Function at 0x10002220
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10157153
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x101b0e5c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1000487c
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.user32.dll
call edi
test eax, eax
jne 0x1000226e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
mov edx, eax
lea ecx, [ebp - 0x294]
call fcn.10001e70
cmp byte [ebp - 0x18c], 0
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
jne 0x100022a8
xor ecx, ecx
jmp 0x100022ba
lea ecx, [ebp - 0x18c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100022b1
sub ecx, edx
push ecx
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x78]
call fcn.10002930
lea eax, [ebp - 0x18c]
mov dword [ebp - 4], 0
push eax
call fcn.1013fe69
push str.PLAZAUPDATE.EXE
push eax
call fcn.1013c3b0
add esp, 0xc
test eax, eax
je 0x10002506
push str.PLAZAUPDATE.EXE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
push str.PLAZAUPDATE.EXE
mov esi, eax
call edi
mov edi, eax
lea eax, [ebp - 0x60]
push 0x50
push 0
push eax
mov dword [ebp - 0x29c], edi
call fcn.1013cba0
add esp, 0xc
mov dword [ebp - 0x2a0], 0
lea eax, [ebp - 0x2b8]
xorps xmm0, xmm0
add edi, 0x14fe8c
movq qword [ebp - 0x2a8], xmm0
movups xmmword [ebp - 0x2b8], xmm0
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x50
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.1013cba0
movzx eax, si
push eax
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x60]
push str._04XlazaUpdate
push eax
call fcn.10002ff0
movq xmm0, qword [ebp - 0x60]
add esp, 0x18
mov esi, dword [ebp - 0x29c]
movq qword [edi], xmm0
add esi, 0x14fef0
mov eax, dword [ebp - 0x58]
xorps xmm0, xmm0
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x54]
mov word [edi + 0xc], ax
lea eax, [ebp - 0x2b8]
push 0x1c
push eax
push esi
movups xmmword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2a0], 0
movq qword [ebp - 0x2a8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x50
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.1013cba0
mov edi, dword [ebp - 0x298]
lea eax, [ebp - 0x60]
push edi
push str._04XlazaUpdateEvent
push eax
call fcn.10002ff0
movups xmm0, xmmword [ebp - 0x60]
add esp, 0x18
movups xmmword [esi], xmm0
movzx eax, word [ebp - 0x50]
mov word [esi + 0x10], ax
xorps xmm0, xmm0
mov al, byte [ebp - 0x4e]
mov byte [esi + 0x12], al
lea eax, [ebp - 0x2b8]
mov esi, dword [ebp - 0x29c]
push 0x1c
push eax
add esi, 0x14fea8
movq qword [ebp - 0x2a8], xmm0
push esi
movups xmmword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2a0], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x50
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.1013cba0
push edi
lea eax, [ebp - 0x60]
push str._04XamePlaza
push eax
call fcn.10002ff0
movq xmm0, qword [ebp - 0x60]
add esp, 0x18
movq qword [esi], xmm0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x58]
mov dword [esi + 8], eax
lea eax, [ebp - 0x2b8]
mov esi, dword [ebp - 0x29c]
push 0x1c
push eax
add esi, 0x151648
movq qword [ebp - 0x2a8], xmm0
push esi
movups xmmword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2a0], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 4
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi], 1
jmp 0x10002753
push str.JywGame.exe
call edi
mov esi, eax
mov dword [ebp - 0x29c], esi
test esi, esi
je 0x10002753
call fcn.100020b0
mov edi, eax
mov dword [ebp - 0x2a0], 0
push 0x1c
lea eax, [ebp - 0x2b8]
xorps xmm0, xmm0
push eax
add esi, 0x144948
movq qword [ebp - 0x2a8], xmm0
push esi
movups xmmword [ebp - 0x2b8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x50
call fcn.10142539
push 0x50
mov esi, eax
push 0
push esi
call fcn.1013cba0
movzx eax, di
push eax
push str._04XamePlaza
push esi
mov dword [ebp - 0x298], eax
call fcn.10002ff0
movq xmm0, qword [esi]
add esp, 0x1c
mov ecx, dword [ebp - 0x29c]
push 0x1c
movq qword [ecx + 0x144948], xmm0
lea edi, [ecx + 0x145af4]
mov eax, dword [esi + 8]
xorps xmm0, xmm0
mov dword [ecx + 0x144950], eax
lea eax, [ebp - 0x2b8]
push eax
push edi
movups xmmword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2a0], 0
movq qword [ebp - 0x2a8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x50
call fcn.10142539
push 0x50
mov esi, eax
push 0
push esi
call fcn.1013cba0
push dword [ebp - 0x298]
push str._04XameFrameMutex
push esi
call fcn.10002ff0
movups xmm0, xmmword [esi]
add esp, 0x1c
movups xmmword [edi], xmm0
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x10], al
xorps xmm0, xmm0
mov edi, dword [ebp - 0x29c]
lea eax, [ebp - 0x2b8]
add edi, 0x144bcc
movq qword [ebp - 0x2a8], xmm0
movups xmmword [ebp - 0x2b8], xmm0
mov dword [ebp - 0x2a0], 0
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x2a4]
push eax
push 0x40
push 0x15
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x50
call fcn.10142539
push 0x50
mov esi, eax
push 0
push esi
call fcn.1013cba0
push dword [ebp - 0x298]
push str._04XameFrameWnd
push esi
call fcn.10002ff0
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov ax, word [esi + 0xc]
push 0
mov word [edi + 0xc], ax
movzx eax, byte [esi + 0xe]
push 0
push 0x10002160
mov byte [edi + 0xe], al
call fcn.1014269a
add esp, 0x28
call fcn.10006497
mov ecx, eax
test ecx, ecx
jne 0x100026fb
push 0x80004005
call fcn.100034b0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x298]
push str.GAMEPLAZA.EXE__d
push eax
call fcn.10002f90
mov esi, dword [ebp - 0x298]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10002753
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10001fe0
push str.CreateProcessW
push ecx
lea ecx, [ebp - 0x8c]
call fcn.10001a90
push 0x10001f70
push str.CreateProcessA
add eax, 5
push ecx
lea ecx, [ebp - 0x8c]
mov dword [0x101bb190], eax
call fcn.10001a90
add eax, 5
mov dword [0x101bb194], eax
mov eax, dword [ebp - 0x64]
cmp eax, 0x10
jb 0x100027d9
mov ecx, dword [ebp - 0x78]
inc eax
cmp eax, 0x1000
jb 0x100027d0
test cl, 0x1f
je 0x100027ac
call fcn.1013f691
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x100027b8
call fcn.1013f691
sub ecx, eax
cmp ecx, 4
jae 0x100027c4
call fcn.1013f691
cmp ecx, 0x23
jbe 0x100027ce
call fcn.1013f691
mov ecx, eax
push ecx
call fcn.100039bc
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10139936
mov esp, ebp
pop ebp
ret