Function at 0x140001990
Capabilities:
Check for foreground window switch
Extract resource via kernel32 functions
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push rbp
push rbx
push rdi
push r14
lea rbp, [rsp - 0x828]
sub rsp, 0x928
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
xor r14d, r14d
mov dword [rbp + 0x3d0], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rbx, rax
test rax, rax
je 0x140001a1b
nop
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140001a05
lea rdx, [rbp + 0x3d0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rbp + 0x3d0], edi
je 0x140001a1e
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x1400019e0
mov rbx, r14
mov qword [0x140006660], rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [0x140006660], rax
test rax, rax
je 0x14000201b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdi, [0x1400043e0]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xorps xmm0, xmm0
mov qword [rbp + 0x380], r14
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm0
lea rax, [0x1400010d0]
movdqa xmmword [rbp + 0x3b0], xmm1
xor ecx, ecx
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x390], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x398], rax
lea rcx, [rbp + 0x380]
lea rax, str.TrayWin
mov qword [rbp + 0x3c0], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
mov rax, qword [rbp + 0x398]
xor r9d, r9d
mov rdx, qword [rbp + 0x3c0]
xor ecx, ecx
mov qword [rsp + 0x58], r14
mov r8, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor edx, edx
lea rcx, [rbp - 0x30]
mov rbx, rax
mov r8d, 0x308
xor eax, eax
mov dword [rbp - 0x54], eax
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x3c], eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rbp - 0x50], rbx
xor eax, eax
mov dword [rbp - 0x58], 0x3d0
mov ebx, 7
mov qword [rbp + 0x36c], rax
xor ecx, ecx
mov dword [rbp + 0x374], eax
movups xmmword [rbp + 0x2dc], xmm0
mov dword [rbp - 0x44], ebx
movups xmmword [rbp + 0x2ec], xmm0
mov dword [rbp + 0x2d8], 3
movups xmmword [rbp + 0x2fc], xmm0
mov dword [rbp - 0x40], 0x400
movups xmmword [rbp + 0x30c], xmm0
movups xmmword [rbp + 0x31c], xmm0
movups xmmword [rbp + 0x32c], xmm0
movups xmmword [rbp + 0x33c], xmm0
movups xmmword [rbp + 0x34c], xmm0
movups xmmword [rbp + 0x35c], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea edx, [rbx + 0x5e]
call qword [sym.imp.USER32.dll_LoadIconW]
lea r8, str._Fix_my_text__n
mov qword [rbp - 0x38], rax
lea edx, [rbx + 0x25]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rbp + 0x410]
lea rcx, [rbp - 0x58]
nop dword [rax]
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rbx, 1
jne 0x140001bd0
movups xmm0, xmmword [rcx]
lea rdx, [rbp + 0x410]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
xor ecx, ecx
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
mov dword [rbp + 0x3e0], 2
mov dword [rbp + 0x7e0], 0x5b
mov dword [rbp + 0x7e4], 0xa2
mov dword [rbp + 0x7e8], 0x5b
mov dword [rbp + 0x7ec], 0xa4
mov dword [rbp + 0x3e0], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x6f
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140001cd5
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001cd5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
lea rcx, [0x140004688]
call fcn.140001070
cmp dword [0x140006668], r14d
jne 0x140002009
mov qword [rsp + 0x950], rsi
mov esi, 0xa
mov qword [rsp + 0x958], r12
mov r12d, 0x451
mov qword [rsp + 0x960], r13
mov qword [rsp + 0x920], r15
movaps xmmword [rsp + 0x910], xmm6
lea r13d, [r12 - 0x50]
movaps xmmword [rsp + 0x900], xmm7
mov edi, r14d
lea rbx, [rbp + 0x7e0]
nop dword [rax + rax]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001d60
inc edi
add rbx, 4
cmp edi, 2
jl 0x140001d40
mov r15d, 1
jmp 0x140001d92
mov edi, r14d
lea rbx, [rbp + 0x7e8]
nop word [rax + rax]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400025f0
inc edi
add rbx, 4
cmp edi, 2
jl 0x140001d70
mov r15d, 2
lea rcx, str.________________________________________________n
mov dword [rbp + 0x3d0], r15d
call fcn.140001070
lea rcx, [rbp - 0x70]
call fcn.1400013a0
mov ecx, 0xfffffff5
movsd xmm0, qword [rax + 0x10]
movups xmm7, xmmword [rax]
movsd qword [rsp + 0x70], xmm0
movsd qword [rbp + 0x3f0], xmm0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.GetBufer:_t
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, 0xf
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp dword [rbp + 0x3f0], 0xd
jne 0x140001e21
movq rdx, xmm7
lea rcx, str.__s__n
call fcn.140001010
jmp 0x140001e5d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__PICTURE__
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001e75
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140001ea5
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140001ea5
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001ef1
xorps xmm0, xmm0
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea rcx, [rbp + 0x3e0]
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
movups xmmword [rbp + 0x400], xmm0
call qword [sym.imp.USER32.dll_PeekMessageW]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001e75
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x140006660]
jne 0x140002039
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400046c8]
lea rcx, str.Message:_t_s_n
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movq rsi, xmm7
test rsi, rsi
je 0x140001fc1
psrldq xmm7, 8
mov ecx, 0x2000
movq rdx, xmm7
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140001f93
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140001f8a
movq r8, xmm7
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001fb8
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [rsp + 0x70]
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, 0xa
cmp dword [0x140006668], 0
mov r14d, 0
je 0x140001d31
movaps xmm7, xmmword [rsp + 0x900]
movaps xmm6, xmmword [rsp + 0x910]
mov r15, qword [rsp + 0x920]
mov r13, qword [rsp + 0x960]
mov r12, qword [rsp + 0x958]
mov rsi, qword [rsp + 0x950]
lea rdx, [rbp + 0x410]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor eax, eax
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.140002650
add rsp, 0x928
pop r14
pop rdi
pop rbx
pop rbp
ret
mov ebx, r14d
nop dword [rax]
mov ecx, 0x43
call fcn.1400018e0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x3e0]
call fcn.1400013a0
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movq rsi, xmm6
movsd qword [rbp - 0x78], xmm0
test rsi, rsi
jne 0x1400020be
xorps xmm0, xmm0
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea rcx, [rbp + 0x380]
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
call qword [sym.imp.USER32.dll_PeekMessageW]
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc ebx
cmp ebx, 0xa
jl 0x140002040
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.GetBufer:_t
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14d, dword [rbp - 0x78]
cmp r14d, 0xd
jne 0x140002119
mov rdx, rsi
lea rcx, str.__s__n
call fcn.140001010
lea ebx, [r14 - 2]
jmp 0x140002158
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, 0xb
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__PICTURE__
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test rsi, rsi
jne 0x140002180
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140004708]
jmp 0x140001f22
cmp r14d, 8
jne 0x1400021aa
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140004720]
jmp 0x140001f22
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400021c2
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, r15d
sub ecx, 1
je 0x1400022e8
cmp ecx, 1
jne 0x140002333
xor r9d, r9d
mov rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r9w
jne 0x1400021e1
test rax, rax
je 0x1400022c6
mov r14d, 0x430
mov r8, rsi
mov edi, 0xffe0
lea r15d, [r14 - 0x20]
nop word [rax + rax]
movzx edx, word [r8]
movzx eax, dx
lea ecx, [rdx - 0x61]
cmp cx, 0x19
jbe 0x14000222d
movzx ecx, dx
sub cx, r14w
cmp cx, 0x1f
ja 0x140002230
add dx, di
cmp dx, r12w
jne 0x140002239
mov edx, r13d
cmp ax, dx
jne 0x140002263
lea ecx, [rax - 0x41]
cmp cx, 0x19
jbe 0x140002254
movzx ecx, ax
sub cx, r15w
cmp cx, 0x1f
ja 0x140002258
add ax, 0x20
cmp ax, r13w
jne 0x140002286
mov eax, r12d
jmp 0x140002286
lea ecx, [rax - 0x61]
cmp cx, 0x19
jbe 0x140002279
movzx ecx, ax
sub cx, r14w
cmp cx, 0x1f
ja 0x14000227c
add ax, di
cmp ax, r12w
jne 0x140002286
movzx eax, r13w
inc r9d
mov word [r8], ax
add r8, 2
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x1400022a0
movsxd rax, r9d
cmp rax, rcx
jb 0x140002210
mov r14d, dword [rbp - 0x78]
mov edi, 0xf
mov r15d, dword [rbp + 0x3d0]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140004600]
jmp 0x140002310
mov rcx, rsi
call fcn.140001490
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400045e8]
lea rcx, str.Message:_t_s_n
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.SetBufer:_t
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp r14d, 0xd
jne 0x140002386
mov rdx, rsi
lea rcx, str.__s__n
call fcn.140001010
jmp 0x1400023c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__PICTURE__
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test rsi, rsi
je 0x14000243b
psrldq xmm6, 8
mov ecx, 0x2000
movq rdx, xmm6
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140002409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140002400
movq r8, xmm6
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000242d
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, 0xf
mov ecx, 0x56
call fcn.1400018e0
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400024a6
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea rcx, [rbp + 0x380]
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
call qword [sym.imp.USER32.dll_PeekMessageW]
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc ebx
cmp ebx, 0xa
jl 0x140002447
jmp 0x1400024b2
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.SetBufer:_t
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14d, dword [rsp + 0x70]
movq rdi, xmm7
cmp r14d, 0xd
jne 0x14000250f
mov rdx, rdi
lea rcx, str.__s__n
call fcn.140001010
jmp 0x14000254d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__PICTURE__
call fcn.140001070
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test rdi, rdi
je 0x1400025c3
psrldq xmm7, 8
mov ecx, 0x2000
movq rdx, xmm7
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140002596
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000258d
movq r8, xmm7
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400025ba
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [0x140006074], 0
je 0x1400025eb
cmp r15d, 1
jne 0x1400025eb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea edx, [r15 + 0x4f]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov esi, 0xa
xorps xmm0, xmm0
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea rcx, [rbp + 0x380]
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
call qword [sym.imp.USER32.dll_PeekMessageW]
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001fc6