Function at 0x1400064f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Monitor clipboard content

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov dword [rcx], ebx
mov dword [rbp + 0x20], 0x477a2d35
mov dword [rbp + 0x24], 0x9ff0b322
mov dword [rbp + 0x28], 0xe32041f7
mov dword [rbp + 0x2c], 0x653797
mov dword [rbp + 0x30], 0x474e2d60
mov dword [rbp + 0x34], 0x9ff6b32f
mov dword [rbp + 0x38], 0xe32841fb
mov dword [rbp + 0x3c], 0x713797
mov dword [rbp + 0x40], 0x475f2d66
mov dword [rbp + 0x44], 0x9fd2b32a
mov dword [rbp + 0x48], 0xe37f41eb
mov r15d, 0x37e3
mov ecx, 4
mov rax, qword gs:[0x58]
mov r14, qword [rax]
or r13, 0xffffffffffffffff
mov eax, dword [rcx + r14]
cmp dword [0x140160bb8], eax
jle 0x14000660a
lea rcx, [0x140160bb8]
call fcn.1400b77a0
cmp dword [0x140160bb8], r13d
jne 0x14000660a
mov byte [0x140160856], 1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [0x140160828], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [0x140160838], xmm1
movsd xmm0, qword [rbp + 0x40]
movsd qword [0x140160848], xmm0
mov eax, dword [rbp + 0x48]
mov dword [0x140160850], eax
mov word [0x140160854], r15w
lea rcx, [0x1400fee30]
call fcn.1400b7e90
lea rcx, [0x140160bb8]
call fcn.1400b7740
lea r9, [0x140160828]
mov r15b, 7
cmp byte [0x140160856], bl
je 0x140006648
mov rdx, rbx
mov cl, dl
and cl, r15b
shl cl, 3
movabs rax, 0x37e3419fb3472d09
shr rax, cl
xor word [r9 + rdx*2], ax
inc rdx
cmp rdx, 0x17
jb 0x14000661f
mov byte [0x140160856], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
mov r8, r13
inc r8
cmp word [r9 + r8*2], bx
jne 0x14000665c
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14002a4e0
nop
mov dword [rbp + 0x20], 0x1fe9bb55
mov dword [rbp + 0x24], 0xf785dd4b
mov dword [rbp + 0x28], 0x233e57a5
mov dword [rbp + 0x2c], 0xdfb740
mov dword [rbp + 0x30], 0x1fdfbb2c
mov dword [rbp + 0x34], 0xf7a9dd76
mov dword [rbp + 0x38], 0x233857b1
mov dword [rbp + 0x3c], 0xdab751
mov dword [rbp + 0x40], 0x1fcfbb08
mov dword [rbp + 0x44], 0xf7dddd21
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x140160ef0], eax
jle 0x140006722
lea rcx, [0x140160ef0]
call fcn.1400b77a0
cmp dword [0x140160ef0], r13d
jne 0x140006722
mov byte [0x140160f40], 1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [0x140160f18], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [0x140160f28], xmm1
movsd xmm0, qword [rbp + 0x40]
movsd qword [0x140160f38], xmm0
lea rcx, [0x1400fedf8]
call fcn.1400b7e90
lea rcx, [0x140160ef0]
call fcn.1400b7740
lea r9, [0x140160f18]
cmp byte [0x140160f40], bl
je 0x14000675d
mov rdx, rbx
mov cl, dl
and cl, r15b
shl cl, 3
movabs rax, 0xb72357f7dd1fbb69
shr rax, cl
xor word [r9 + rdx*2], ax
inc rdx
cmp rdx, 0x14
jb 0x140006734
mov byte [0x140160f40], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
mov r8, r13
inc r8
cmp word [r9 + r8*2], bx
jne 0x14000676f
mov rdx, r9
lea rcx, [rbp - 0x80]
call fcn.14002a4e0
nop
mov dword [rbp + 0x20], 0xbff6a7ed
mov dword [rbp + 0x24], 0x45c597ee
mov dword [rbp + 0x28], 0x21a8cb2c
mov dword [rbp + 0x2c], 0x387d49
mov dword [rbp + 0x30], 0xbfcea7b5
mov dword [rbp + 0x34], 0x45d197cb
mov dword [rbp + 0x38], 0x21b9cb2a
mov dword [rbp + 0x3c], 0x1c7d4c
mov dword [rbp + 0x40], 0xbf99a7a5
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x140160ebc], eax
jle 0x140006835
lea rcx, [0x140160ebc]
call fcn.1400b77a0
cmp dword [0x140160ebc], r13d
jne 0x140006835
mov byte [0x1401604ae], 1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [0x140160488], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [0x140160498], xmm1
mov eax, dword [rbp + 0x40]
mov dword [0x1401604a8], eax
mov eax, 0x97bf
mov word [0x1401604ac], ax
lea rcx, [0x1400fedc4]
call fcn.1400b7e90
lea rcx, [0x140160ebc]
call fcn.1400b7740
lea r9, [0x140160488]
cmp byte [0x1401604ae], bl
je 0x140006870
mov rdx, rbx
mov cl, dl
and cl, r15b
shl cl, 3
movabs rax, 0x7d21cb4597bfa7d1
shr rax, cl
xor word [r9 + rdx*2], ax
inc rdx
cmp rdx, 0x13
jb 0x140006847
mov byte [0x1401604ae], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8, r13
inc r8
cmp word [r9 + r8*2], bx
jne 0x140006882
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.14002a4e0
nop
mov dword [rbp + 0x20], 0x3d76336a
mov dword [rbp + 0x24], 0x6f450d7e
mov dword [rbp + 0x28], 0xf3e5b12e
mov dword [rbp + 0x2c], 0x4201ac
mov dword [rbp + 0x30], 0x3d7a3371
mov dword [rbp + 0x34], 0x6f520d6d
mov dword [rbp + 0x38], 0xf3f4b13d
mov dword [rbp + 0x3c], 0x4e01b0
mov dword [rbp + 0x40], 0x3d77336f
mov dword [rbp + 0x44], 0x6f4b0d62
mov dword [rbp + 0x48], 0xf3e3b120
mov dword [rbp + 0x4c], 0x4001be
mov dword [rbp + 0x50], 0x3d6c3369
mov dword [rbp + 0x54], 0x6f480d75
mov dword [rbp + 0x58], 0xf3f5b12e
mov dword [rbp + 0x5c], 0x2b018f
mov dword [rbp + 0x60], 0x3d333341
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x1401605a4], eax
jle 0x14000698a
lea rcx, [0x1401605a4]
call fcn.1400b77a0
cmp dword [0x1401605a4], r13d
jne 0x14000698a
mov byte [0x140160574], 1
movaps xmm0, xmmword [rbp + 0x20]
movaps xmmword [0x140160530], xmm0
movaps xmm1, xmmword [rbp + 0x30]
movaps xmmword [0x140160540], xmm1
movaps xmm0, xmmword [rbp + 0x40]
movaps xmmword [0x140160550], xmm0
movaps xmm1, xmmword [rbp + 0x50]
movaps xmmword [0x140160560], xmm1
mov eax, dword [rbp + 0x60]
mov dword [0x140160570], eax
lea rcx, [0x1400fed8c]
call fcn.1400b7e90
lea rcx, [0x1401605a4]
call fcn.1400b7740
lea r9, [0x140160530]
cmp byte [0x140160574], bl
je 0x1400069c5
mov rdx, rbx
mov cl, dl
and cl, r15b
shl cl, 3
movabs rax, 0x1f3b16f0d3d333d
shr rax, cl
xor word [r9 + rdx*2], ax
inc rdx
cmp rdx, 0x22
jb 0x14000699c
mov byte [0x140160574], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8, r13
inc r8
cmp word [r9 + r8*2], bx
jne 0x1400069d7
mov rdx, r9
lea rcx, [rbp - 0x40]
call fcn.14002a4e0
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x80], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
lea rcx, [rsi + 8]
call fcn.140021cf8
nop
lea r9, [fcn.14000804c]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x60]
call fcn.1400b7b88
mov qword [rsi + 0x58], rbx
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140005c6c
nop
mov byte [rsi + 0x188], bl
lea rdi, [rsi + 0x190]
mov qword [rbp + 0x80], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov ecx, 0x48
call fcn.1400b7b4c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
mov dword [rbp + 0x20], 0xe55b19b9
mov dword [rbp + 0x24], 0xd988c9d4
mov dword [rbp + 0x28], 0xe93e0def
mov dword [rbp + 0x2c], 0xfebbda
mov dword [rbp + 0x30], 0xe52919a0
mov dword [rbp + 0x34], 0xd9f0c9a6
mov dword [rbp + 0x38], 0xe9200deb
mov dword [rbp + 0x3c], 0x8ebbdd
mov dword [rbp + 0x40], 0xe55f19bf
mov dword [rbp + 0x44], 0xd9f0c9c8
mov dword [rbp + 0x48], 0xe94e0dec
mov dword [rbp + 0x4c], 0x96bbac
mov dword [rbp + 0x50], 0xe52f19c9
mov dword [rbp + 0x54], 0xd9fac9d4
mov dword [rbp + 0x58], 0xe9380dea
mov dword [rbp + 0x5c], 0x8fbbdb
mov dword [rbp + 0x60], 0xe52b19be
mov dword [rbp + 0x64], 0xd98dc9a4
mov dword [rbp + 0x68], 0xe94b0d86
mov dword [rbp + 0x6c], 0xc9bb86
mov dword [rbp + 0x70], 0xe57819e0
mov dword [rbp + 0x74], 0xd9c9c991
mov edi, 4
mov eax, dword [rdi + r14]
cmp dword [0x1401605b8], eax
jle 0x140006b9d
lea rcx, [0x1401605b8]
call fcn.1400b77a0
cmp dword [0x1401605b8], r13d
jne 0x140006b9d
mov byte [0x140160d38], 1
movaps xmm0, xmmword [rbp + 0x20]
movaps xmmword [0x140160ce0], xmm0
movaps xmm1, xmmword [rbp + 0x30]
movaps xmmword [0x140160cf0], xmm1
movaps xmm0, xmmword [rbp + 0x40]
movaps xmmword [0x140160d00], xmm0
movaps xmm1, xmmword [rbp + 0x50]
movaps xmmword [0x140160d10], xmm1
movaps xmm0, xmmword [rbp + 0x60]
movaps xmmword [0x140160d20], xmm0
movsd xmm1, qword [rbp + 0x70]
movsd qword [0x140160d30], xmm1
lea rcx, [0x1400feb80]
call fcn.1400b7e90
lea rcx, [0x1401605b8]
call fcn.1400b7740
lea r8, [0x140160ce0]
cmp byte [0x140160d38], bl
je 0x140006bd8
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xbbe90dd9c9e5198d
shr rax, cl
xor word [r8 + rdx*2], ax
inc rdx
cmp rdx, 0x2c
jb 0x140006baf
mov byte [0x140160d38], bl
mov rcx, r8
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [rsi], eax
mov rcx, rsi
call fcn.140007978
mov dword [rbp + 0x80], 0x63097a58
mov eax, dword [rdi + r14]
cmp dword [0x140160be4], eax
jle 0x140006c41
lea rcx, [0x140160be4]
call fcn.1400b77a0
cmp dword [0x140160be4], r13d
jne 0x140006c41
mov byte [0x140160fdc], 1
mov eax, dword [rbp + 0x80]
mov dword [0x140160fd8], eax
lea rcx, [0x1400fed84]
call fcn.1400b7e90
lea rcx, [0x140160be4]
call fcn.1400b7740
lea rdi, [0x140160fd8]
cmp byte [0x140160fdc], bl
je 0x140006c7a
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xf553e56763671535
shr rax, cl
xor byte [rdx + rdi], al
inc rdx
cmp rdx, 4
jb 0x140006c53
mov byte [0x140160fdc], bl
lea rdx, [r15 + 0x40]
lea rcx, [0x1401580f0]
call fcn.140005910
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100
mov dword [rsp + 0x20], 0x6cf0000
mov r9, rdi
mov r8, rbx
mov rcx, r15
call fcn.140028920
mov ecx, setsockopt
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x2f]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl_CClipboardMonitor::constructor_void____ptr64::_2::_lambda_2___long_long___int64___struct_HWND______ptr64__unsigned_int__unsigned_long_long_unsigned___int64___long_long___int64___int____ptr64_.0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
lea rax, [rbp - 0x20]
mov qword [rbp + 0x18], rax
lea r8, [rbp - 0x20]
mov edx, 0x31d
mov rcx, r15
call fcn.140005e20
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140006d1a
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp - 0x20]
cmp rcx, rax
setne dl
call r8
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
nop
mov rax, rsi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400b7620
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret