Function at 0x401695
Capabilities:
Check for foreground window switch
Create process on windows
Get graphical window text
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe20
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [0x404df0], ebx
je 0x4016b7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4016a5
mov esi, dword [ebp + 8]
mov eax, dword [esi]
dec eax
cmp eax, 0x2e
ja case.0x4016c6.2
jmp dword [eax*4 + 0x401d8a]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
push ebx
push 1
call edi
mov ecx, eax
mov eax, dword [esi + 8]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push ebx
call edi
mov ecx, eax
mov eax, dword [esi + 4]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push 0x8001
jmp 0x401742
push ebx
push ebx
push ebx
push ebx
push 6
jmp 0x401742
mov esi, dword [sym.imp.USER32.dll_mouse_event]
push ebx
push ebx
push ebx
push ebx
push 6
call esi
push ebx
push ebx
push ebx
push ebx
push 6
jmp 0x401c71
push ebx
push ebx
push ebx
push ebx
push 0x18
jmp 0x401742
push ebx
push ebx
push ebx
push ebx
push 0x60
jmp 0x401742
push ebx
push ebx
push ebx
push ebx
push 2
jmp 0x401742
push ebx
push ebx
push ebx
push ebx
push 4
call dword [sym.imp.USER32.dll_mouse_event]
jmp case.0x4016c6.2
push dword [esi + 4]
lea eax, [ebp - 0x520]
push eax
call sub.MSVCRT.dll_strcpy
cmp byte [ebp - 0x520], 0x22
pop ecx
pop ecx
jne 0x40178b
lea eax, [ebp - 0x51f]
push 0x4045f0
push eax
lea esi, [ebp - 0x51f]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4017ac
mov byte [eax], bl
inc eax
inc eax
jmp 0x4017ac
lea eax, [ebp - 0x520]
push 0x4045cc
push eax
lea esi, [ebp - 0x520]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4017ac
mov byte [eax], bl
inc eax
push 1
push ebx
push eax
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x4016c6.2
push dword [esi + 4]
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe case.0x4016c6.2
mov edi, dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 4]
mov al, byte [eax + ecx]
mov byte [ebp + 0xb], bl
mov byte [ebp + 0xa], al
lea eax, [ebp + 0xa]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
lea eax, [ebp + 0xa]
push eax
call fcn.00402803
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
push ebx
push ebx
push ebx
push eax
call edi
push ebx
push 2
push ebx
push dword [ebp - 0xc]
call edi
push dword [esi + 4]
inc dword [ebp - 4]
call sub.MSVCRT.dll_strlen
cmp dword [ebp - 4], eax
pop ecx
jb 0x4017dc
jmp case.0x4016c6.2
push ebx
jmp 0x4019b8
push dword [esi + 4]
jmp 0x401b31
mov dword [0x404dec], ebx
jmp case.0x4016c6.2
mov edi, 0x100
lea eax, [ebp - 0x620]
push edi
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [esi + 4]
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne case.0x4016c6.2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401846
push dword [esi + 4]
call fcn.0040157a
test al, al
pop ecx
jne 0x401896
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4016c6.3
push dword [esi + 4]
call fcn.0040157a
test al, al
pop ecx
je case.0x4016c6.2
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401896
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
push ecx
xor ecx, ecx
mov cl, ah
movzx ecx, cl
movzx eax, al
push ecx
push eax
lea eax, [ebp - 0xc]
push str._02X_02X_02X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push dword [esi + 0xc]
lea eax, [ebp - 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x1c
test eax, eax
je case.0x4016c6.2
push dword [0x404dd8]
call fcn.0040157a
test al, al
pop ecx
jne 0x401a3d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4016c6.10
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
push ecx
xor ecx, ecx
mov cl, ah
movzx ecx, cl
movzx eax, al
push ecx
push eax
lea eax, [ebp - 0xc]
push str._02X_02X_02X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push dword [esi + 0xc]
lea eax, [ebp - 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x1c
test eax, eax
jne case.0x4016c6.2
push dword [0x404dd8]
call fcn.0040157a
test al, al
pop ecx
jne 0x401a3d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4016c6.42
push 0x404dc8
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp case.0x4016c6.2
push dword [0x404dcc]
push dword [0x404dc8]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp case.0x4016c6.2
push 1
jmp 0x4019b8
push 2
push dword [esi + 4]
mov ecx, edi
call fcn.004013df
jmp case.0x4016c6.2
mov edi, dword [sym.imp.MSVCRT.dll__strlwr]
push dword [0x404dd8]
call fcn.0040157a
test al, al
pop ecx
jne 0x401a3d
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x404dd0]
je 0x4019cd
lea ecx, [ebp - 0xa20]
mov dword [0x404dd0], eax
push ecx
push eax
call fcn.0040150b
lea eax, [ebp - 0xa20]
push eax
call edi
push dword [esi + 4]
call edi
push dword [esi + 4]
lea eax, [ebp - 0xa20]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x18
test eax, eax
je case.0x4016c6.2
jmp 0x4019cd
mov al, 1
jmp 0x401d83
push ebx
push dword [esi + 4]
jmp 0x401a84
push dword [0x404dd8]
mov esi, dword [esi + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push esi
mov ecx, 0x404dd8
jmp 0x401a76
push dword [0x404de0]
mov esi, dword [esi + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push esi
mov ecx, 0x404de0
call fcn.0040123c
jmp case.0x4016c6.2
push dword [esi + 4]
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 9
push edi
call esi
push 5
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4016c6.2
push dword [esi + 4]
lea eax, [ebp - 0x520]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x520]
push 0x4045cc
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 0x10
cmp esi, ebx
je case.0x4016c6.2
lea eax, [ebp - 0x520]
mov byte [esi], bl
push eax
call fcn.0040157a
test al, al
pop ecx
je 0x401b2f
lea eax, [ebp - 0xe20]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
inc esi
push ebx
lea eax, [ebp - 0xe20]
push esi
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x520]
push eax
call fcn.0040157a
test al, al
pop ecx
je 0x401b2f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b14
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x4016c6.2
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x4016c6.2
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [esi + 4]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
je case.0x4016c6.2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push ebx
push ebx
push 0x11
call esi
push ebx
push ebx
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push 0x11
call esi
push 0x64
call edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x4016c6.2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [esi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 4], eax
mov edi, 0x100
lea ecx, [ebp - 0x120]
push edi
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4045cc
push dword [esi + 4]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x401c4f
inc eax
push eax
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401c4f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [esi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 4], eax
jmp 0x401bf6
push ebx
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebx
push 0x201
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push ebx
push ebx
push 0x202
push dword [ebp - 4]
push dword [ebp + 8]
call esi
jmp case.0x4016c6.2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [esi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov edi, 0x100
lea ecx, [ebp - 0x120]
push edi
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4045cc
push dword [esi + 4]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je case.0x4016c6.2
inc eax
push eax
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je case.0x4016c6.2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [esi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
jmp 0x401c90
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov ebx, eax
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je case.0x4016c6.20
jmp case.0x4016c6.2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
push 0x40
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.0x4016c6.2
push dword [esi + 4]
mov ecx, edi
call fcn.00401e46
push 0x4045d4
mov ecx, edi
call fcn.00401e46
jmp case.0x4016c6.2
mov byte [0x404df4], 1
jmp case.0x4016c6.2
mov eax, dword [esi + 4]
mov dword [0x4045d0], eax
mov dword [0x404dec], 1
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4