Function at 0x10031b20
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.10031760
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test al, al
je 0x10031b5d
push 0
push 0
push 0
push 0x100319d0
push 0
push 0
call ebx
mov esi, eax
push 0xa
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x10031a90
push 0
push 0
call ebx
mov esi, eax
push 0xa
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x40cee4
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
mov eax, 0x10031b00
sub eax, 0x40cee9
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x40cee5
call edi
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x40cee9
call esi
mov eax, 0x40cee9
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x40cee9
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x513508
call edi
push eax
call ebx
mov eax, 0x100319b0
sub eax, 0x51350d
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x513509
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51c5ca
call edi
push eax
call ebx
mov eax, 0x100315f0
sub eax, 0x51c5cf
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51c5cb
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51c611
call edi
push eax
call ebx
mov eax, 0x10031610
sub eax, 0x51c616
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51c612
call edi
push eax
call ebx
call fcn.10031760
test al, al
je 0x10031cdc
call fcn.10031680
test al, al
jne 0x10031cdc
push 0
push 0
push 0
push 0x10031840
push 0
push 0
mov dword [0x10074f04], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x520a8f
call edi
push eax
call ebx
mov eax, 0x10031330
sub eax, 0x520a94
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x520a90
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x602d69
call edi
push eax
call ebx
mov eax, 0x10031290
sub eax, 0x602d6e
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x602d6a
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x519389
call edi
push eax
call ebx
mov eax, 0x100314a0
sub eax, 0x51938e
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51938a
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x44231b
call edi
push eax
call ebx
mov eax, 0x10031190
sub eax, 0x442320
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x44231c
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x521f23
call edi
push eax
call ebx
mov eax, 0x100311b0
sub eax, 0x521f28
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x521f24
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x452914
call edi
push eax
call ebx
mov eax, 0x10031250
sub eax, 0x452919
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x452915
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x44023f
call edi
push eax
call ebx
mov eax, 0x10031470
sub eax, 0x440244
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x440240
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret