Function at 0x10002e40
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 0xdd0]
xor ebx, ebx
xor ebp, ebp
xor esi, esi
cmp edi, 4
mov dword [esp + 0x10], ecx
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 2
mov byte [esp + 0x16], 4
mov byte [esp + 0x17], 9
mov byte [esp + 0x18], 0x10
mov byte [esp + 0x19], 0x15
mov byte [esp + 0x1a], 0x1c
mov byte [esp + 0x1b], 0x21
mov byte [esp + 0x1c], 0x28
mov byte [esp + 0x1d], 0x2d
mov byte [esp + 0x1e], 0x34
mov byte [esp + 0x1f], 0x39
mov byte [esp + 0x20], 0x40
mov byte [esp + 0x21], 0x45
mov byte [esp + 0x22], 0x4c
mov byte [esp + 0x23], 0x51
mov byte [esp + 0x24], 0x58
mov byte [esp + 0x25], 0x5d
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], 0x75
mov byte [esp + 0x2a], 0x7c
mov byte [esp + 0x2b], 0x81
mov byte [esp + 0x2c], 0x88
mov byte [esp + 0x2d], 0x8d
je 0x10002ef4
cmp edi, 5
je 0x10002ef4
cmp edi, 6
je 0x10002ef4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10
mov eax, dword [ecx + 0xbb4]
test eax, eax
jl 0x10002f15
mov ebx, edi
lea esi, [ecx + 0xbdc]
sub ebx, 5
neg ebx
sbb ebx, ebx
and ebx, 0xfffffff6
add ebx, 0x14
jmp 0x10002f2a
mov eax, dword [ecx + 0xbb8]
test eax, eax
jl 0x10002f2c
lea esi, [ecx + 0xbf1]
mov ebx, 0x14
mov ebp, eax
mov eax, dword [esp + 0x38]
cmp eax, 0x201
ja 0x1000350e
je 0x100032d0
sub eax, 0x100
je 0x10003156
sub eax, 2
jne case.0x1000316e.15
mov edx, dword [esp + 0x3c]
cmp edx, 8
je 0x10003102
cmp edx, 0xd
je 0x100030be
cmp edx, 0x16
mov edi, esi
je 0x10003003
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jge 0x10002fd3
mov eax, dword [0x10016db8]
test eax, eax
jne 0x10002fa6
cmp dl, 0x7f
jbe 0x10002fa6
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
cmp ecx, ebx
jg case.0x1000316e.15
dec ebx
cmp ebx, ebp
jle 0x10002fb7
mov al, byte [esi + ebx - 1]
mov byte [esi + ebx], al
dec ebx
cmp ebx, ebp
jg 0x10002fab
mov eax, dword [0x10016db8]
test eax, eax
je 0x10002fcf
mov cl, byte [esi + ebp - 1]
lea eax, [esi + ebp - 1]
mov byte [esi + ebp], cl
mov byte [eax], dl
jmp 0x10002fd2
mov byte [esi + ebp], dl
inc ebp
mov eax, dword [0x10016db8]
test eax, eax
je 0x10002feb
mov dword [0x10016db8], 0
jmp case.0x1000316e.15
cmp dl, 0x7f
jbe case.0x1000316e.15
mov dword [0x10016db8], 1
jmp case.0x1000316e.15
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
je case.0x1000316e.15
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
cmp eax, 1
jne 0x10003671
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10003671
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x10003074
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, eax
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10003078
mov ebx, dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_CloseClipboard]
dec edi
mov esi, 0
je 0x100030a5
mov ebp, dword [esp + 0x34]
movsx edx, byte [ebx + esi]
mov ecx, dword [esp + 0x10]
push 0
push edx
push 0x102
push ebp
call fcn.10002e40
inc esi
cmp esi, edi
jb 0x1000308a
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
mov eax, dword [ecx + 0xbb4]
test eax, eax
jl 0x100030db
mov eax, dword [ecx + 0xbb8]
not ebp
mov dword [ecx + 0xbb4], ebp
jmp 0x1000362b
mov eax, dword [ecx + 0xbb8]
test eax, eax
jl 0x10003633
mov dword [ecx + 0xbb4], 0
mov dword [ecx + 0xbb8], 0xffffffff
jmp 0x10003633
test ebp, ebp
jle case.0x1000316e.15
mov ecx, dword [esp + 0x10]
push ebp
push esi
call fcn.10002e00
test eax, eax
je 0x1000313a
sub ebp, 2
lea ecx, [ebx - 1]
cmp ebp, ecx
mov eax, ebp
jge case.0x1000316e.15
mov dl, byte [esi + eax + 2]
mov byte [esi + eax], dl
inc eax
cmp eax, ecx
jl 0x10003129
jmp case.0x1000316e.15
dec ebp
cmp ebp, ebx
mov eax, ebp
jge case.0x1000316e.15
mov cl, byte [esi + eax + 1]
mov byte [esi + eax], cl
inc eax
cmp eax, ebx
jl 0x10003145
jmp case.0x1000316e.15
mov edx, dword [esp + 0x3c]
lea edi, [edx - 9]
cmp edi, 0x25
ja case.0x1000316e.15
xor eax, eax
mov al, byte [edi + 0x1000369c]
jmp dword [eax*4 + 0x10003680]
cmp ebp, ebx
jge case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, ecx
jge case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffd
cmp ebp, ecx
jg 0x100031ea
lea ecx, [ebp + 2]
push ecx
mov ecx, dword [esp + 0x14]
push esi
call fcn.10002e00
test eax, eax
je 0x100031ea
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, ebp
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
cmp ebp, ecx
jge case.0x1000316e.15
mov al, byte [esi + edx + 2]
mov edi, esi
mov byte [esi + edx], al
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
cmp edx, ecx
jl 0x100031cb
jmp case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, ecx
jge case.0x1000316e.15
mov cl, byte [esi + edx + 1]
mov edi, esi
mov byte [esi + edx], cl
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x10003200
jmp case.0x1000316e.15
mov ecx, dword [esp + 0x10]
push ebp
push esi
call fcn.10002e00
test eax, eax
je 0x1000323d
cmp ebp, 1
jle case.0x1000316e.15
sub ebp, 2
jmp case.0x1000316e.15
test ebp, ebp
jle case.0x1000316e.15
dec ebp
jmp case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp + 2]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jg 0x10003274
mov ecx, dword [esp + 0x10]
push ebx
push esi
call fcn.10002e00
test eax, eax
je 0x10003288
mov ebp, ebx
jmp case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, ecx
jge case.0x1000316e.15
inc ebp
jmp case.0x1000316e.15
xor ebp, ebp
jmp case.0x1000316e.15
mov eax, dword [ecx + 0xbb4]
test eax, eax
jl 0x100032a7
mov dword [ecx + 0xbb4], ebp
jmp 0x100032b7
mov eax, dword [ecx + 0xbb8]
test eax, eax
jl 0x100032b7
mov dword [ecx + 0xbb8], ebp
mov edx, dword [ecx + 0xbb4]
mov eax, dword [ecx + 0xbb8]
not edx
mov dword [ecx + 0xbb4], edx
jmp 0x1000362b
mov eax, dword [esp + 0x40]
mov ebx, dword [ecx + 0xdcc]
mov edx, eax
and edx, 0xffff
shr eax, 0x10
test ebx, ebx
mov dword [esp + 0x40], edx
je 0x100032f8
mov edi, 0x14d
mov dword [esp + 0x3c], edi
jmp 0x10003310
xor edx, edx
cmp edi, 5
sete dl
add edx, 0x175
mov edi, edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x3c], edi
cmp edx, edi
jl case.0x1000316e.15
add edi, 0x8b
cmp edx, edi
jg case.0x1000316e.15
test ebx, ebx
je 0x100033dd
cmp eax, 0xe3
jl 0x1000337f
cmp eax, 0xf5
jg 0x1000337f
mov esi, dword [ecx + 0xbb4]
test esi, esi
jge 0x1000334e
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jl 0x10003360
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0xe6
jl case.0x1000316e.15
cmp eax, 0xf1
jg case.0x1000316e.15
lea esi, [ecx + 0xbdc]
cmp eax, 0x12c
jl 0x10003481
cmp eax, 0x13e
jg 0x10003481
mov esi, dword [ecx + 0xbb4]
test esi, esi
jl 0x100033a7
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jge 0x100033b9
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0x12f
jl case.0x1000316e.15
cmp eax, 0x13a
jg case.0x1000316e.15
lea esi, [ecx + 0xbf1]
jmp 0x1000348a
cmp eax, 0xe5
jl 0x1000342e
cmp eax, 0xf7
jg 0x1000342e
mov esi, dword [ecx + 0xbb4]
test esi, esi
jge 0x100033fd
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jl 0x1000340f
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0xe8
jl case.0x1000316e.15
cmp eax, 0xf3
jg case.0x1000316e.15
lea esi, [ecx + 0xbdc]
cmp eax, 0x10a
jl 0x10003481
cmp eax, 0x11c
jg 0x10003481
mov esi, dword [ecx + 0xbb4]
test esi, esi
jl 0x1000344e
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jge 0x10003460
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0x10d
jl case.0x1000316e.15
cmp eax, 0x118
jg case.0x1000316e.15
lea esi, [ecx + 0xbf1]
jmp 0x1000348a
cmp ebp, 0xffffffff
jne case.0x1000316e.15
mov eax, dword [esp + 0x3c]
xor ebx, ebx
xor ecx, ecx
mov cl, byte [esp + ebx + 0x14]
add ecx, eax
cmp edx, ecx
jl 0x100034a8
xor ecx, ecx
mov cl, byte [esp + ebx + 0x15]
add ecx, eax
cmp edx, ecx
jl 0x100034ab
inc ebx
jmp 0x10003490
dec ebx
cmp ebx, 0xffffffff
je 0x10003633
cmp ebx, 0x19
jge 0x10003633
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jle 0x100034e1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
jmp case.0x1000316e.15
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea ebp, [ebx + 1]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, ecx
jg 0x10003507
mov ecx, dword [esp + 0x10]
push ebp
push esi
call fcn.10002e00
test eax, eax
jne case.0x1000316e.15
mov ebp, ebx
jmp case.0x1000316e.15
cmp eax, 0x204
jne case.0x1000316e.15
mov eax, dword [esp + 0x40]
mov ebx, dword [ecx + 0xdcc]
mov esi, eax
and esi, 0xffff
shr eax, 0x10
test ebx, ebx
je 0x10003539
mov edi, 0x14d
jmp 0x10003549
xor edx, edx
cmp edi, 5
sete dl
add edx, 0x175
mov edi, edx
cmp esi, edi
jl case.0x1000316e.15
add edi, 0x8b
cmp esi, edi
jg case.0x1000316e.15
test ebx, ebx
je 0x100035cc
cmp eax, 0xe3
jl 0x10003598
cmp eax, 0xf5
jg 0x10003598
mov esi, dword [ecx + 0xbb4]
test esi, esi
jge 0x10003583
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jl 0x10003595
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0x12c
jl case.0x1000316e.15
cmp eax, 0x13e
jg case.0x1000316e.15
mov eax, dword [ecx + 0xbb4]
test eax, eax
jl 0x100035c0
not eax
mov dword [ecx + 0xbb4], eax
mov eax, dword [ecx + 0xbb8]
test eax, eax
jge 0x10003633
jmp 0x1000362b
cmp eax, 0xe5
jl 0x10003601
cmp eax, 0xf7
jg 0x10003601
mov esi, dword [ecx + 0xbb4]
test esi, esi
jge 0x100035ec
not esi
mov dword [ecx + 0xbb4], esi
mov esi, dword [ecx + 0xbb8]
test esi, esi
jl 0x100035fe
not esi
mov dword [ecx + 0xbb8], esi
or ebp, 0xffffffff
cmp eax, 0x10a
jl case.0x1000316e.15
cmp eax, 0x11c
jg case.0x1000316e.15
mov eax, dword [ecx + 0xbb4]
test eax, eax
jl 0x10003621
not eax
mov dword [ecx + 0xbb4], eax
mov eax, dword [ecx + 0xbb8]
test eax, eax
jge 0x10003633
not eax
mov dword [ecx + 0xbb8], eax
or ebp, 0xffffffff
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xbb4]
test ecx, ecx
jl 0x1000365d
test ebp, ebp
jl 0x10003671
pop edi
mov dword [eax + 0xbb4], ebp
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 0x10
mov ecx, dword [eax + 0xbb8]
test ecx, ecx
jl 0x10003671
test ebp, ebp
jl 0x10003671
mov dword [eax + 0xbb8], ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 0x10