Function at 0x1400069ec
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Monitor clipboard content

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400991b0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rcx], ebx
mov dword [rbp - 0x20], 0x477a2d35
mov dword [rbp - 0x1c], 0x9ff0b322
mov dword [rbp - 0x18], 0xe32041f7
mov dword [rbp - 0x14], 0x653797
mov dword [rbp - 0x10], 0x474e2d60
mov dword [rbp - 0xc], 0x9ff6b32f
mov dword [rbp - 8], 0xe32841fb
mov dword [rbp - 4], 0x713797
mov dword [rbp], 0x475f2d66
mov dword [rbp + 4], 0x9fd2b32a
mov dword [rbp + 8], 0xe37f41eb
mov edi, 0x37e3
mov r15d, 4
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov eax, dword [r15 + r14]
cmp dword [0x14009e954], eax
jle 0x140006b05
lea rcx, [0x14009e954]
call fcn.14004b21c
cmp dword [0x14009e954], 0xffffffff
jne 0x140006b05
mov byte [0x14009ef5e], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009ef30], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009ef40], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x14009ef50], xmm0
mov eax, dword [rbp + 8]
mov dword [0x14009ef58], eax
mov word [0x14009ef5c], di
lea rcx, [0x14006d044]
call fcn.14004b990
lea rcx, [0x14009e954]
call fcn.14004b1bc
lea rdx, [0x14009ef30]
mov dil, 7
cmp byte [0x14009ef5e], bl
je 0x140006b44
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x37e3419fb3472d09
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x17
jb 0x140006b1a
mov byte [0x14009ef5e], bl
movdqa xmm0, xmmword [0x140086d90]
movdqa xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
lea rcx, [rsp + 0x60]
call fcn.1400183ec
nop
mov dword [rbp - 0x20], 0x1fe9bb55
mov dword [rbp - 0x1c], 0xf785dd4b
mov dword [rbp - 0x18], 0x233e57a5
mov dword [rbp - 0x14], 0xdfb740
mov dword [rbp - 0x10], 0x1fdfbb2c
mov dword [rbp - 0xc], 0xf7a9dd76
mov dword [rbp - 8], 0x233857b1
mov dword [rbp - 4], 0xdab751
mov dword [rbp], 0x1fcfbb08
mov dword [rbp + 4], 0xf7dddd21
mov eax, dword [r15 + r14]
cmp dword [0x14009f204], eax
jle 0x140006c0b
lea rcx, [0x14009f204]
call fcn.14004b21c
cmp dword [0x14009f204], 0xffffffff
jne 0x140006c0b
mov byte [0x14009eb28], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009eb00], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009eb10], xmm1
movsd xmm0, qword [rbp]
movsd qword [0x14009eb20], xmm0
lea rcx, [0x14006d024]
call fcn.14004b990
lea rcx, [0x14009f204]
call fcn.14004b1bc
lea rdx, [0x14009eb00]
cmp byte [0x14009eb28], bl
je 0x140006c47
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0xb72357f7dd1fbb69
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x14
jb 0x140006c1d
mov byte [0x14009eb28], bl
movdqa xmm0, xmmword [0x140086d90]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], bx
lea rcx, [rbp - 0x80]
call fcn.1400183ec
nop
mov dword [rbp - 0x20], 0xbff6a7ed
mov dword [rbp - 0x1c], 0x45c597ee
mov dword [rbp - 0x18], 0x21a8cb2c
mov dword [rbp - 0x14], 0x387d49
mov dword [rbp - 0x10], 0xbfcea7b5
mov dword [rbp - 0xc], 0x45d197cb
mov dword [rbp - 8], 0x21b9cb2a
mov dword [rbp - 4], 0x1c7d4c
mov dword [rbp], 0xbf99a7a5
mov eax, dword [r15 + r14]
cmp dword [0x14009f134], eax
jle 0x140006d0c
lea rcx, [0x14009f134]
call fcn.14004b21c
cmp dword [0x14009f134], 0xffffffff
jne 0x140006d0c
mov byte [0x14009e83e], 1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [0x14009e818], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x14009e828], xmm1
mov eax, dword [rbp]
mov dword [0x14009e838], eax
mov eax, 0x97bf
mov word [0x14009e83c], ax
lea rcx, [0x14006d004]
call fcn.14004b990
lea rcx, [0x14009f134]
call fcn.14004b1bc
lea rdx, [0x14009e818]
cmp byte [0x14009e83e], bl
je 0x140006d48
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x7d21cb4597bfa7d1
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x13
jb 0x140006d1e
mov byte [0x14009e83e], bl
movdqa xmm0, xmmword [0x140086d90]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], bx
lea rcx, [rbp - 0x60]
call fcn.1400183ec
nop
mov dword [rbp - 0x20], 0x3d76336a
mov dword [rbp - 0x1c], 0x6f450d7e
mov dword [rbp - 0x18], 0xf3e5b12e
mov dword [rbp - 0x14], 0x4201ac
mov dword [rbp - 0x10], 0x3d7a3371
mov dword [rbp - 0xc], 0x6f520d6d
mov dword [rbp - 8], 0xf3f4b13d
mov dword [rbp - 4], 0x4e01b0
mov dword [rbp], 0x3d77336f
mov dword [rbp + 4], 0x6f4b0d62
mov dword [rbp + 8], 0xf3e3b120
mov dword [rbp + 0xc], 0x4001be
mov dword [rbp + 0x10], 0x3d6c3369
mov dword [rbp + 0x14], 0x6f480d75
mov dword [rbp + 0x18], 0xf3f5b12e
mov dword [rbp + 0x1c], 0x2b018f
mov dword [rbp + 0x20], 0x3d333341
lea rdx, [0x14009ea30]
mov eax, dword [r15 + r14]
cmp dword [0x14009ee74], eax
jle 0x140006e3e
lea rcx, [0x14009ee74]
call fcn.14004b21c
cmp dword [0x14009ee74], 0xffffffff
jne 0x140006e37
mov byte [0x14009ea74], 1
mov r8d, 0x44
lea rdx, [rbp - 0x20]
lea rcx, [0x14009ea30]
call fcn.14004cf20
lea rcx, [0x14006cfe4]
call fcn.14004b990
lea rcx, [0x14009ee74]
call fcn.14004b1bc
lea rdx, [0x14009ea30]
cmp byte [0x14009ea74], bl
je 0x140006e73
mov r8, rbx
mov cl, r8b
and cl, dil
shl cl, 3
movabs rax, 0x1f3b16f0d3d333d
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0x22
jb 0x140006e49
mov byte [0x14009ea74], bl
movdqa xmm0, xmmword [0x140086d90]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
lea rcx, [rbp - 0x40]
call fcn.1400183ec
nop
lea rcx, [rsi + 8]
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x60]
call fcn.14001cfe8
nop
lea r9, [0x140008434]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x60]
call fcn.14004b624
mov qword [rsi + 0x58], rbx
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140006188
nop
mov byte [rsi + 0x188], bl
lea rdi, [rsi + 0x190]
mov qword [rbp + 0x40], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
call fcn.14001a760
mov qword [rdi], rax
mov dword [rbp - 0x20], 0xe55b19b9
mov dword [rbp - 0x1c], 0xd988c9d4
mov dword [rbp - 0x18], 0xe93e0def
mov dword [rbp - 0x14], 0xfebbda
mov dword [rbp - 0x10], 0xe52919a0
mov dword [rbp - 0xc], 0xd9f0c9a6
mov dword [rbp - 8], 0xe9200deb
mov dword [rbp - 4], 0x8ebbdd
mov dword [rbp], 0xe55f19bf
mov dword [rbp + 4], 0xd9f0c9c8
mov dword [rbp + 8], 0xe94e0dec
mov dword [rbp + 0xc], 0x96bbac
mov dword [rbp + 0x10], 0xe52f19c9
mov dword [rbp + 0x14], 0xd9fac9d4
mov dword [rbp + 0x18], 0xe9380dea
mov dword [rbp + 0x1c], 0x8fbbdb
mov dword [rbp + 0x20], 0xe52b19be
mov dword [rbp + 0x24], 0xd98dc9a4
mov dword [rbp + 0x28], 0xe94b0d86
mov dword [rbp + 0x2c], 0xc9bb86
mov dword [rbp + 0x30], 0xe57819e0
mov dword [rbp + 0x34], 0xd9c9c991
lea rdi, [0x14009ecc0]
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x14009ee48], eax
jle 0x140006fef
lea rcx, [0x14009ee48]
call fcn.14004b21c
cmp dword [0x14009ee48], 0xffffffff
jne 0x140006fef
mov byte [0x14009ed18], 1
mov r8d, 0x58
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14004cf20
lea rcx, [0x14006ce5c]
call fcn.14004b990
lea rcx, [0x14009ee48]
call fcn.14004b1bc
cmp byte [0x14009ed18], bl
je 0x140007022
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xbbe90dd9c9e5198d
shr rax, cl
xor word [rdi + rdx*2], ax
inc rdx
cmp rdx, 0x2c
jb 0x140006ffa
mov byte [0x14009ed18], bl
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [rsi], eax
mov rcx, rsi
call fcn.140007da0
mov dword [rbp + 0x40], 0x63097a58
mov eax, 4
mov eax, dword [rax + r14]
cmp dword [0x14009eaa8], eax
jle 0x14000708a
lea rcx, [0x14009eaa8]
call fcn.14004b21c
cmp dword [0x14009eaa8], 0xffffffff
jne 0x14000708a
mov byte [0x14009eee8], 1
mov eax, dword [rbp + 0x40]
mov dword [0x14009eee4], eax
lea rcx, [0x14006cfdc]
call fcn.14004b990
lea rcx, [0x14009eaa8]
call fcn.14004b1bc
lea rdi, [0x14009eee4]
cmp byte [0x14009eee8], bl
je 0x1400070c3
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xf553e56763671535
shr rax, cl
xor byte [rdx + rdi], al
inc rdx
cmp rdx, 4
jb 0x14000709c
mov byte [0x14009eee8], bl
lea rdx, [r15 + 0x40]
lea rcx, [0x140099b70]
call fcn.140005cd8
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100
mov dword [rsp + 0x20], 0x6cf0000
mov r9, rdi
mov r8, rbx
mov rcx, r15
call fcn.14001b9fc
mov ecx, 0x11
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x2f]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_62f4e708318f69aa0ddad9efb82c751d___long_long___int64___struct_HWND______ptr64__unsigned_int__unsigned_long_long_unsigned___int64___long_long___int64___int____ptr64_.0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
lea rax, [rbp - 0x20]
mov qword [rbp + 0x18], rax
lea r8, [rbp - 0x20]
mov edx, 0x31d
mov rcx, r15
call fcn.140006330
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140007164
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp - 0x20]
cmp rcx, rax
setne dl
call r8
nop
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
nop
mov rax, rsi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14004b000
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret