Function at 0x1005410
Capabilities:
Read clipboard data
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
mov ebx, eax
cmp ebx, edi
je 0x10056f5
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 0xc]
jne 0x10056f5
movzx eax, word [ebp + 0x10]
dec eax
dec eax
je 0x1005684
dec eax
je 0x10055b0
sub eax, 6
je 0x100552e
sub eax, 5
je 0x10054a9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x1005526
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10056f0
mov esi, dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push edi
push edi
push ebx
call esi
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x100551b
push eax
push dword [ebp - 8]
push ebx
call esi
test eax, eax
je 0x10054f4
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], 1
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xc], edi
jne 0x10056f0
push 0x10020f0
call fcn.01004c8a
pop ecx
mov dword [ebp - 8], edi
jmp 0x10056f0
lea eax, [ebp - 4]
push eax
push 2
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
movzx eax, word [ebp - 4]
lea eax, [eax*4 + 8]
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x1005526
mov word [esi], 0x300
mov ax, word [ebp - 4]
mov word [esi + 2], ax
lea eax, [esi + 4]
push eax
movzx eax, word [ebp - 4]
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
test eax, eax
je 0x1005595
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1005598
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
jmp 0x1005681
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x10056f0
cmp dword [0x1009a8c], edi
push edi
je 0x10055d3
lea eax, [ebp - 0x14]
push eax
push 0x10
push esi
jmp 0x10055f8
mov ax, word [esi]
mov word [ebp - 0x10], ax
mov ax, word [esi + 4]
mov word [ebp - 0xe], ax
mov ax, word [esi + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], di
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esi + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp + 0xc], esi
call ebx
push edi
push edi
push esi
mov esi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
call esi
cmp eax, edi
mov dword [ebp - 8], eax
je 0x10056f0
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x1005526
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 8], eax
jne 0x100566b
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
jmp 0x100566e
mov dword [ebp - 8], edi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call ebx
push dword [ebp + 0x10]
call esi
push eax
jmp 0x10056ea
lea eax, [ebp - 0x2c]
push eax
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 9
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10056a3
push 9
call esi
jmp 0x10056a5
xor eax, eax
push eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1a]
push eax
push edi
push ebx
call fcn.0100683f
mov esi, eax
cmp esi, edi
je 0x10056f0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp ebx, edi
je 0x10056f0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
jmp 0x1005702
push 0x10020c4
call fcn.01004c8a
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc