Function at 0x140005c98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Monitor clipboard content

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rcx], ebx
mov dword [rbp - 0x20], 0x477a2d35
mov dword [rbp - 0x1c], 0x9ff0b322
mov dword [rbp - 0x18], 0xe32041f7
mov dword [rbp - 0x14], 0x653797
mov dword [rbp - 0x10], 0x474e2d60
mov dword [rbp - 0xc], 0x9ff6b32f
mov dword [rbp - 8], 0xe32841fb
mov dword [rbp - 4], 0x713797
mov dword [rbp], 0x475f2d66
mov dword [rbp + 4], 0x9fd2b32a
mov dword [rbp + 8], 0xe37f41eb
mov edi, 0x37e3
mov r15d, 4
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov eax, dword [r15 + r14]
cmp dword [0x1400a4de4], eax
jle 0x140005db1
lea rcx, [0x1400a4de4]
call fcn.14004b24c
cmp dword [0x1400a4de4], 0xffffffff
jne 0x140005db1
mov byte [0x1400a52f6], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x1400a52c8], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x1400a52d8], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x1400a52e8], xmm0
mov eax, dword [rbp + 8]
mov dword [0x1400a52f0], eax
mov word [0x1400a52f4], di
lea rcx, [0x140074258]
call fcn.14004b9c0
lea rcx, [0x1400a4de4]
call fcn.14004b1ec
lea rdx, [0x1400a52c8]
mov dil, 7
cmp byte [0x1400a52f6], bl
je 0x140005df0
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x37e3419fb3472d09
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x17
jb 0x140005dc6
mov byte [0x1400a52f6], bl
movdqa xmm0, xmmword [0x14008cc10]
movdqa xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
lea rcx, [rsp + 0x60]
call fcn.140017f74
nop
mov dword [rbp - 0x20], 0x1fe9bb55
mov dword [rbp - 0x1c], 0xf785dd4b
mov dword [rbp - 0x18], 0x233e57a5
mov dword [rbp - 0x14], 0xdfb740
mov dword [rbp - 0x10], 0x1fdfbb2c
mov dword [rbp - 0xc], 0xf7a9dd76
mov dword [rbp - 8], 0x233857b1
mov dword [rbp - 4], 0xdab751
mov dword [rbp], 0x1fcfbb08
mov dword [rbp + 4], 0xf7dddd21
mov eax, dword [r15 + r14]
cmp dword [0x1400a5550], eax
jle 0x140005eb7
lea rcx, [0x1400a5550]
call fcn.14004b24c
cmp dword [0x1400a5550], 0xffffffff
jne 0x140005eb7
mov byte [0x1400a4fa8], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x1400a4f80], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x1400a4f90], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x1400a4fa0], xmm0
lea rcx, [0x140074238]
call fcn.14004b9c0
lea rcx, [0x1400a5550]
call fcn.14004b1ec
lea rdx, [0x1400a4f80]
cmp byte [0x1400a4fa8], bl
je 0x140005ef3
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0xb72357f7dd1fbb69
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x14
jb 0x140005ec9
mov byte [0x1400a4fa8], bl
movdqa xmm0, xmmword [0x14008cc10]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], bx
lea rcx, [rbp - 0x80]
call fcn.140017f74
nop
mov dword [rbp - 0x20], 0xbff6a7ed
mov dword [rbp - 0x1c], 0x45c597ee
mov dword [rbp - 0x18], 0x21a8cb2c
mov dword [rbp - 0x14], 0x387d49
mov dword [rbp - 0x10], 0xbfcea7b5
mov dword [rbp - 0xc], 0x45d197cb
mov dword [rbp - 8], 0x21b9cb2a
mov dword [rbp - 4], 0x1c7d4c
mov dword [rbp], 0xbf99a7a5
mov eax, dword [r15 + r14]
cmp dword [0x1400a5484], eax
jle 0x140005fb8
lea rcx, [0x1400a5484]
call fcn.14004b24c
cmp dword [0x1400a5484], 0xffffffff
jne 0x140005fb8
mov byte [0x1400a4ca6], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x1400a4c80], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x1400a4c90], xmm1
mov eax, dword [rbp]
mov dword [0x1400a4ca0], eax
mov eax, 0x97bf
mov word [0x1400a4ca4], ax
lea rcx, [0x140074218]
call fcn.14004b9c0
lea rcx, [0x1400a5484]
call fcn.14004b1ec
lea rdx, [0x1400a4c80]
cmp byte [0x1400a4ca6], bl
je 0x140005ff4
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x7d21cb4597bfa7d1
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x13
jb 0x140005fca
mov byte [0x1400a4ca6], bl
movdqa xmm0, xmmword [0x14008cc10]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], bx
lea rcx, [rbp - 0x60]
call fcn.140017f74
nop
mov dword [rbp - 0x20], 0x3d76336a
mov dword [rbp - 0x1c], 0x6f450d7e
mov dword [rbp - 0x18], 0xf3e5b12e
mov dword [rbp - 0x14], 0x4201ac
mov dword [rbp - 0x10], 0x3d7a3371
mov dword [rbp - 0xc], 0x6f520d6d
mov dword [rbp - 8], 0xf3f4b13d
mov dword [rbp - 4], 0x4e01b0
mov dword [rbp], 0x3d77336f
mov dword [rbp + 4], 0x6f4b0d62
mov dword [rbp + 8], 0xf3e3b120
mov dword [rbp + 0xc], 0x4001be
mov dword [rbp + 0x10], 0x3d6c3369
mov dword [rbp + 0x14], 0x6f480d75
mov dword [rbp + 0x18], 0xf3f5b12e
mov dword [rbp + 0x1c], 0x2b018f
mov dword [rbp + 0x20], 0x3d333341
lea rdx, [0x1400a4ea0]
mov eax, dword [r15 + r14]
cmp dword [0x1400a51d4], eax
jle 0x1400060ea
lea rcx, [0x1400a51d4]
call fcn.14004b24c
cmp dword [0x1400a51d4], 0xffffffff
jne 0x1400060e3
mov byte [0x1400a4ee4], 1
mov r8d, 0x44
lea rdx, [rbp - 0x20]
lea rcx, [0x1400a4ea0]
call fcn.14004cf60
lea rcx, [0x1400741f8]
call fcn.14004b9c0
lea rcx, [0x1400a51d4]
call fcn.14004b1ec
lea rdx, [0x1400a4ea0]
cmp byte [0x1400a4ee4], bl
je 0x14000611f
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x1f3b16f0d3d333d
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x22
jb 0x1400060f5
mov byte [0x1400a4ee4], bl
movdqa xmm0, xmmword [0x14008cc10]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
lea rcx, [rbp - 0x40]
call fcn.140017f74
nop
lea rcx, [rsi + 8]
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x60]
call fcn.14001ce28
nop
lea r9, [0x140007764]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x60]
call fcn.14004b654
mov qword [rsi + 0x58], rbx
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140005434
nop
mov byte [rsi + 0x188], bl
lea rdi, [rsi + 0x190]
mov qword [rbp + 0x40], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
call fcn.14001a3c8
mov qword [rdi], rax
mov dword [rbp - 0x20], 0xe55b19b9
mov dword [rbp - 0x1c], 0xd988c9d4
mov dword [rbp - 0x18], 0xe93e0def
mov dword [rbp - 0x14], 0xfebbda
mov dword [rbp - 0x10], 0xe52919a0
mov dword [rbp - 0xc], 0xd9f0c9a6
mov dword [rbp - 8], 0xe9200deb
mov dword [rbp - 4], 0x8ebbdd
mov dword [rbp], 0xe55f19bf
mov dword [rbp + 4], 0xd9f0c9c8
mov dword [rbp + 8], 0xe94e0dec
mov dword [rbp + 0xc], 0x96bbac
mov dword [rbp + 0x10], 0xe52f19c9
mov dword [rbp + 0x14], 0xd9fac9d4
mov dword [rbp + 0x18], 0xe9380dea
mov dword [rbp + 0x1c], 0x8fbbdb
mov dword [rbp + 0x20], 0xe52b19be
mov dword [rbp + 0x24], 0xd98dc9a4
mov dword [rbp + 0x28], 0xe94b0d86
mov dword [rbp + 0x2c], 0xc9bb86
mov dword [rbp + 0x30], 0xe57819e0
mov dword [rbp + 0x34], 0xd9c9c991
lea rdi, [0x1400a5020]
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x1400a51a8], eax
jle 0x14000629b
lea rcx, [0x1400a51a8]
call fcn.14004b24c
cmp dword [0x1400a51a8], 0xffffffff
jne 0x14000629b
mov byte [0x1400a5078], 1
mov r8d, 0x58
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14004cf60
lea rcx, [0x14007406c]
call fcn.14004b9c0
lea rcx, [0x1400a51a8]
call fcn.14004b1ec
cmp byte [0x1400a5078], bl
je 0x1400062ce
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xbbe90dd9c9e5198d
shr rax, cl
xor word [rdi + rdx*2], ax
inc rdx
cmp rdx, 0x2c
jb 0x1400062a6
mov byte [0x1400a5078], bl
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [rsi], eax
mov rcx, rsi
call fcn.1400070d0
mov dword [rbp + 0x40], 0x677a1558
mov dword [rbp + 0x44], 0x67636309
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x1400a5170], eax
jle 0x14000633f
lea rcx, [0x1400a5170]
call fcn.14004b24c
cmp dword [0x1400a5170], 0xffffffff
jne 0x14000633f
mov byte [0x1400a4e08], 1
mov rax, qword [rbp + 0x40]
mov qword [0x1400a4e00], rax
lea rcx, [0x1400741ec]
call fcn.14004b9c0
lea rcx, [0x1400a5170]
call fcn.14004b1ec
lea rdi, [0x1400a4e00]
cmp byte [0x1400a4e08], bl
je 0x140006379
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xf553e56763671535
shr rax, cl
xor word [rdi + rdx*2], ax
inc rdx
cmp rdx, 4
jb 0x140006351
mov byte [0x1400a4e08], bl
lea rdx, [r15 + 0x40]
lea rcx, [0x14009fdc0]
call fcn.140004f84
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100
mov dword [rsp + 0x20], 0x6cf0000
mov r9, rdi
mov r8, rbx
mov rcx, r15
call fcn.14001b664
mov ecx, 0x11
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x2f]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_62f4e708318f69aa0ddad9efb82c751d___long_long___int64___struct_HWND______ptr64__unsigned_int__unsigned_long_long_unsigned___int64___long_long___int64___int____ptr64_.0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
lea rax, [rbp - 0x20]
mov qword [rbp + 0x18], rax
lea r8, [rbp - 0x20]
mov edx, 0x31d
mov rcx, r15
call fcn.1400055dc
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000641a
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp - 0x20]
cmp rcx, rax
setne dl
call r8
nop
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
nop
mov rax, rsi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret