Function at 0x10001770
Capabilities:
Read clipboard data
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov esi, esp
mov eax, 0x14
call fcn.1025a110
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
sub esp, 8
mov ecx, esp
lea edx, [esi + 0xb8]
mov dword [ecx + 4], edx
mov dword [ecx], 0xe75224
mov ecx, dword [sym.imp.GDI32.dll_GetWindowExtEx]
mov dword [esi + 0x9c], eax
call ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx + 0xc], 0x4c4
mov dword [ecx + 8], 0x4c4
mov dword [ecx + 4], 0x816bab
mov dword [ecx], 0x90fbf7
mov ecx, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov dword [esi + 0x98], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xacc
mov dword [ecx], 0x388
mov ecx, dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
mov dword [esi + 0x94], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x9dc
mov dword [ecx], 0x1afd5b
mov ecx, dword [sym.imp.USER32.dll_GetWindow]
mov dword [esi + 0x90], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xe14
mov dword [ecx], 0x45f622
mov ecx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esi + 0x8c], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x9cb
mov dword [ecx], 0xdb7b59
mov ecx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esi + 0x88], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x51727d
mov dword [ecx], 0x9e7270
mov ecx, dword [sym.imp.USER32.dll_IsChild]
mov dword [esi + 0x84], eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_GetCapture]
mov dword [esi + 0x80], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x8a3
mov ecx, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 0x7c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xf9e418
mov ecx, dword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [esi + 0x78], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ecx
jmp 0x100018de
sub esp, 4
mov eax, esp
mov dword [eax], 0xfd6
mov eax, dword [sym.imp.USER32.dll_GetQueueStatus]
call eax
mov dword [esi + 0x6c], eax
jmp 0x10001978
mov eax, dword [esi + 0x70]
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xc50
mov dword [ecx], 0x80b729
mov ecx, dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov dword [esi + 0x68], eax
call ecx
sub esp, 8
mov eax, esp
lea ecx, [esi + 0xa8]
mov dword [eax + 4], ecx
mov dword [eax], 0x5ce20f
mov eax, dword [sym.imp.USER32.dll_MapDialogRect]
call eax
mov ecx, 0x6e4633
mov dword [esi + 0xa4], ecx
sub esp, 0xc
mov ecx, esp
lea edx, [esi + 0xa4]
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x56d
mov dword [ecx], 0x288cb7
mov ecx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [esi + 0x64], eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esi + 0x60], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], ecx
mov eax, dword [esi + 0x58]
mov ecx, 0x14
mov dword [esi + 0x54], eax
xor edx, edx
div ecx
cmp edx, 1
je 0x100018c4
mov eax, dword [esi + 0x54]
add eax, 1
cmp eax, 0x187
mov dword [esi + 0x58], eax
jne 0x1000195d
sub esp, 0x14
mov eax, esp
mov dword [eax + 0x10], 0x709
mov dword [eax + 0xc], 0x65a
mov dword [eax + 8], 0x709
mov dword [eax + 4], 0xb05
mov dword [eax], 0x806bc6
mov eax, dword [sym.imp.KERNEL32.dll_UnlockFile]
call eax
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x68]
sub eax, 7
mov dword [esi + 0x4c], eax
je 0x10001a2e
jmp 0x100019c8
mov eax, dword [esi + 0x68]
sub eax, 0x5c
mov dword [esi + 0x48], eax
je 0x100019df
jmp 0x100019d5
xor eax, eax
mov dword [esi + 0x44], eax
jmp 0x10001a90
sub esp, 8
mov eax, esp
mov dword [eax + 4], 0x9bb
mov dword [eax], 0x60d2b6
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xd22
mov ecx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 0x40], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xa88
mov dword [ecx], 0xa4848b
mov ecx, dword [sym.imp.GDI32.dll_GetNearestColor]
mov dword [esi + 0x3c], eax
call ecx
mov dword [esi + 0x38], eax
xor eax, eax
mov ecx, 0x14
sub esp, 0xc
mov edx, dword [esi + 0x9c]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
call sub.msvcrt.dll_memset
add esp, 0xc
sub esp, 4
mov eax, esp
mov ecx, dword [esi + 0x9c]
mov dword [eax], ecx
mov eax, dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
call eax
mov dword [esi + 0x2c], eax
sub esp, 4
mov eax, esp
mov dword [eax], 0x8322ff
mov eax, dword [sym.imp.USER32.dll_HideCaret]
call eax
mov dword [esi + 0x28], eax
jmp 0x10001b3d
mov eax, dword [esi + 0x44]
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x44f
mov ecx, dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [esi + 0x24], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x32463e
mov ecx, dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [esi + 0x20], eax
call ecx
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0x336
mov dword [ecx + 0x10], 0x1025d146
mov dword [ecx + 0xc], 0x336
mov dword [ecx + 8], 0x1025d14e
mov dword [ecx + 4], 0x246
mov dword [ecx], 0xed6
mov ecx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esi + 0x1c], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xadf03c
mov dword [ecx], 0x69d
mov ecx, dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov dword [esi + 0x18], eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_CountClipboardFormats]
mov dword [esi + 0x14], eax
call ecx
mov ecx, dword [esi + 0x24]
add ecx, 1
cmp ecx, 0xa
mov dword [esi + 0x10], eax
mov dword [esi + 0x44], ecx
jne 0x10001a90
jmp 0x10001b3d
mov eax, dword [sym.imp.USER32.dll_GetShellWindow]
call eax
mov ecx, dword [esi + 0x68]
add ecx, 1
cmp ecx, 0x125
sete dl
mov dword [esi + 0xc], eax
mov dword [esi + 8], ecx
mov byte [esi + 7], dl
mov al, byte [esi + 7]
test al, 1
mov ecx, dword [esi + 8]
mov dword [esi + 0x70], ecx
jne 0x10001b71
jmp 0x100018de
lea esp, [ebp - 4]
pop esi
pop ebp
ret