Function at 0x100111e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x6063f2
call edi
mov byte [0x6063f2], 0xe9
mov eax, 0x10011090
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9f9c09
mov dword [0x6063f3], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x6063f2
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 3
push 0x6063f7
call edi
mov eax, 0x6063f7
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 3
push 0x6063f7
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c28b3
call edi
mov byte [0x4c28b3], 0xe9
mov eax, 0x10011020
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3d748
mov dword [0x4c28b4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c28b3
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 3
push 0x4c28b8
call edi
mov eax, 0x4c28b8
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 3
push 0x4c28b8
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce93e
call edi
mov byte [0x5ce93e], 0xe9
mov eax, 0x10010a50
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa316bd
mov dword [0x5ce93f], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce93e
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x5ce943
call edi
mov eax, 0x5ce943
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x5ce943
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce97c
call edi
mov byte [0x5ce97c], 0xe9
mov eax, 0x10010bc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3167f
mov dword [0x5ce97d], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce97c
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x5ce981
call edi
mov eax, 0x5ce981
mov esi, 0x90909090
mov word [eax], si
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x5ce981
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce990
call edi
mov byte [0x5ce990], 0xe9
mov eax, 0x10010be0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3166b
mov dword [0x5ce991], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce990
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x5ce995
call edi
mov eax, 0x5ce995
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x5ce995
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce9bc
call edi
mov byte [0x5ce9bc], 0xe9
mov eax, 0x10010c00
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3163f
mov dword [0x5ce9bd], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce9bc
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x5ce9c1
call edi
mov eax, 0x5ce9c1
mov word [eax], si
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x5ce9c1
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x605602
call edi
mov byte [0x605602], 0xe9
mov eax, 0x10010dd0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fa9f9
mov dword [0x605603], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x605602
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x605607
call edi
mov eax, 0x605607
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x605607
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x605c24
call edi
mov byte [0x605c24], 0xe9
mov eax, 0x10010ec0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fa3d7
mov dword [0x605c25], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x605c24
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x605c29
call edi
mov eax, 0x605c29
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x605c29
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c6442
call edi
mov byte [0x4c6442], 0xe9
mov eax, 0x10010940
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb39bb9
mov dword [0x4c6443], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c6442
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c6447
call edi
mov eax, 0x4c6447
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c6447
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xa
push 0x7b9924
call edi
mov eax, 0x7b9924
mov ecx, esi
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0xa
push 0x7b9924
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c14b9
call edi
mov byte [0x4c14b9], 0xe9
mov eax, 0x10010530
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3eb42
mov dword [0x4c14ba], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c14b9
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c0d45
call edi
mov byte [0x4c0d45], 0xe9
mov eax, 0x100108e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3f2b6
mov dword [0x4c0d46], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c0d45
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c0d4a
call edi
mov eax, 0x4c0d4a
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c0d4a
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x5ce618
call edi
mov eax, 0x5ce618
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x5ce618
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce613
call edi
mov byte [0x5ce613], 0xe9
mov eax, 0x1000f940
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa319e8
mov dword [0x5ce614], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce613
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x4c24af
call edi
mov eax, 0x4c24af
mov word [eax], si
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x4c24af
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c24aa
call edi
mov byte [0x4c24aa], 0xe9
mov eax, 0x10010450
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3db51
mov dword [0x4c24ab], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c24aa
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5ce7ce
call edi
mov byte [0x5ce7ce], 0xe9
mov eax, 0x1000f910
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3182d
mov dword [0x5ce7cf], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5ce7ce
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 3
push 0x5ce7d3
call edi
mov eax, 0x5ce7d3
mov ecx, esi
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 3
push 0x5ce7d3
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c31f5
call edi
mov byte [0x4c31f5], 0xe9
mov eax, 0x10010c20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3ce06
mov dword [0x4c31f6], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c31f5
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push 0x4c31fa
call edi
mov eax, 0x4c31fa
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 4
push 0x4c31fa
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c4c93
call edi
mov byte [0x4c4c93], 0xe9
mov eax, 0x10010c80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3b368
mov dword [0x4c4c94], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c4c93
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c4c98
call edi
mov eax, 0x4c4c98
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c4c98
call edi
push 0
push 0
push 0
push 0x10010d30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x450791
call edi
mov byte [0x450791], 0xe9
mov eax, 0x1000f690
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffbaf86a
mov dword [0x450792], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x450791
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4508ea
call edi
mov byte [0x4508ea], 0xe9
mov eax, 0x1000f6b0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffbaf711
mov dword [0x4508eb], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4508ea
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x44ddcb
call edi
mov byte [0x44ddcb], 0xe9
mov eax, 0x1000f460
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffbb2230
mov dword [0x44ddcc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x44ddcb
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret