10003a40
nop word [eax + eax]
push 0x1000e540
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x10009d90
mov edi, ebx
xor esi, esi
sub edi, str.xx____xx____xx
mov dword [esp + 0x10], edi
nop
lea eax, [esi + ebx]
mov edx, 0x1000e55c
mov dword [esp + 0xc], eax
mov cl, 0x78
mov eax, str.xx____xx____xx
add edi, esi
cmp cl, 0x78
jne 0x10009dd5
mov cl, byte [edi + eax]
cmp cl, byte [edx]
jne 0x10009fe5
mov cl, byte [eax + 1]
inc eax
inc edx
test cl, cl
jne 0x10009dc5
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 2]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1000e56c
push str.user32.dll
mov eax, dword [ecx + 0xa8]
mov dword [0x100181ac], eax
mov eax, dword [ecx + 0xc]
mov dword [0x100181bc], eax
mov eax, dword [ecx + 0x1c]
mov dword [0x100181c0], eax
mov eax, dword [ecx + 0xe4]
mov dword [0x100181b0], eax
mov eax, dword [ecx + 0x164]
mov dword [0x100181b4], eax
mov eax, dword [ecx + 0xc0]
mov dword [0x100181b8], eax
mov eax, dword [ecx + 0x68]
mov dword [0x100181c8], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x10018028], eax
add eax, 5
push str.keybd_event
push str.user32.dll
mov dword [0x100180a4], eax
call edi
push eax
call esi
mov dword [0x100184fc], eax
add eax, 5
push str.D3DXVec3Project
push str.d3dx9_38.dll
mov dword [0x10017f94], eax
call edi
push eax
call esi
push str.D3DXCreateFontA
push str.d3dx9_38.dll
mov dword [0x100180ac], eax
call edi
push eax
call esi
mov dword [0x100180a0], eax
add eax, 5
push str.D3DXCreateLine
push str.d3dx9_38.dll
mov dword [0x100181d8], eax
call edi
push eax
call esi
mov dword [0x10018274], eax
add eax, 5
mov dword [0x100181ec], eax
call fcn.100043a0
push 0
push 0
push 0
push 0x10002f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x10019584]
cmp dword [eax], 0xffffffff
jne 0x10009ef1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [0x10019584]
cmp dword [eax], 0xffffffff
je 0x10009ee3
push 0x20
xor edi, edi
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ebx, eax
test ebx, ebx
je 0x10009f55
push 0x38
lea eax, [esp + 0x18]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], edi
mov esi, dword [ebx]
push eax
lea eax, [esp + 0x18]
push eax
push 0x20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 1
push edi
push ebx
call dword [esi + 0x40]
test eax, eax
js 0x10009f55
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov edi, dword [eax + 0xa8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
mov dword [0x1001824c], edi
call esi
mov eax, dword [edi]
mov dword [0x10018144], eax
mov al, byte [edi + 4]
mov byte [0x10018148], al
mov eax, 0x10009a10
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008300
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008080
push 0
push 0
call esi
push 0
push 0
push 0
push 0x100080c0
push 0
push 0
call esi
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c9d8
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x10]
inc esi
cmp esi, 0x128000
jb 0x10009db0
xor ecx, ecx
jmp 0x10009de2