Function at 0x140161cac
Capabilities:
Resolve function by parsing pe exports
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rcx, qword [rsp + 0x108]
call fcn.14001f9dc
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0x20
jne 0x140161d57
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x1c], 0
je 0x140161d57
lea rcx, [0x14020dcd4]
call qword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140161d57
mov rcx, qword [rsp + 0x108]
call fcn.14016306c
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1401637f8
nop
lea rcx, [rsp + 0xa0]
call fcn.14016389c
test rax, rax
je 0x140161d4a
lea rcx, [rsp + 0xa0]
call fcn.14016389c
mov rdx, rax
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetClipboardData]
nop
lea rcx, [rsp + 0xa0]
call fcn.140163854
lea rax, [rsp + 0x68]
mov rdi, rax
mov rsi, qword [rsp + 0x20]
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x98], 0
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 8
je 0x140161de5
cmp dword [rsp + 0x40], 0x10
je 0x140161dbe
cmp dword [rsp + 0x40], 0x18
je 0x140161da1
jmp 0x140161dff
mov rax, qword [rsp + 0x20]
imul eax, dword [rax], 3
and eax, 3
mov ecx, 4
sub ecx, eax
mov eax, ecx
and eax, 3
mov dword [rsp + 0x34], eax
jmp 0x140161dff
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
shl eax, 1
and eax, 3
mov ecx, 4
sub ecx, eax
mov eax, ecx
and eax, 3
xor edx, edx
mov ecx, 2
div ecx
mov dword [rsp + 0x34], eax
jmp 0x140161dff
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
and eax, 3
mov ecx, 4
sub ecx, eax
mov eax, ecx
and eax, 3
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x74]
imul ecx, dword [rsp + 0x6c]
mov ecx, ecx
lea rax, [rcx + rax*4 + 0x7c]
mov rdx, rax
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1401637f8
nop
lea rcx, [rsp + 0x58]
call fcn.14016389c
test rax, rax
jne 0x140161e6a
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x58]
call fcn.140163854
mov al, byte [rsp + 0x30]
jmp 0x14016225b
mov dword [rsp + 0x78], 0xff0000
mov dword [rsp + 0x7c], 0xff00
mov dword [rsp + 0x80], 0xff
mov dword [rsp + 0x84], 0xff000000
mov dword [rsp + 0x88], shutdown
mov dword [rsp + 0x8c], 8
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x94], 0x18
lea rcx, [rsp + 0x58]
call fcn.14016389c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov dword [rax], 0x7c
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x68]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x6c]
mov dword [rax + 8], ecx
mov eax, 1
mov rcx, qword [rsp + 0x28]
mov word [rcx + 0xc], ax
mov rax, qword [rsp + 0x28]
movzx ecx, word [rsp + 0x70]
mov word [rax + 0xe], cx
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x74]
imul ecx, dword [rax + 4]
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x7c]
mov dword [rax + 0x2c], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x80]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x84]
mov dword [rax + 0x34], ecx
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x38], 0x57696e20
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x6c], 2
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 8]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0x20
je 0x140161fae
jmp 0x1401621d4
mov rcx, qword [rsp + 0x108]
call fcn.140020088
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x6c]
dec ecx
imul ecx, dword [rsp + 0x74]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
dec eax
mov dword [rsp + 0x44], eax
jmp 0x140162007
mov eax, dword [rsp + 0x44]
dec eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x1401621d2
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x48], 0
jmp 0x14016206e
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xa8]
add rax, 4
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xb0]
add rax, 4
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
cmp dword [rsp + 0x48], eax
jae 0x140162195
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x10]
mov ecx, dword [rsp + 0x38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x20]
shr eax, cl
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov ecx, dword [rsp + 0x38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x24]
shr eax, cl
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
mov ecx, dword [rsp + 0x38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x28]
shr eax, cl
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov ecx, dword [rsp + 0x38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x2c]
shr eax, cl
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x4c]
imul eax, dword [rsp + 0x3c]
cdq
mov ecx, 0xff
idiv ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x50]
imul eax, dword [rsp + 0x3c]
cdq
mov ecx, 0xff
idiv ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
imul eax, dword [rsp + 0x3c]
cdq
mov ecx, 0xff
idiv ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x88]
mov cl, al
mov eax, dword [rsp + 0x4c]
shl eax, cl
mov ecx, dword [rsp + 0x8c]
mov edx, dword [rsp + 0x50]
shl edx, cl
mov ecx, edx
or eax, ecx
mov ecx, dword [rsp + 0x90]
mov edx, dword [rsp + 0x54]
shl edx, cl
mov ecx, edx
or eax, ecx
mov ecx, dword [rsp + 0x94]
mov edx, dword [rsp + 0x3c]
shl edx, cl
mov ecx, edx
or eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
jmp 0x14016203c
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0xb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x74]
mov rcx, qword [rsp + 0xc0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0], rax
jmp 0x140161ffd
jmp 0x14016221d
call fcn.140142150
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
je 0x140162208
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov ecx, 1
call qword [rsp + 0xd0]
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x58]
call fcn.140163854
mov al, byte [rsp + 0x31]
jmp 0x14016225b
lea rcx, [rsp + 0x58]
call fcn.14016389c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, [rsp + 0x58]
call fcn.14016389c
mov rdx, rax
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_SetClipboardData]
mov byte [rsp + 0x32], 1
lea rcx, [rsp + 0x58]
call fcn.140163854
mov al, byte [rsp + 0x32]
add rsp, 0xe8
pop rdi
pop rsi
ret