Function at 0x14004b0b0
Capabilities:
Open clipboard
Read clipboard data
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x2c8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r14, rcx
xor eax, eax
xor ecx, ecx
movzx edi, ax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14004b473
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2f0], rbp
mov qword [rsp + 0x2f8], rsi
lea rcx, str.Office_Drawing_Shape_Format
mov qword [rsp + 0x2c0], r12
mov qword [rsp + 0x2b0], r15
call qword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov ecx, 8
mov ebx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov esi, 1
test rax, rax
je 0x14004b14b
mov rdx, r14
mov rcx, rax
call fcn.1400537a0
test eax, eax
je 0x14004b20c
mov edi, esi
jmp 0x14004b445
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14004b20c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
je 0x14004b1fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
lea rcx, [rsp + 0x190]
mov edx, 0x104
mov r12, rax
call fcn.1400661b0
lea rcx, [rsp + 0x40]
call fcn.140063a00
lea rdx, [0x1401f6fd8]
lea rcx, [rsp + 0x190]
call fcn.1401be7e4
mov rbp, rax
test rax, rax
je 0x14004b1fa
lea edx, [r12 - 0x8d]
lea rcx, [r15 + 0x8d]
mov r9, rax
mov r8, rsi
call fcn.1401c24f8
mov rcx, rbp
call fcn.1401be6a4
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x190]
xor r9d, r9d
mov rdx, r14
call fcn.140065400
test ax, ax
jne 0x14004b1fa
movzx edi, si
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test di, di
jne 0x14004b445
mov ecx, 3
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14004b40a
mov rcx, rax
mov qword [rsp + 0x2b8], r13
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, qword [rax + 0x10]
mov ebp, dword [rax + 4]
mov r15d, dword [rax + 8]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_CreateDCA]
mov r12, rax
test ebp, ebp
je 0x14004b2c3
test r15d, r15d
je 0x14004b2c3
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, eax
mov eax, 0xce69a00d
imul ecx, ebp
add ecx, 0x4f6
mul ecx
mov rcx, r12
mov ebp, edx
mov edx, 0x5a
shr ebp, 0xb
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, eax
mov eax, 0xce69a00d
imul ecx, r15d
add ecx, 0x4f6
mul ecx
mov r15d, edx
shr r15d, 0xb
jmp 0x14004b2cb
mov ebp, 0x100
mov r15d, ebp
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r15d
mov edx, ebp
mov rcx, r12
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r13
mov rdx, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
mov dword [rsp + 0x188], ebp
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x18c], r15d
mov qword [rsp + 0x180], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rdx, [rsp + 0x180]
mov r8, rax
mov rcx, r13
mov rbx, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [rsp + 0x20]
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetMapMode]
xor r9d, r9d
mov r8d, r15d
mov edx, ebp
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetWindowExtEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor r9d, r9d
mov r8d, r15d
mov edx, ebp
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetViewportExtEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 7]
call qword [sym.imp.GDI32.dll_SetBoundsRect]
mov rdx, qword [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.GDI32.dll_PlayMetaFile]
mov rbx, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call fcn.1400538f0
mov rdx, r14
movsxd rbp, eax
mov rcx, rbp
call fcn.1400537a0
test eax, eax
je 0x14004b3ce
movzx edi, si
mov rdx, qword [rsp + 0x28]
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r13, qword [rsp + 0x2b8]
jmp 0x14004b445
mov ecx, 2
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14004b445
mov ecx, 9
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, rbx
mov rdx, rax
call fcn.1400538f0
mov rdx, r14
movsxd rcx, eax
call fcn.1400537a0
test eax, eax
je 0x14004b445
movzx edi, si
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r15, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2c0]
mov rsi, qword [rsp + 0x2f8]
mov rbp, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x2e8]
movzx eax, di
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x2c8
pop r14
pop rdi
ret