Function at 0x100516e
Capabilities:
Read clipboard data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
mov ebx, eax
cmp ebx, edi
je 0x1005451
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 0xc]
jne 0x1005451
movzx eax, word [ebp + 0x10]
dec eax
dec eax
je 0x10053e0
dec eax
je 0x100530c
sub eax, 6
je 0x100528a
sub eax, 5
je 0x1005205
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x1005282
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100544c
mov esi, dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push edi
push edi
push ebx
call esi
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x1005277
push eax
push dword [ebp - 8]
push ebx
call esi
test eax, eax
je 0x1005250
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], 1
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xc], edi
jne 0x100544c
push 0x10020a4
call fcn.01004bf7
pop ecx
mov dword [ebp - 8], edi
jmp 0x100544c
lea eax, [ebp - 4]
push eax
push 2
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
movzx eax, word [ebp - 4]
lea eax, [eax*4 + 8]
push eax
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x1005282
mov word [esi], 0x300
mov ax, word [ebp - 4]
mov word [esi + 2], ax
lea eax, [esi + 4]
push eax
movzx eax, word [ebp - 4]
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
test eax, eax
je 0x10052f1
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10052f4
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
jmp 0x10053dd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
je 0x100544c
cmp dword [0x1008a6c], edi
push edi
je 0x100532f
lea eax, [ebp - 0x14]
push eax
push 0x10
push esi
jmp 0x1005354
mov ax, word [esi]
mov word [ebp - 0x10], ax
mov ax, word [esi + 4]
mov word [ebp - 0xe], ax
mov ax, word [esi + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], di
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esi + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp + 0xc], esi
call ebx
push edi
push edi
push esi
mov esi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
call esi
cmp eax, edi
mov dword [ebp - 8], eax
je 0x100544c
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x1005282
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 8], eax
jne 0x10053c7
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
jmp 0x10053ca
mov dword [ebp - 8], edi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call ebx
push dword [ebp + 0x10]
call esi
push eax
jmp 0x1005446
lea eax, [ebp - 0x2c]
push eax
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 9
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10053ff
push 9
call esi
jmp 0x1005401
xor eax, eax
push eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1a]
push eax
push edi
push ebx
call fcn.01006636
mov esi, eax
cmp esi, edi
je 0x100544c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp ebx, edi
je 0x100544c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
jmp 0x100545e
push 0x1002078
call fcn.01004bf7
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc