Function at 0x40d540
Capabilities:
Check os version
Get keyboard layout
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x528
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test ebp, ebp
je 0x40d56b
push 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x40d573
call dword [0x45eecc]
mov ebp, eax
test ebp, ebp
je 0x40dcab
mov ebx, dword [esp + 0x53c]
test bh, 0xff
jne 0x40d5dd
cmp bx, 0xd
jne 0x40d5b6
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0x1c0001
push 0xd
push 0x100
push ebp
call esi
push 0xc01c0001
push 0xd
push 0x101
push ebp
call esi
jmp 0x40dca3
and ebx, 0xffff
push 1
push ebx
push 0x102
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x45eed4]
test eax, eax
jne 0x40dcab
jmp 0x40dca3
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x424]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x424]
mov dword [esp + 0x424], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x434]
mov dword [esp + 0x10], 0
cmp eax, 2
jne 0x40d62c
cmp dword [esp + 0x428], 5
jb 0x40d62c
mov dword [esp + 0x10], 1
mov esi, dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x14]
push 0x208
push ecx
push ebp
call esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [esp + 0x21c]
push 0x208
push edx
push eax
call esi
test eax, eax
jne 0x40d661
mov word [esp + 0x21c], ax
mov eax, dword [0x45eed4]
test eax, eax
je 0x40d80b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d7c3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x21c]
push str.OpusApp
push eax
call esi
test eax, eax
je 0x40d7a1
lea ecx, [esp + 0x21c]
push str.XLMAIN
push ecx
call esi
test eax, eax
je 0x40d7a1
push 9
lea edx, [esp + 0x220]
push str.FrontPage
push edx
call fcn.00421335
add esp, 0xc
test eax, eax
je 0x40d7a1
lea eax, [esp + 0x14]
push str._WwG
push eax
call esi
test eax, eax
je 0x40d7a1
lea ecx, [esp + 0x14]
push str.Internet_Explorer_Server
push ecx
call esi
test eax, eax
je 0x40d7a1
lea edx, [esp + 0x14]
push str.paneClassDC
push edx
call esi
test eax, eax
je 0x40d7a1
lea eax, [esp + 0x14]
push str.MSWinPub
push eax
call esi
test eax, eax
je 0x40d7a1
lea ecx, [esp + 0x14]
push str.WordProDocWndNT
push ecx
call esi
test eax, eax
je 0x40d7a1
lea edx, [esp + 0x14]
push str.Lego.LSEDITN31
push edx
call esi
test eax, eax
je 0x40d7a1
lea eax, [esp + 0x14]
push str.LSEDITN31
push eax
call esi
test eax, eax
je 0x40d7a1
lea ecx, [esp + 0x14]
push str.SuperEdit
push ecx
call esi
test eax, eax
je 0x40d7a1
lea edx, [esp + 0x14]
push str.FLWMdiPres
push edx
call esi
test eax, eax
je 0x40d7a1
lea eax, [esp + 0x14]
push str.PSViewC
push eax
call esi
test eax, eax
je 0x40d7a1
lea ecx, [esp + 0x14]
push str.WinEd20
push ecx
call esi
test eax, eax
je 0x40d7a1
lea edx, [esp + 0x14]
push str.WksQuillCtrl
push edx
call esi
test eax, eax
jne 0x40dc8e
and ebx, 0xffff
push 1
push ebx
push 0x102
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x528
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x14]
push str.RichEdit20A
push eax
call esi
test eax, eax
je 0x40d7e9
lea ecx, [esp + 0x14]
push str.RichEdit20W
push ecx
call esi
test eax, eax
jne 0x40d7a1
and ebx, 0xffff
push 1
push ebx
push 0x286
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x528
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea edx, [esp + 0x21c]
push str.OpusApp
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x21c]
push str.XLMAIN
push eax
call esi
test eax, eax
je 0x40da8b
push 9
lea ecx, [esp + 0x220]
push str.FrontPage
push ecx
call fcn.00421335
add esp, 0xc
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str._WwG
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.Internet_Explorer_Server
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.paneClassDC
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.RichEdit20A
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.RichEdit20W
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.MSWinPub
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.WordProDocWndNT
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.Lego.LSEDITN31
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.LSEDITN31
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.SuperEdit
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.FLWMdiPres
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.PSViewC
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.WinEd20
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.WksQuillCtrl
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.DirectUIHWND
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.RichEdit20WPT
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.REComboBox20W
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.RichTextWndClass
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.TTeComboBox
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.TRichViewEdit
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.TExRichEdit
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x14]
push str.SunAwtFrame
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.TSkypeRichViewEdit
push eax
call esi
test eax, eax
je 0x40da8b
lea ecx, [esp + 0x14]
push str.Shell_DocObject_View
push ecx
call esi
test eax, eax
je 0x40da8b
lea edx, [esp + 0x21c]
push str.ThunderDFrame
push edx
call esi
test eax, eax
je 0x40da8b
lea eax, [esp + 0x14]
push str.TX32
push eax
call esi
test eax, eax
je 0x40da8b
push ebp
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x40dc8e
lea ecx, [esp + 0x14]
push str.QWidget
push ecx
call esi
test eax, eax
push 1
je 0x40dc90
and ebx, 0xffff
push ebx
push 0x102
jmp 0x40dc9c
push 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
mov edi, 1
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp eax, 4
jne 0x40dabc
lea edx, [esp + 0x14]
push str.WinEd20
push edx
call esi
test eax, eax
je 0x40dabc
xor edi, edi
lea eax, [esp + 0x14]
push str.TX32
push eax
call esi
test eax, eax
je 0x40db2f
lea ecx, [esp + 0x14]
push str.TRichViewEdit
push ecx
call esi
test eax, eax
je 0x40db2f
lea edx, [esp + 0x14]
push str.SunAwtFrame
push edx
call esi
test eax, eax
je 0x40db2f
lea eax, [esp + 0x14]
push str.TSkypeRichViewEdit
push eax
call esi
test eax, eax
je 0x40db2f
lea ecx, [esp + 0x14]
push str.Shell_DocObject_View
push ecx
call esi
test eax, eax
je 0x40db2f
lea edx, [esp + 0x21c]
push str.ThunderDFrame
push edx
call esi
test eax, eax
je 0x40db2f
lea eax, [esp + 0x14]
push str.TTeComboBox
push eax
call esi
test eax, eax
jne 0x40db34
mov edi, 1
push 9
lea ecx, [esp + 0x220]
push str.FrontPage
push ecx
call fcn.00421335
add esp, 0xc
test eax, eax
jne 0x40db5f
lea edx, [esp + 0x14]
push str.RichEdit20A
push edx
call esi
test eax, eax
je 0x40db67
test edi, edi
je 0x40dc22
lea eax, [esp + 0x14]
push str.EXCEL7
push eax
call esi
test eax, eax
jne 0x40db9f
call fcn.0043239c
test eax, eax
je 0x40db8b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x40db8f
xor eax, eax
jmp 0x40db92
mov eax, dword [eax + 0x1c]
push 0x454a80
push 3
push eax
call fcn.0040d480
push 0x10
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov word [eax], bx
mov word [eax + 2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_EmptyClipboard]
call ebx
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, dword [sym.imp.USER32.dll_CloseClipboard]
call esi
call fcn.0043239c
test eax, eax
je 0x40dbf9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x40dbfd
xor eax, eax
jmp 0x40dc00
mov eax, dword [eax + 0x1c]
push 0x454ae8
push 5
push eax
call fcn.0040d480
push 0
call edi
call ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x528
ret 4
lea eax, [esp + 0x14]
push str.RichEdit20A
push eax
call esi
test eax, eax
je 0x40dc62
lea ecx, [esp + 0x14]
push str.RichEdit20WPT
push ecx
call esi
test eax, eax
je 0x40dc62
lea edx, [esp + 0x14]
push str.REComboBox20W
push edx
call esi
test eax, eax
je 0x40dc62
lea eax, [esp + 0x14]
push str.RichEdit20W
push eax
call esi
test eax, eax
jne 0x40dc6a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40dc8e
lea ecx, [esp + 0x14]
push str.EQNINSITUCLASS
push ecx
call esi
test eax, eax
je 0x40dc8e
lea edx, [esp + 0x14]
push str.FrontPageEditorDocumentView
push edx
call esi
test eax, eax
jne 0x40d7a1
push 1
and ebx, 0xffff
push ebx
push 0x286
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x528
ret 4