Function at 0x14000633c
Capabilities:
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
mov r9b, byte [r8]
xor r15d, r15d
mov r12, r8
cmp r9b, r15b
mov rdi, rdx
mov r14, rcx
mov r13, rdx
je 0x140006b0b
mov ebp, 0x1000
cmp r9b, 0x7e
jne 0x140006ae7
mov cl, byte [r12 + 1]
mov dl, cl
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x140006396
add dl, 0x20
cmp dl, 0x6e
jne 0x1400063af
mov byte [rdi], 0xd
mov byte [rdi + 1], 0xa
add r12, 2
add rdi, 2
jmp 0x140006af2
mov dl, cl
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x1400063bb
add dl, 0x20
cmp dl, 0x78
jne 0x1400063fe
mov al, byte [r12 + 2]
xor edx, edx
lea rcx, [rsp + 0x9e8]
mov byte [rsp + 0x9e8], al
mov al, byte [r12 + 3]
lea r8d, [rdx + 0x10]
mov byte [rsp + 0x9e9], al
mov byte [rsp + 0x9ea], r15b
call sub.msvcrt.dll_strtoul
mov byte [rdi], al
add r12, 4
jmp 0x140006aee
mov dl, cl
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x14000640a
add dl, 0x20
cmp dl, 0x71
jne 0x14000641b
mov byte [rdi], 0x22
add r12, 2
jmp 0x140006aee
mov dl, cl
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x140006427
add dl, 0x20
cmp dl, 0x74
jne 0x140006431
mov byte [rdi], 9
jmp 0x140006412
cmp cl, 0x25
je 0x140006452
cmp cl, 0x24
je 0x140006452
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x140006445
add cl, 0x20
cmp cl, 0x7e
jne 0x140006ae7
mov byte [rdi], cl
jmp 0x140006412
lea rdx, [r12 + 2]
mov ebx, r15d
mov rsi, r15
mov al, byte [rdx]
jmp 0x14000646f
cmp al, cl
je 0x14000647b
add ebx, 1
add rsi, 1
mov al, byte [rdx + rsi]
cmp al, r15b
jne 0x140006461
or ebx, 0xffffffff
or rsi, 0xffffffffffffffff
lea eax, [rbx - 1]
cmp eax, 0x7d
ja 0x140006ae7
lea rcx, [rsp + 0x80]
movsxd r8, ebx
call sub.msvcrt.dll_memcpy
lea eax, [rbx + 3]
lea rdx, str.folder.
movsxd rcx, eax
mov r8d, 7
mov byte [rsp + rsi + 0x80], r15b
add r12, rcx
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x14000653f
lea rcx, [rsp + 0x3a1]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x3a0], r15b
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x3a0]
lea rdx, [rsp + 0x87]
mov rcx, r14
call fcn.1400075e4
cmp eax, r15d
je 0x140006af2
lea rcx, [rsp + 0x3a0]
call sub.msvcrt.dll_strlen
cmp eax, r15d
jle 0x140006af2
mov ecx, edi
sub ecx, r13d
lea ecx, [rcx + rax + 5]
cmp ecx, ebp
jae 0x140006af2
movsxd rbx, eax
lea rdx, [rsp + 0x3a0]
mov r8, rbx
jmp 0x140006a3c
lea rdx, str.loopcount
lea rcx, [rsp + 0x80]
mov r8d, 9
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x1400065d2
lea rcx, [rsp + 0x1a1]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x1a0], r15b
call sub.msvcrt.dll_memset
mov ecx, dword [r14 + 0x4011c]
lea rdx, [rsp + 0x1a0]
add ecx, 1
mov r8d, 0xa
call sub.msvcrt.dll__itoa
lea rcx, [rsp + 0x1a0]
call sub.msvcrt.dll_strlen
cmp eax, r15d
jle 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
movsxd rbx, eax
lea rdx, [rsp + 0x1a0]
mov r8, rbx
jmp 0x140006a3c
lea rdx, str.currdate.
lea rcx, [rsp + 0x80]
mov r8d, 8
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x140006677
mov ebx, 0xff
lea rcx, [rsp + 0x4b1]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x4b0], r15b
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x4b0]
lea r9, [rsp + 0x89]
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea rcx, [rsp + 0x4b0]
call sub.msvcrt.dll_strlen
cmp eax, r15d
jle 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
movsxd rbx, eax
lea rdx, [rsp + 0x4b0]
mov r8, rbx
jmp 0x140006a3c
lea rdx, str.currtime.
lea rcx, [rsp + 0x80]
mov r8d, 8
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x14000671c
mov ebx, 0xff
lea rcx, [rsp + 0x2a1]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x2a0], r15b
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x2a0]
lea r9, [rsp + 0x89]
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea rcx, [rsp + 0x2a0]
call sub.msvcrt.dll_strlen
cmp eax, r15d
jle 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
movsxd rbx, eax
lea rdx, [rsp + 0x2a0]
mov r8, rbx
jmp 0x140006a3c
lea rdx, str.sys.
lea rcx, [rsp + 0x80]
mov r8d, 4
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x14000679a
mov ebx, 0x80
lea rcx, [rsp + 0x111]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x110], r15b
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x84]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r15d
jbe 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
lea rdx, [rsp + 0x110]
jmp 0x140006a37
lea rdx, str.nir.
lea rcx, [rsp + 0x80]
mov r8d, 4
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x140006841
lea rcx, [rsp + 0x5b1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x5b0], r15b
call sub.msvcrt.dll_memset
lea rdx, str.exefile
lea rcx, [rsp + 0x84]
call sub.msvcrt.dll__strcmpi
cmp eax, r15d
jne 0x140006af2
lea rdx, [rsp + 0x5b0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x5b0]
call sub.msvcrt.dll_strlen
cmp eax, r15d
jbe 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
lea rdx, [rsp + 0x5b0]
jmp 0x140006a37
lea rdx, str.param.
lea rcx, [rsp + 0x80]
mov r8d, 6
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x1400069a6
lea rdx, [rsp + 0x86]
lea rcx, [r14 + 0x401a0]
call fcn.1400034f8
cmp eax, r15d
jl 0x14000689c
cmp eax, dword [r14 + 0x401f8]
jge 0x14000689c
movsxd rcx, eax
mov rax, qword [r14 + 0x401e0]
mov esi, dword [rax + rcx*4]
add rsi, qword [r14 + 0x401e8]
jmp 0x14000689f
mov rsi, r15
cmp rsi, r15
jne 0x140006a12
lea rax, [0x1400174d8]
lea rdx, [rsp + 0x86]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov eax, pe_nt_image_headers64
or r8d, 0xffffffff
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x40], 0x66
call fcn.140003590
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400012d8
cmp eax, r15d
je 0x140006983
mov rax, qword [rsp + 0x60]
lea rsi, [0x1400173e0]
lea rdx, [rsp + 0x86]
cmp rax, r15
lea rcx, [r14 + 0x401a0]
cmovne rsi, rax
or r8d, 0xffffffff
call fcn.14000342c
lea rcx, [r14 + 0x401d0]
or r8d, 0xffffffff
mov rdx, rsi
call fcn.14000342c
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp eax, r15d
jbe 0x140006983
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006983
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
mov ebx, eax
call sub.msvcrt.dll_memcpy
add rdi, rbx
lea rcx, [rsp + 0x60]
call fcn.140003568
lea rcx, [rsp + 0x48]
call fcn.140003568
lea rcx, [rsp + 0x30]
call fcn.14000112c
jmp 0x140006af2
lea rdx, str.fparam.
lea rcx, [rsp + 0x80]
mov r8d, 7
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x140006a4c
lea rcx, [rsp + 0x87]
call sub.msvcrt.dll_atoi
cmp eax, r15d
jle 0x140006af2
add eax, 0xffffffff
cmp eax, r15d
jl 0x140006a06
cmp eax, dword [r14 + 0x40198]
jge 0x140006a06
movsxd rcx, eax
mov rax, qword [r14 + 0x40180]
mov esi, dword [rax + rcx*4]
add rsi, qword [r14 + 0x40188]
jmp 0x140006a09
mov rsi, r15
cmp rsi, r15
je 0x140006af2
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp eax, r15d
jbe 0x140006af2
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, ebp
jae 0x140006af2
mov rdx, rsi
mov ebx, eax
mov r8d, eax
mov rcx, rdi
call sub.msvcrt.dll_memcpy
add rdi, rbx
jmp 0x140006af2
lea rdx, [0x140018170]
lea rcx, [rsp + 0x80]
mov r8d, 9
call sub.msvcrt.dll__strnicmp
cmp eax, r15d
jne 0x140006af2
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, r15d
je 0x140006af2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
cmp rax, r15
mov rsi, rax
je 0x140006adf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp rax, r15
mov rbp, rax
je 0x140006ada
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp eax, r15d
jbe 0x140006ad1
mov ecx, eax
sub ecx, r13d
lea ecx, [rcx + rdi + 5]
cmp ecx, 0x1000
jae 0x140006ad1
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
mov ebx, eax
call sub.msvcrt.dll_memcpy
add rdi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebp, 0x1000
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140006af2
mov byte [rdi], r9b
add r12, 1
add rdi, 1
mov eax, edi
sub eax, r13d
add eax, 0x14
cmp eax, ebp
jg 0x140006b0b
mov r9b, byte [r12]
cmp r9b, r15b
jne 0x14000637b
lea r11, [rsp + 0x9b0]
mov byte [rdi], r15b
mov rax, rdi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret