Function at 0x1400069dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Monitor clipboard content

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400971b0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rcx], ebx
mov dword [rbp - 0x20], 0x477a2d35
mov dword [rbp - 0x1c], 0x9ff0b322
mov dword [rbp - 0x18], 0xe32041f7
mov dword [rbp - 0x14], 0x653797
mov dword [rbp - 0x10], 0x474e2d60
mov dword [rbp - 0xc], 0x9ff6b32f
mov dword [rbp - 8], 0xe32841fb
mov dword [rbp - 4], 0x713797
mov dword [rbp], 0x475f2d66
mov dword [rbp + 4], 0x9fd2b32a
mov dword [rbp + 8], 0xe37f41eb
mov edi, 0x37e3
mov r15d, 4
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov eax, dword [r15 + r14]
cmp dword [0x14009c950], eax
jle 0x140006af5
lea rcx, [0x14009c950]
call fcn.14004a96c
cmp dword [0x14009c950], 0xffffffff
jne 0x140006af5
mov byte [0x14009cf96], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009cf68], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009cf78], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x14009cf88], xmm0
mov eax, dword [rbp + 8]
mov dword [0x14009cf90], eax
mov word [0x14009cf94], di
lea rcx, [0x14006c714]
call fcn.14004b0e0
lea rcx, [0x14009c950]
call fcn.14004a90c
lea rdx, [0x14009cf68]
mov dil, 7
cmp byte [0x14009cf96], bl
je 0x140006b34
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x37e3419fb3472d09
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x17
jb 0x140006b0a
mov byte [0x14009cf96], bl
movdqa xmm0, xmmword [0x140085ca0]
movdqa xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
lea rcx, [rsp + 0x60]
call fcn.140017c18
nop
mov dword [rbp - 0x20], 0x1fe9bb55
mov dword [rbp - 0x1c], 0xf785dd4b
mov dword [rbp - 0x18], 0x233e57a5
mov dword [rbp - 0x14], 0xdfb740
mov dword [rbp - 0x10], 0x1fdfbb2c
mov dword [rbp - 0xc], 0xf7a9dd76
mov dword [rbp - 8], 0x233857b1
mov dword [rbp - 4], 0xdab751
mov dword [rbp], 0x1fcfbb08
mov dword [rbp + 4], 0xf7dddd21
mov eax, dword [r15 + r14]
cmp dword [0x14009d220], eax
jle 0x140006bfb
lea rcx, [0x14009d220]
call fcn.14004a96c
cmp dword [0x14009d220], 0xffffffff
jne 0x140006bfb
mov byte [0x14009cb30], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009cb08], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009cb18], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x14009cb28], xmm0
lea rcx, [0x14006c6f4]
call fcn.14004b0e0
lea rcx, [0x14009d220]
call fcn.14004a90c
lea rdx, [0x14009cb08]
cmp byte [0x14009cb30], bl
je 0x140006c37
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0xb72357f7dd1fbb69
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x14
jb 0x140006c0d
mov byte [0x14009cb30], bl
movdqa xmm0, xmmword [0x140085ca0]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], bx
lea rcx, [rbp - 0x80]
call fcn.140017c18
nop
mov dword [rbp - 0x20], 0xbff6a7ed
mov dword [rbp - 0x1c], 0x45c597ee
mov dword [rbp - 0x18], 0x21a8cb2c
mov dword [rbp - 0x14], 0x387d49
mov dword [rbp - 0x10], 0xbfcea7b5
mov dword [rbp - 0xc], 0x45d197cb
mov dword [rbp - 8], 0x21b9cb2a
mov dword [rbp - 4], 0x1c7d4c
mov dword [rbp], 0xbf99a7a5
mov eax, dword [r15 + r14]
cmp dword [0x14009d158], eax
jle 0x140006cfc
lea rcx, [0x14009d158]
call fcn.14004a96c
cmp dword [0x14009d158], 0xffffffff
jne 0x140006cfc
mov byte [0x14009c83e], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009c818], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009c828], xmm1
mov eax, dword [rbp]
mov dword [0x14009c838], eax
mov eax, 0x97bf
mov word [0x14009c83c], ax
lea rcx, [0x14006c6d4]
call fcn.14004b0e0
lea rcx, [0x14009d158]
call fcn.14004a90c
lea rdx, [0x14009c818]
cmp byte [0x14009c83e], bl
je 0x140006d38
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x7d21cb4597bfa7d1
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x13
jb 0x140006d0e
mov byte [0x14009c83e], bl
movdqa xmm0, xmmword [0x140085ca0]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], bx
lea rcx, [rbp - 0x60]
call fcn.140017c18
nop
mov dword [rbp - 0x20], 0x3d76336a
mov dword [rbp - 0x1c], 0x6f450d7e
mov dword [rbp - 0x18], 0xf3e5b12e
mov dword [rbp - 0x14], 0x4201ac
mov dword [rbp - 0x10], 0x3d7a3371
mov dword [rbp - 0xc], 0x6f520d6d
mov dword [rbp - 8], 0xf3f4b13d
mov dword [rbp - 4], 0x4e01b0
mov dword [rbp], 0x3d77336f
mov dword [rbp + 4], 0x6f4b0d62
mov dword [rbp + 8], 0xf3e3b120
mov dword [rbp + 0xc], 0x4001be
mov dword [rbp + 0x10], 0x3d6c3369
mov dword [rbp + 0x14], 0x6f480d75
mov dword [rbp + 0x18], 0xf3f5b12e
mov dword [rbp + 0x1c], 0x2b018f
mov dword [rbp + 0x20], 0x3d333341
lea rdx, [0x14009ca10]
mov eax, dword [r15 + r14]
cmp dword [0x14009ce84], eax
jle 0x140006e2e
lea rcx, [0x14009ce84]
call fcn.14004a96c
cmp dword [0x14009ce84], 0xffffffff
jne 0x140006e27
mov byte [0x14009ca54], 1
mov r8d, 0x44
lea rdx, [rbp - 0x20]
lea rcx, [0x14009ca10]
call fcn.14004c670
lea rcx, [0x14006c6b4]
call fcn.14004b0e0
lea rcx, [0x14009ce84]
call fcn.14004a90c
lea rdx, [0x14009ca10]
cmp byte [0x14009ca54], bl
je 0x140006e63
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x1f3b16f0d3d333d
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x22
jb 0x140006e39
mov byte [0x14009ca54], bl
movdqa xmm0, xmmword [0x140085ca0]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
lea rcx, [rbp - 0x40]
call fcn.140017c18
nop
lea rcx, [rsi + 8]
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x60]
call fcn.14001c740
nop
lea r9, [0x140008424]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x60]
call fcn.14004ad74
mov qword [rsi + 0x58], rbx
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140006178
nop
mov byte [rsi + 0x188], bl
lea rdi, [rsi + 0x190]
mov qword [rbp + 0x40], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
call fcn.140019f8c
mov qword [rdi], rax
mov dword [rbp - 0x20], 0xe55b19b9
mov dword [rbp - 0x1c], 0xd988c9d4
mov dword [rbp - 0x18], 0xe93e0def
mov dword [rbp - 0x14], 0xfebbda
mov dword [rbp - 0x10], 0xe52919a0
mov dword [rbp - 0xc], 0xd9f0c9a6
mov dword [rbp - 8], 0xe9200deb
mov dword [rbp - 4], 0x8ebbdd
mov dword [rbp], 0xe55f19bf
mov dword [rbp + 4], 0xd9f0c9c8
mov dword [rbp + 8], 0xe94e0dec
mov dword [rbp + 0xc], 0x96bbac
mov dword [rbp + 0x10], 0xe52f19c9
mov dword [rbp + 0x14], 0xd9fac9d4
mov dword [rbp + 0x18], 0xe9380dea
mov dword [rbp + 0x1c], 0x8fbbdb
mov dword [rbp + 0x20], 0xe52b19be
mov dword [rbp + 0x24], 0xd98dc9a4
mov dword [rbp + 0x28], 0xe94b0d86
mov dword [rbp + 0x2c], 0xc9bb86
mov dword [rbp + 0x30], 0xe57819e0
mov dword [rbp + 0x34], 0xd9c9c991
lea rdi, [0x14009ccd0]
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x14009ce58], eax
jle 0x140006fdf
lea rcx, [0x14009ce58]
call fcn.14004a96c
cmp dword [0x14009ce58], 0xffffffff
jne 0x140006fdf
mov byte [0x14009cd28], 1
mov r8d, 0x58
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14004c670
lea rcx, [0x14006c52c]
call fcn.14004b0e0
lea rcx, [0x14009ce58]
call fcn.14004a90c
cmp byte [0x14009cd28], bl
je 0x140007012
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xbbe90dd9c9e5198d
shr rax, cl
xor word [rdi + rdx*2], ax
inc rdx
cmp rdx, 0x2c
jb 0x140006fea
mov byte [0x14009cd28], bl
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [rsi], eax
mov rcx, rsi
call fcn.140007d90
mov dword [rbp + 0x40], 0x63097a58
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x14009ca90], eax
jle 0x14000707a
lea rcx, [0x14009ca90]
call fcn.14004a96c
cmp dword [0x14009ca90], 0xffffffff
jne 0x14000707a
mov byte [0x14009cf20], 1
mov eax, dword [rbp + 0x40]
mov dword [0x14009cf1c], eax
lea rcx, [0x14006c6ac]
call fcn.14004b0e0
lea rcx, [0x14009ca90]
call fcn.14004a90c
lea rdi, [0x14009cf1c]
cmp byte [0x14009cf20], bl
je 0x1400070b3
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xf553e56763671535
shr rax, cl
xor byte [rdx + rdi], al
inc rdx
cmp rdx, 4
jb 0x14000708c
mov byte [0x14009cf20], bl
lea rdx, [r15 + 0x40]
lea rcx, [0x140097b70]
call fcn.140005cc8
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100
mov dword [rsp + 0x20], 0x6cf0000
mov r9, rdi
mov r8, rbx
mov rcx, r15
call fcn.14001b228
mov ecx, 0x11
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x2f]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_62f4e708318f69aa0ddad9efb82c751d___long_long___int64___struct_HWND______ptr64__unsigned_int__unsigned_long_long_unsigned___int64___long_long___int64___int____ptr64_.0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
lea rax, [rbp - 0x20]
mov qword [rbp + 0x18], rax
lea r8, [rbp - 0x20]
mov edx, 0x31d
mov rcx, r15
call fcn.140006320
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140007154
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp - 0x20]
cmp rcx, rax
setne dl
call r8
nop
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
nop
mov rax, rsi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14004a750
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret