Function at 0x14006a7d0
Capabilities:
Check if file exists
Delete file
Get common file path
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140129718]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
mov rsi, rcx
xor r13d, r13d
mov r15d, r13d
mov dword [rsp + 0x30], r13d
mov ebx, r13d
nop dword [rax]
test ebx, ebx
jle 0x14006a82f
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14012d7d0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14006a9c5
inc ebx
cmp ebx, 5
jl 0x14006a820
mov esi, 2
mov ecx, esi
call qword [0x1400e8220]
test al, al
je 0x14006a8b6
mov r9d, esi
mov r8d, 0x290
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTooluiScreenCaptureComponent.cpp
lea rcx, [rbp - 0x78]
call qword [0x1400e8218]
nop
mov r15d, 1
mov dword [rsp + 0x30], r15d
lea rcx, [rax + 8]
lea rdx, str._CScreenCaptureComponent__SaveToClipboard_failure
call fcn.14000f940
mov rcx, rax
lea rdx, str._last_error:
call fcn.14000f940
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [0x1400e75d0]
nop
test r15b, 1
je 0x14006a8c6
lea rcx, [rbp - 0x78]
call qword [0x1400e8210]
mov qword [rbp + 0x198], r13
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], InitCommonControls
mov byte [rbp + 0x198], 0
mov ecx, 0x30
call fcn.1400dc988
mov qword [rbp + 0x1a8], 0x27
mov qword [rbp + 0x1b0], 0x2f
movups xmm0, xmmword [str.pc_snipping_tool_open_clipboard_failure]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400ee2d0]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400ee2e0]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x1400ee2e4]
mov word [rax + 0x24], cx
movzx ecx, byte [0x1400ee2e6]
mov byte [rax + 0x26], cl
mov byte [rax + 0x27], 0
mov qword [rbp + 0x198], rax
lea rcx, [rbp + 0x198]
call fcn.140024590
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x14006a995
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a990
call qword [0x1400e7dc8]
int3
call fcn.1400dc8cc
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.1400dc960
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test ebx, ebx
jle 0x14006aa8b
mov qword [rbp + 0x198], r13
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], InitCommonControls
mov byte [rbp + 0x198], r13b
mov ecx, 0x30
call fcn.1400dc988
mov qword [rbp + 0x1a8], 0x28
mov qword [rbp + 0x1b0], 0x2f
movups xmm0, xmmword [str.pc_snipping_tool_open_clipboard_retry_ok]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400ee2f8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400ee308]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], r13b
mov qword [rbp + 0x198], rax
lea rcx, [rbp + 0x198]
call fcn.140024590
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x14006aa8b
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006aa86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006aa86
call qword [0x1400e7dc8]
int3
call fcn.1400dc8cc
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, 0x18
call fcn.1400dc988
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r15d, 1
test rax, rax
je 0x14006aad1
mov qword [rax + 8], r13
mov dword [rax + 0x10], r15d
lea rcx, [0x1400e8990]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14006af3d
jmp 0x14006aad4
mov rbx, r13
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x14006af5e
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006af69
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
mov edx, r15d
sub edx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x104
or eax, edx
jge 0x14006ab28
mov edx, 0x104
lea rcx, [rsp + 0x48]
call fcn.14000eab0
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r12, [rdi - 0x18]
test rdi, rdi
jne 0x14006ab44
mov eax, r13d
jmp 0x14006ab5a
movsxd rdx, dword [r12 + 0xc]
mov rcx, rdi
call qword [0x1400e7e78]
test eax, eax
js 0x14006af53
cmp eax, dword [r12 + 0xc]
jg 0x14006af53
mov dword [r12 + 8], eax
mov eax, eax
mov word [rdi + rax*2], r13w
mov r14d, 0xffffffff
test rdi, rdi
je 0x14006ab85
cmp qword [rbx], rdi
je 0x14006ac13
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14006abbd
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006aba3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14006abb5
call fcn.1400dc8cc
mov qword [rbx + 8], r13
mov rcx, rbx
call fcn.1400dc980
mov qword [rsp + 0x38], r13
mov ecx, 0x18
call fcn.1400dc988
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14006ac02
mov qword [rax + 8], r13
mov dword [rax + 0x10], r15d
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14006ac05
test rdi, rdi
jne 0x14006af48
jmp 0x14006ac05
mov rbx, r13
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x14006af74
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006af7f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140068830
nop
mov rdi, qword [rax]
test rbx, rbx
jne 0x14006ac79
lea ecx, [rbx + 0x18]
call fcn.1400dc988
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14006ac68
mov qword [rax + 8], r13
mov dword [rax + 0x10], r15d
mov qword [rax], r13
jmp 0x14006ac6b
mov rbx, r13
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x14006af32
mov r9, rdi
mov r8, qword [rbx]
lea rdx, str._s_s.bmp
lea rcx, [rsp + 0x40]
call fcn.14002d530
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006acb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x58], r13
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov rax, r13
cmp byte [rsi + 0x28], al
setne al
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
mov edx, 0x812
mov rcx, qword [0x14012d7d0]
call fcn.140030cb0
mov qword [rbp - 0x80], r13
mov dword [rsp + 0x28], InitCommonControls
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
mov rdi, rax
test rax, rax
je 0x14006ad33
mov rdx, rax
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x14006ae93
mov esi, 2
mov ecx, esi
call qword [0x1400e8220]
test al, al
je 0x14006adb6
mov r9d, esi
mov r8d, 0x2b4
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTooluiScreenCaptureComponent.cpp
lea rcx, [rbp + 0x90]
call qword [0x1400e8218]
nop
mov dword [rsp + 0x30], esi
lea rcx, [rax + 8]
lea rdx, str._CScreenCaptureComponent__Load_bmp_failure
call fcn.14000f940
mov rcx, rax
lea rdx, str.__bmp_path:
call fcn.14000f940
mov rdx, rbx
mov rcx, rax
call qword [0x1400e8028]
mov rcx, rax
lea rdx, str._last_error:
call fcn.14000f940
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [0x1400e75d0]
jmp 0x14006adba
mov esi, dword [rsp + 0x30]
test sil, 2
je 0x14006adcd
lea rcx, [rbp + 0x90]
call qword [0x1400e8210]
mov qword [rbp + 0x1b8], r13
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d0], InitCommonControls
mov byte [rbp + 0x1b8], 0
mov ecx, 0x30
call fcn.1400dc988
mov qword [rbp + 0x1c8], 0x23
mov qword [rbp + 0x1d0], 0x2f
movups xmm0, xmmword [str.pc_snipping_tool_load_image_failure]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400ee380]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400ee390]
mov word [rax + 0x20], cx
movzx ecx, byte [0x1400ee392]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], 0
mov qword [rbp + 0x1b8], rax
lea rcx, [rbp + 0x1b8]
call fcn.140024590
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x14006ae93
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ae8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ae8e
call qword [0x1400e7dc8]
int3
call fcn.1400dc8cc
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14006aea9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006aecb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14006aee8
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lock xadd dword [rax + 0x10], r14d
cmp r14d, 1
jne 0x14006a995
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006af13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14006af25
call fcn.1400dc8cc
mov qword [rbx + 8], r13
mov rcx, rbx
call fcn.1400dc980
jmp 0x14006a995
mov ecx, 0x8007000e
call fcn.1400ddbe0
nop
mov ecx, 0x8007000e
call fcn.1400ddbe0
nop
mov ecx, 0x8007000e
call fcn.1400ddbe0
nop
mov ecx, 0x80070057
call fcn.14000d650
nop
mov ecx, 0x8007000e
call fcn.1400ddbe0
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x8007000e
call fcn.1400ddbe0
nop
mov ecx, 0x80004005
call fcn.14000d650
int3