Function at 0x436b90
Capabilities:
Create process on windows
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x452b68
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x4650c0]
xor eax, esp
mov dword [esp + 0x2f8], eax
push ebx
push esi
push edi
mov eax, dword [0x4650c0]
xor eax, esp
push eax
lea eax, [esp + 0x310]
mov dword fs:[0], eax
xor esi, esi
push esi
mov edi, ecx
call fcn.0043af06
add esp, 4
push eax
call fcn.0043a044
mov eax, dword [edi + 0xd8]
add esp, 4
cmp eax, esi
je 0x436bfe
mov eax, dword [eax + 4]
cmp eax, esi
je 0x436bfe
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x318], esi
mov edi, edi
lea eax, [esp + 0x34]
push eax
mov ecx, 0x468ae8
call fcn.004044b0
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, eax
sar ecx, 2
test ecx, ecx
jne 0x436c4b
push 0x7530
call ebx
jmp 0x436c20
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
sub edi, eax
mov byte [esp + 0x318], 1
sar edi, 2
jmp 0x436c70
push 0x468ae8
lea ecx, [esp + 0x48]
call fcn.00404a40
cmp edi, esi
ja 0x436c8d
push 0x7530
call ebx
jmp 0x436c70
xor esi, esi
push str.ClientClientProcess_9c00dc50_f39a_4917_8fd9_37125ccecced
push esi
push 0xf001f
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, esi
je 0x436cc2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x436c8d
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
call fcn.00437290
test eax, eax
je 0x436cb5
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x436cb5
xor eax, eax
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
call fcn.0043aefb
mov edx, dword [esp + 0xec]
mov eax, dword [esp + 0xe8]
add esp, 4
push esi
push 0x3e8
push edx
push eax
call fcn.00446060
mov ecx, eax
movzx eax, word [esp + 0xec]
mov edi, edx
cdq
add ecx, eax
mov eax, dword [0x468c10]
adc edi, edx
sub ecx, dword [esp + 0x24]
sbb edi, dword [esp + 0x28]
imul eax, eax, 0x3e8
cdq
cmp edi, edx
jl 0x436cb5
jg 0x436d73
cmp ecx, eax
jbe 0x436cb5
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
je 0x436d89
push eax
push esi
call fcn.00438570
add esp, 8
mov eax, dword [esi]
sub eax, 0x10
call fcn.00401a60
lea esi, [eax + 0x10]
mov dword [esp + 0x30], esi
mov byte [esp + 0x318], 2
mov eax, dword [esp + 0x48]
cmp ebx, eax
je 0x436db4
push eax
push ebx
call fcn.004385f0
add esp, 8
lea ecx, [esp + 0x54]
push ecx
mov edi, ebx
call fcn.00412140
mov byte [esp + 0x318], 3
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str.1URL
lea ecx, [esp + 0x14]
push ecx
mov ebx, 5
mov byte [esp + 0x320], 4
call fcn.00402080
mov eax, dword [esp + 0x54]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ebx, [esp + 0x18]
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
push 6
push str.2IELE
call fcn.004019a0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
push 9
push str.3ELEName
call fcn.004019a0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
push 0xb
push str.4INPUTNAME
call fcn.004019a0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
push 9
push str.5BTNTYPE
call fcn.004019a0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
push 9
push str.6BTNNAME
call fcn.004019a0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x318], 5
mov ecx, dword [esp + 0x6c]
push ecx
push str.7SPROB_d____r_n
lea edi, [esp + 0x1c]
call fcn.00410840
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
add esp, 8
push ecx
push eax
call fcn.004019a0
push 0xb
push str.8MONEYLINK
call fcn.004019a0
mov edi, dword [esp + 0x70]
cmp edi, dword [esp + 0x74]
je 0x436f61
push 1
push str.____
lea ebx, [esp + 0x18]
call fcn.004019a0
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004019a0
push 1
push 0x458a14
call fcn.004019a0
add edi, 4
cmp edi, dword [esp + 0x74]
jne 0x436f30
push 7
push str.____r_n
lea ebx, [esp + 0x18]
call fcn.004019a0
mov edx, dword [esp + 0x80]
push edx
push str.9CBTNPROB_d____r_n
lea edi, [esp + 0x1c]
call fcn.00410840
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
add esp, 8
push ecx
push eax
call fcn.004019a0
mov eax, dword [0x468c0c]
push eax
push str.10UVSUPPORT_d____r_n
call fcn.00410840
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
add esp, 8
push ecx
push eax
call fcn.004019a0
push 0xb
push str.11SKEYWORD
call fcn.004019a0
mov eax, dword [esi - 0xc]
push eax
push esi
call fcn.004019a0
push 7
push str.____r_n
call fcn.004019a0
mov ecx, dword [0x468c18]
push ecx
push str.12DEF_XY_MOVE_d____r_n
call fcn.00410840
mov edi, dword [esp + 0x1c]
mov eax, dword [edi - 0xc]
add esp, 8
push eax
push edi
call fcn.004019a0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x437200
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx - 0xc]
lea eax, [eax + eax + 2]
push eax
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
push 0
push esi
call fcn.0043c440
mov eax, dword [ebx - 0xc]
add esp, 0xc
cmp dword [ebx - 4], 1
mov dword [esp + 0x18], eax
jle 0x437062
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00401f30
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax]
push ecx
push ebx
push esi
call fcn.0043c950
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x4589e4
call fcn.00401e30
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0xfe]
mov byte [esp + 0x320], 6
push ecx
mov word [esp + 0x100], ax
call fcn.0043c440
add esp, 0xc
push 0x104
lea edx, [esp + 0xf8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xf8]
call fcn.00401e30
lea ecx, [esp + 0x9c]
mov byte [esp + 0x318], 7
push ecx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xa0]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push str._auto_8985b77d_8f79_4596_844e_6482e70c3d14
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0x1c]
inc eax
push eax
call fcn.00437690
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x318], 6
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x437172
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x318], 5
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43719a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x318], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4371c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [esp + 0x318], 3
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4371e6
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
lea eax, [esp + 0x54]
call fcn.00405ea0
mov byte [esp + 0x318], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
jmp 0x43726b
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [edi - 0x10]
mov byte [esp + 0x318], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43722f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x318], 3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437257
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x54]
call fcn.00405ea0
mov byte [esp + 0x318], 1
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436c8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x436c8b