Function at 0x404e92
Capabilities:
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x950
push ebx
push esi
mov esi, dword [ebp + 0x7c]
cmp byte [esi], 0
mov ebx, eax
mov dword [ebp + 0x6c], ebx
je 0x4054ee
push edi
cmp byte [esi], 0x7e
jne 0x4054c7
mov al, byte [esi + 1]
mov cl, al
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x404ecc
add cl, 0x20
cmp cl, 0x6e
jne 0x404ee4
inc esi
inc esi
mov byte [ebx], 0xd
mov byte [ebx + 1], 0xa
inc ebx
mov dword [ebp + 0x7c], esi
inc ebx
jmp 0x4054d2
mov cl, al
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x404ef3
add cl, 0x20
cmp cl, 0x78
jne 0x404f23
mov al, byte [esi + 2]
mov byte [ebp + 0x64], al
mov al, byte [esi + 3]
push 0x10
mov byte [ebp + 0x65], al
lea eax, [ebp + 0x64]
push 0
push eax
mov byte [ebp + 0x66], 0
call sub.msvcrt.dll_strtoul
add esp, 0xc
add esi, 4
mov dword [ebp + 0x7c], esi
jmp 0x4054cf
mov cl, al
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x404f32
add cl, 0x20
cmp cl, 0x71
jne 0x404f44
mov byte [ebx], 0x22
inc esi
inc esi
mov dword [ebp + 0x7c], esi
jmp 0x4054d1
mov cl, al
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x404f53
add cl, 0x20
cmp cl, 0x74
jne 0x404f5d
mov byte [ebx], 9
jmp 0x404f3a
cmp al, 0x25
je 0x404f7d
cmp al, 0x24
je 0x404f7d
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x404f71
add al, 0x20
cmp al, 0x7e
jne 0x4054c7
mov byte [ebx], al
jmp 0x404f3a
movsx eax, al
add esi, 2
push eax
mov edx, esi
call fcn.00402330
mov edi, eax
lea eax, [edi - 1]
cmp eax, 0x7d
pop ecx
ja 0x4054c7
push edi
lea eax, [ebp - 0x54]
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x7c]
lea eax, [eax + edi + 3]
push 7
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x54]
push str.folder.
push eax
mov byte [ebp + edi - 0x54], 0
call sub.msvcrt.dll__strnicmp
add esp, 0x18
test eax, eax
jne 0x405030
push 0x104
push eax
mov byte [ebp - 0x3e0], al
lea eax, [ebp - 0x3df]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3e0]
lea ecx, [ebp - 0x4d]
call fcn.00405a97
test eax, eax
je 0x4054d2
lea eax, [ebp - 0x3e0]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
test esi, esi
pop ecx
jle 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0x3e0]
jmp 0x4052a2
push 9
lea eax, [ebp - 0x54]
push str.loopcount
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4050ae
push 0xff
push eax
mov byte [ebp - 0x2d8], al
lea eax, [ebp - 0x2d7]
push eax
call sub.msvcrt.dll_memset
push 0xa
lea eax, [ebp - 0x2d8]
push eax
mov eax, dword [ebp + 0x78]
mov eax, dword [eax + 0x10058]
inc eax
push eax
call sub.msvcrt.dll__itoa
lea eax, [ebp - 0x2d8]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
add esp, 0x1c
test esi, esi
jle 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0x2d8]
jmp 0x4052a2
push 8
lea eax, [ebp - 0x54]
push str.currdate.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x405130
mov esi, 0xff
push esi
mov byte [ebp - 0x4e0], al
xor edi, edi
lea eax, [ebp - 0x4df]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4b]
push eax
push edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetDateFormatA]
lea eax, [ebp - 0x4e0]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
cmp esi, edi
pop ecx
jle 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0x4e0]
jmp 0x4052a2
push 8
lea eax, [ebp - 0x54]
push str.currtime.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4051b2
mov esi, 0xff
push esi
mov byte [ebp - 0x1d8], al
xor edi, edi
lea eax, [ebp - 0x1d7]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x4b]
push eax
push edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTimeFormatA]
lea eax, [ebp - 0x1d8]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
cmp esi, edi
pop ecx
jle 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0x1d8]
jmp 0x4052a2
push 4
lea eax, [ebp - 0x54]
push str.sys.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x40521e
mov esi, 0x80
push esi
push eax
mov byte [ebp - 0xd8], al
lea eax, [ebp - 0xd7]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
jbe 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0xd8]
jmp 0x4052a2
push 4
lea eax, [ebp - 0x54]
push str.nir.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4052a9
push 0x3ff
push eax
mov byte [ebp - 0x8e0], al
lea eax, [ebp - 0x8df]
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x50]
push str.exefile
push eax
call sub.msvcrt.dll__strcmpi
add esp, 0x14
test eax, eax
jne 0x4054d2
lea eax, [ebp - 0x8e0]
push eax
call fcn.004025e7
lea eax, [ebp - 0x8e0]
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
test esi, esi
pop ecx
pop ecx
jbe 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
lea eax, [ebp - 0x8e0]
push esi
push eax
jmp 0x405440
push 6
lea eax, [ebp - 0x54]
push str.param.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4053d9
mov esi, dword [ebp + 0x78]
lea eax, [ebp - 0x4e]
lea edi, [esi + 0x100a4]
push eax
call fcn.00402b55
xor edi, edi
cmp eax, edi
jl 0x4052ec
lea ecx, [esi + 0x100c4]
call fcn.00402b82
mov dword [ebp + 0x68], eax
jmp 0x4052ef
mov dword [ebp + 0x68], edi
cmp dword [ebp + 0x68], edi
je 0x405322
push dword [ebp + 0x68]
call sub.msvcrt.dll_strlen
mov esi, eax
cmp esi, edi
pop ecx
jbe 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
push esi
push dword [ebp + 0x68]
jmp 0x405440
mov eax, 0x100
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x60], eax
lea eax, [ebp - 0x4e]
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edi
push eax
lea edi, [ebp + 0x3c]
mov dword [ebp + 0x30], 0x411ebc
mov dword [ebp + 0x38], 0x66
call fcn.00402be3
push 0
lea ecx, [ebp + 0x30]
call fcn.004011d6
test eax, eax
je 0x4053bc
mov edi, dword [ebp + 0x50]
test edi, edi
jne 0x405379
mov edi, 0x411e4c
lea eax, [ebp - 0x4e]
push eax
lea eax, [esi + 0x100a4]
call fcn.00402aba
push edi
lea eax, [esi + 0x100c4]
call fcn.00402aba
push edi
call sub.msvcrt.dll_strlen
mov esi, eax
test esi, esi
pop ecx
jbe 0x4053bc
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4053bc
push esi
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
lea esi, [ebp + 0x50]
call fcn.00402bbe
lea esi, [ebp + 0x3c]
call fcn.00402bbe
lea edx, [ebp + 0x30]
call fcn.004010bf
jmp 0x4054d2
push 7
lea eax, [ebp - 0x54]
push str.fparam.
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x405450
lea eax, [ebp - 0x4d]
push eax
call sub.msvcrt.dll_atoi
test eax, eax
pop ecx
jle 0x4054d2
mov ecx, dword [ebp + 0x78]
dec eax
add ecx, 0x10084
call fcn.00402b82
mov edi, eax
test edi, edi
je 0x4054d2
push edi
call sub.msvcrt.dll_strlen
mov esi, eax
test esi, esi
pop ecx
jbe 0x4054d2
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054d2
push esi
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
jmp 0x4054d2
push 9
lea eax, [ebp - 0x54]
push 0x412a38
push eax
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4054d2
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4054d2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
mov dword [ebp + 0x68], eax
je 0x4054bf
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
test edi, edi
je 0x4054bf
push edi
call sub.msvcrt.dll_strlen
mov esi, eax
test esi, esi
pop ecx
jbe 0x4054b6
sub eax, dword [ebp + 0x6c]
lea eax, [eax + ebx + 5]
cmp eax, 0x1000
jae 0x4054b6
push esi
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4054d2
mov eax, dword [ebp + 0x7c]
mov al, byte [eax]
inc dword [ebp + 0x7c]
mov byte [ebx], al
inc ebx
mov eax, ebx
sub eax, dword [ebp + 0x6c]
add eax, 0x14
cmp eax, 0x1000
jg 0x4054ed
mov esi, dword [ebp + 0x7c]
cmp byte [esi], 0
jne 0x404eb1
pop edi
pop esi
mov byte [ebx], 0
mov eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8