Function at 0x100011b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Hook routines via microsoft detours
Resume thread
Suspend thread

Disassembly:
push ecx
cmp dword [0x10017388], 0
lea eax, [ecx + 0x301f9]
mov dword [0x1001737c], eax
lea eax, [ecx + 0x300d6]
push esi
push edi
mov dword [0x10017380], eax
jne 0x10001229
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x10017388
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10001229
mov esi, dword [0x10017394]
mov dword [0x1001739c], eax
mov dword [0x10017398], eax
mov dword [0x10017390], eax
test esi, esi
je 0x10001222
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x10001281
mov esi, dword [esi + 4]
test esi, esi
jne 0x10001208
xor eax, eax
mov dword [0x10017384], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [0x10017384], 0
mov esi, eax
jne 0x10001299
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
je 0x10001299
push 8
call fcn.100033df
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.1000340f
add esp, 8
mov dword [0x10017384], esi
mov dword [0x10017390], 0
jmp 0x10001299
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10001224
mov eax, dword [0x10017398]
mov dword [edi + 4], esi
mov dword [edi], eax
mov dword [0x10017398], edi
sub esp, 0xc
mov edx, 0x10001100
mov ecx, 0x10017378
call fcn.10001da0
sub esp, 0xc
mov edx, 0x10001010
mov ecx, 0x1001737c
call fcn.10001da0
sub esp, 0xc
mov edx, 0x10001090
mov ecx, 0x10017380
call fcn.10001da0
pop edi
pop esi
add esp, 4
jmp 0x10001940
sub esp, 0x2d8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2d4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
cmp dword [0x10017388], eax
je 0x10001980
mov eax, 0x10dd
pop esi
mov ecx, dword [esp + 0x2d4]
xor ecx, esp
call fcn.1000306e
add esp, 0x2d8
ret
cmp dword [0x10017384], 0
push ebx
push ebp
push edi
je 0x10001a80
call esi
cmp dword [0x10017388], eax
jne 0x10001d80
mov edi, dword [0x1001739c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
je 0x10001a0a
nop
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call ebx
cmp dword [edi + 4], 0
jne 0x100019f7
mov esi, dword [edi + 0x10]
test esi, esi
je 0x100019f7
push 0x48
push 0
push esi
call fcn.100046e0
mov ecx, esi
add esp, 0xc
and ecx, 0xffff0000
mov eax, dword [ecx + 8]
mov dword [esi + 0x40], eax
mov dword [ecx + 8], esi
mov dword [edi + 0x10], 0
mov esi, dword [edi]
push 0x18
push edi
call fcn.1000340f
add esp, 8
mov edi, esi
test esi, esi
jne 0x100019b0
mov dword [0x1001739c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [0x10017394]
mov ebp, eax
test esi, esi
je 0x10001a4f
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
nop dword [eax]
lea eax, [esp + 0x10]
push eax
push 0x20
push 0x10000
push esi
call ebx
push 0x10000
push esi
push ebp
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x10001a30
mov edi, dword [0x10017398]
test edi, edi
je 0x10001d6c
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call ebx
mov esi, dword [edi]
push 8
push edi
call fcn.1000340f
add esp, 8
mov edi, esi
test esi, esi
jne 0x10001a63
jmp 0x10001d6c
mov esi, dword [0x1001739c]
mov dword [esp + 0x10], 0
test esi, esi
je 0x10001af9
cmp dword [esi + 4], 0
mov ecx, dword [esi + 0x10]
je 0x10001ab4
movzx eax, byte [ecx + 0x36]
push eax
lea eax, [ecx + 0x20]
push eax
push dword [esi + 0xc]
call fcn.10005c60
mov eax, dword [esi + 0xc]
add esp, 0xc
jmp 0x10001aee
mov edx, dword [esi + 0xc]
xor edi, edi
mov ecx, dword [ecx + 0x44]
lea eax, [edx + 5]
mov byte [edx], 0xe9
sub ecx, eax
mov dword [edx + 1], ecx
add edx, 5
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x40]
