Function at 0x1000af90
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10019040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
call fcn.100038b0
cmp byte [0x1001a0ec], 0
jne 0x1000afc0
call fcn.10004090
nop word [eax + eax]
push 0x100105b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x1000afc0
mov edi, ebx
xor esi, esi
sub edi, str.xx____xx____xx
mov dword [esp + 0x10], edi
nop
lea eax, [esi + ebx]
mov edx, 0x100105cc
mov dword [esp + 0xc], eax
mov cl, 0x78
mov eax, str.xx____xx____xx
add edi, esi
cmp cl, 0x78
jne 0x1000b005
mov cl, byte [edi + eax]
cmp cl, byte [edx]
jne 0x1000b157
mov cl, byte [eax + 1]
inc eax
inc edx
test cl, cl
jne 0x1000aff5
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 2]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x100105dc
push str.user32.dll
mov eax, dword [ecx + 0xa8]
mov dword [0x1001a278], eax
mov eax, dword [ecx + 0xc]
mov dword [0x1001a288], eax
mov eax, dword [ecx + 0x1c]
mov dword [0x1001a28c], eax
mov eax, dword [ecx + 0xe4]
mov dword [0x1001a27c], eax
mov eax, dword [ecx + 0x164]
mov dword [0x1001a280], eax
mov eax, dword [ecx + 0xc0]
mov dword [0x1001a284], eax
mov eax, dword [ecx + 0x68]
mov dword [0x1001a294], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x1001a0e8], eax
add eax, 5
push str.keybd_event
push str.user32.dll
mov dword [0x1001a170], eax
call edi
push eax
call esi
mov dword [0x1001a620], eax
add eax, 5
push str.D3DXVec3Project
push str.d3dx9_38.dll
mov dword [0x1001a038], eax
call edi
push eax
call esi
push str.D3DXCreateFontA
push str.d3dx9_38.dll
mov dword [0x1001a174], eax
call edi
push eax
call esi
mov dword [0x1001a16c], eax
add eax, 5
push str.D3DXCreateLine
push str.d3dx9_38.dll
mov dword [0x1001a2a4], eax
call edi
push eax
call esi
mov dword [0x1001a34c], eax
add eax, 5
mov dword [0x1001a2b4], eax
call fcn.10004900
push 0
push 0
push 0
push 0x10003410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x1001b670]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [eax], 0xffffffff
jne 0x1000b121
push 0x64
call esi
mov eax, dword [0x1001b670]
cmp dword [eax], 0xffffffff
je 0x1000b113
push 0x64
call esi
mov edi, dword [0x1001b8a4]
xor ecx, ecx
mov esi, dword [0x1001b6c4]
mov edx, edi
add esi, edi
cmp edi, esi
jae 0x1000b182
nop dword [eax + eax]
mov al, byte [edx]
cmp al, byte [ecx + 0x10012c50]
je 0x1000b16f
cmp byte [ecx + str.xxxxxxxxx____xxx____xxxxxx____x____x____xxxxxxxxxxxxxxxxxx], 0x3f
je 0x1000b16f
xor ecx, ecx
jmp 0x1000b17d
mov edi, dword [esp + 0x10]
inc esi
cmp esi, 0x128000
jb 0x1000afe0
xor ecx, ecx
jmp 0x1000b012
cmp byte [ecx + 0x10012c15], 0
je 0x1000b289
inc ecx
inc edx
cmp edx, esi
jb 0x1000b140
xor edx, edx
lea eax, [edi + 0x64588]
mov dword [0x1001a08c], edx
push 0x20
mov dword [0x1001a094], eax
xor edi, edi
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ebx, eax
test ebx, ebx
je 0x1000b1f9
push 0x38
lea eax, [esp + 0x18]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], edi
mov esi, dword [ebx]
push eax
lea eax, [esp + 0x18]
push eax
push 0x20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 1
push edi
push ebx
call dword [esi + 0x40]
test eax, eax
js 0x1000b1f9
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov edi, dword [eax + 0xa8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
mov dword [0x1001a31c], edi
call esi
mov eax, dword [edi]
mov dword [0x1001a20c], eax
mov al, byte [edi + 4]
mov byte [0x1001a210], al
mov eax, 0x1000ad20
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10009050
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008930
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008ad0
push 0
push 0
call esi
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000df38
mov esp, ebp
pop ebp
ret
add edx, 0xffffffc7
jmp 0x1000b184