Function at 0x100f3e9
Capabilities:
Read clipboard data
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
mov ebx, eax
cmp ebx, edi
je 0x100f6ce
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 0xc]
jne 0x100f6ce
movzx eax, word [ebp + 0x10]
dec eax
dec eax
je 0x100f65d
dec eax
je 0x100f589
sub eax, 6
je 0x100f507
sub eax, 5
je 0x100f482
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x100f4ff
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100f6c9
mov esi, dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push edi
push edi
push ebx
call esi
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x100f4f4
push eax
push dword [ebp - 8]
push ebx
call esi
test eax, eax
je 0x100f4cd
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], 1
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xc], edi
jne 0x100f6c9
push 0x1003270
call fcn.0100eda2
pop ecx
mov dword [ebp - 8], edi
jmp 0x100f6c9
lea eax, [ebp - 4]
push eax
push 2
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
movzx eax, word [ebp - 4]
lea eax, [eax*4 + 8]
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x100f4ff
mov word [esi], 0x300
mov ax, word [ebp - 4]
mov word [esi + 2], ax
lea eax, [esi + 4]
push eax
movzx eax, word [ebp - 4]
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
test eax, eax
je 0x100f56e
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100f571
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
jmp 0x100f65a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x100f6c9
cmp dword [0x1014188], edi
push edi
je 0x100f5ac
lea eax, [ebp - 0x14]
push eax
push 0x10
push esi
jmp 0x100f5d1
mov ax, word [esi]
mov word [ebp - 0x10], ax
mov ax, word [esi + 4]
mov word [ebp - 0xe], ax
mov ax, word [esi + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], di
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esi + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp + 0xc], esi
call ebx
push edi
push edi
push esi
mov esi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
call esi
cmp eax, edi
mov dword [ebp - 8], eax
je 0x100f6c9
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x100f4ff
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 8], eax
jne 0x100f644
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
jmp 0x100f647
mov dword [ebp - 8], edi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call ebx
push dword [ebp + 0x10]
call esi
push eax
jmp 0x100f6c3
lea eax, [ebp - 0x2c]
push eax
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 9
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100f67c
push 9
call esi
jmp 0x100f67e
xor eax, eax
push eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1a]
push eax
push edi
push ebx
call fcn.0101046f
mov esi, eax
cmp esi, edi
je 0x100f6c9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp ebx, edi
je 0x100f6c9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
jmp 0x100f6db
push 0x1003244
call fcn.0100eda2
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc