Function at 0x1000ef74
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10213d32
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f0
push ebx
push esi
xor esi, esi
mov eax, esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], eax
call fcn.100892a1
mov word [esp + 0x70], ax
xor ebx, ebx
inc ebx
mov dword [esp + 0x74], esi
push 0xd
or edi, 0xffffffff
mov dword [esp + 0x7c], ebx
pop eax
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], ebx
mov word [esp + 0x84], ax
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], ebx
call fcn.100892d5
mov word [esp + 0x98], ax
push 0xf
pop eax
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], ebx
mov word [esp + 0xac], ax
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], ebx
call fcn.100892bb
movdqa xmm0, xmmword [0x10271010]
mov word [esp + 0xc0], ax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xd0], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [eax]
push 0xc
mov dword [esp + 0xc8], esi
mov dword [esp + 0xd0], edi
movdqu xmmword [esp + 0xe0], xmm0
mov dword [esp + 0xf0], 8
mov dword [ebx + 0xc], eax
call fcn.101dbffe
pop ecx
test eax, eax
je 0x1000f0ae
mov dword [eax], vtable.tool::resource.0
mov dword [eax + 4], esi
mov dword [eax], vtable.html::clipboard::data.0
mov dword [eax + 8], esi
jmp 0x1000f0b0
mov eax, esi
push eax
lea ecx, [ebx + 0x18]
call fcn.1000fe33
lea ecx, [esp + 0x70]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ecx
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
lea edx, [esp + 0x24]
push edx
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
push edi
mov eax, dword [edi]
call dword [eax + 0xc]
test eax, eax
jne 0x1000f42f
cmp dword [esp + 0x2c], eax
je 0x1000f0fb
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
jmp 0x1000f42f
mov eax, dword [esp + 0x24]
mov esi, dword [esp + esi*4 + 0xdc]
dec eax
jne 0x1000f420
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [esp + 0x28]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, eax
cmp esi, 4
jne 0x1000f2b6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
shr edi, 1
push edi
push edx
call fcn.10002685
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x304], edi
push dword [esp + 0x18]
mov dword [esp + 0x14], 0x102b807c
call fcn.10131585
mov byte [esp + 0x304], 1
call fcn.100892ef
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x50]
or dword [esp + 0x68], 0xffffffff
mov word [esp + 0x5c], ax
xor eax, eax
inc eax
mov dword [esp + 0x60], edi
push edx
mov dword [esp + 0x68], eax
lea edx, [esp + 0x60]
mov dword [esp + 0x70], eax
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0xc]
test eax, eax
js 0x1000f1c8
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
add eax, 0x4c
lea ecx, [esp + 0x10]
push eax
call fcn.10002746
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
push str..url
lea ecx, [esp + 0x14]
call fcn.10132245
test eax, eax
js 0x1000f208
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax + 4]
add eax, 0xfffffffc
push eax
push edi
lea eax, [esp + 0x50]
push eax
call fcn.10131982
lea ecx, [esp + 0x10]
push dword [eax]
call fcn.10131585
lea ecx, [esp + 0x48]
call fcn.100026e7
mov eax, dword [esp + 0x10]
cmp dword [eax + 4], 0
jne 0x1000f21f
push dword [esp + 0x18]
lea ecx, [esp + 0x14]
call fcn.10131585
push 0x18
call fcn.101dbffe
mov esi, eax
pop ecx
mov dword [esp + 0x14], esi
mov byte [esp + 0x304], 2
test esi, esi
je 0x1000f265
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
call fcn.1013266a
mov ecx, dword [esp + 0x1c]
or ecx, 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, esi
call fcn.10004118
jmp 0x1000f267
mov eax, edi
mov dword [esp + 0x304], 4
mov ecx, dword [ebx + 0x18]
push eax
call fcn.100042c2
mov eax, dword [esp + 0x1c]
test al, 1
je 0x1000f297
and eax, 0xfffffffe
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], eax
call fcn.100026e7
lea ecx, [esp + 0x10]
call fcn.100026e7
or dword [esp + 0x304], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.100026e7
jmp 0x1000f416
cmp esi, 0x10
jne 0x1000f36a
xor esi, esi
mov dword [esp + 0x14], esi
push esi
push esi
push 0xffffffffffffffff
mov dword [esp + 0x310], 5
push dword [esp + 0x34]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov edi, eax
test edi, edi
je 0x1000f32f
push 0x104
lea eax, [esp + 0xf4]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
xor eax, eax
lea ecx, [esp + 0x4c]
mov word [esp + 0x2f6], ax
lea eax, [esp + 0xf0]
push eax
call fcn.10002639
push eax
lea ecx, [esp + 0x18]
call fcn.100109f4
lea ecx, [esp + 0x4c]
call fcn.100026e7
inc esi
cmp esi, edi
jb 0x1000f2e4
push 0x14
call fcn.101dbffe
pop ecx
test eax, eax
je 0x1000f349
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.100041f1
jmp 0x1000f34b
xor eax, eax
mov ecx, dword [ebx + 0x18]
push eax
call fcn.100042c2
or dword [esp + 0x304], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.100109aa
jmp 0x1000f416
cmp esi, 1
jne 0x1000f3ae
push 0x14
shr edi, 1
call fcn.101dbffe
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x304], 6
test eax, eax
je 0x1000f3a2
mov edx, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], edx
mov dword [ecx + 4], edi
mov ecx, eax
call fcn.10004067
jmp 0x1000f3a4
xor eax, eax
or dword [esp + 0x304], 0xffffffff
jmp 0x1000f40d
cmp esi, 2
jne 0x1000f3e4
push 0x10
call fcn.101dbffe
pop ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x304], 7
test eax, eax
je 0x1000f3a2
mov edx, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], edx
mov dword [ecx + 4], edi
mov ecx, eax
call fcn.10003fa8
jmp 0x1000f3a4
cmp esi, 8
jne 0x1000f416
push 0x10
call fcn.101dbffe
pop ecx
test eax, eax
je 0x1000f40b
mov edx, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], edx
mov dword [ecx + 4], edi
mov ecx, eax
call fcn.10004021
jmp 0x1000f40d
xor eax, eax
mov ecx, dword [ebx + 0x18]
push eax
call fcn.100042c2
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
inc esi
add ecx, 0x14
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ecx
cmp esi, 5
jb 0x1000f0c5
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x1000f4a7
call fcn.10004310
test eax, eax
je 0x1000f4a7
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x18]
push 1
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
push eax
push dword [esi + 0x1bc]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x3c]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x20]
push dword [ebx + 0x18]
mov ebx, dword [ebp + 0x1c]
push ebx
call fcn.100371e7
test al, al
jne 0x1000f4ad
and dword [ebx], 0
jmp 0x1000f4ad
mov eax, dword [ebp + 0x1c]
and dword [eax], 0
mov ecx, dword [esp + 0x2fc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18