sub ecx, edx
cmp edx, dword [eax + 0x40]
cmova ecx, edi
test ecx, ecx
je 0x10001aeb
push ecx
push 0xcc
push edx
call fcn.100046e0
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov esi, dword [esi]
test esi, esi
jne 0x10001a92
mov ebp, dword [0x10017398]
test ebp, ebp
je 0x10001bfa
nop word [eax + eax]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10001
push eax
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10001bef
mov esi, dword [0x1001739c]
test esi, esi
je 0x10001bef
mov ebx, dword [esp + 0xd0]
cmp dword [esi + 4], 0
je 0x10001b90
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
jb 0x10001be5
lea eax, [ecx + 4]
cmp ebx, eax
jae 0x10001be5
xor eax, eax
lea edi, [ecx + 0x38]
mov ch, byte [edi + eax]
mov dl, bl
sub dl, byte [esi + 0x10]
mov cl, ch
shr cl, 3
cmp cl, dl
je 0x10001b85
inc eax
cmp eax, 8
jb 0x10001b64
xor ch, ch
movzx eax, ch
add eax, dword [esi + 0xc]
jmp 0x10001bc9
and ch, 7
movzx eax, ch
add eax, dword [esi + 0xc]
jmp 0x10001bc9
mov ecx, dword [esi + 0xc]
cmp ebx, ecx
jb 0x10001be5
mov edi, dword [esi + 0x10]
movzx eax, byte [edi + 0x36]
add eax, ecx
cmp ebx, eax
jae 0x10001be5
xor edx, edx
mov ah, byte [edx + edi + 0x38]
mov cl, bl
sub cl, byte [esi + 0xc]
mov al, ah
and al, 7
cmp al, cl
je 0x10001bc1
inc edx
cmp edx, 8
jb 0x10001ba6
xor eax, eax
jmp 0x10001bc7
movzx eax, ah
shr eax, 3
add eax, edi
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ebx, dword [esp + 0xd0]
mov esi, dword [esi]
test esi, esi
jne 0x10001b43
mov ebp, dword [ebp]
test ebp, ebp
jne 0x10001b10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [0x1001739c]
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
je 0x10001c86
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call ebp
mov eax, dword [edi + 0x10]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [edi + 4], 0
je 0x10001c73
mov esi, dword [edi + 0x10]
test esi, esi
je 0x10001c73
push 0x48
push 0
push esi
call fcn.100046e0
mov ecx, esi
mov dword [esp + 0x1c], 1
add esp, 0xc
and ecx, 0xffff0000
mov eax, dword [ecx + 8]
mov dword [esi + 0x40], eax
mov dword [ecx + 8], esi
mov dword [edi + 0x10], 0
mov esi, dword [edi]
push 0x18
push edi
call fcn.1000340f
add esp, 8
mov edi, esi
test esi, esi
jne 0x10001c12
cmp dword [esp + 0x10], 0
mov dword [0x1001739c], 0
je 0x10001d0d
cmp dword [0x10017374], 0
jne 0x10001d0d
mov ecx, dword [0x10017394]
mov edi, 0x10017394
test ecx, ecx
je 0x10001d0d
nop
cmp dword [ecx], 0x52727464
je 0x10001cbd
lea edi, [ecx + 4]
jmp 0x10001d07
lea ebx, [ecx + 0x10000]
xor esi, esi
lea edx, [ecx + 0x88]
nop dword [eax + eax]
mov eax, dword [edx]
test eax, eax
je 0x10001cde
cmp eax, ecx
jb 0x10001cb8
cmp eax, ebx
jae 0x10001cb8
inc esi
add edx, 0x48
cmp esi, 0x38d
jb 0x10001cd0
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1001738c], 0
mov ecx, dword [edi]
test ecx, ecx
jne 0x10001cb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [0x10017394]
mov edi, eax
test esi, esi
je 0x10001d44
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push 0x20
push 0x10000
push esi
call ebp
push 0x10000
push esi
push edi
call ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x10001d25
mov edi, dword [0x10017398]
test edi, edi
je 0x10001d6c
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call ebx
mov esi, dword [edi]
push 8
push edi
call fcn.1000340f
add esp, 8
mov edi, esi
test esi, esi
jne 0x10001d54
mov dword [0x10017398], 0
mov dword [0x10017388], 0
mov ecx, dword [esp + 0x2e4]
mov eax, dword [0x10017384]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.1000306e
add esp, 0x2d8
ret