Function at 0x1400011c0
Capabilities:
Create process on windows
Execute command
Open clipboard
Terminate process
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor ebx, ebx
lea rdx, [0x14000448c]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rbx
mov edi, 0xf
mov qword [rbp - 0x31], rdi
mov byte [rbp - 0x49], bl
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], rdi
mov byte [rbp - 0x29], bl
lea rdx, [0x140004490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c10
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x49]
mov rcx, rbx
call fcn.1400022b0
lea rdx, [0x1400044c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c10
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.1400022b0
mov r13, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp - 0x39]
sub rax, rdx
cmp rax, 0x27
jb 0x140001b1b
lea r15, [rbp - 0x49]
mov r12, qword [rbp - 0x49]
cmp qword [rbp - 0x31], rdi
cmova r15, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x69], xmm1
lea r14, [rdx + 0x27]
mov ebx, edi
lea rsi, [rbp - 0x79]
movabs rax, 0x8000000000000000
lea r8d, [rdi + 7]
cmp r14, rbx
jbe 0x140001393
mov rbx, r14
or rbx, rdi
cmp rbx, rcx
jbe 0x140001357
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140002640
test rax, rax
je 0x14000156c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rbp - 0x39]
jmp 0x14000138f
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000137a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b0f
jmp 0x140001334
test rcx, rcx
je 0x14000138d
call fcn.140002640
mov rsi, rax
mov rdx, qword [rbp - 0x39]
jmp 0x14000138f
xor esi, esi
mov qword [rbp - 0x79], rsi
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], rbx
movups xmm0, xmmword [0x1400044f0]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x140004500]
movups xmmword [rsi + 0x10], xmm1
mov eax, dword [0x140004510]
mov dword [rsi + 0x20], eax
movzx eax, word [0x140004514]
mov word [rsi + 0x24], ax
movzx eax, byte [0x140004516]
mov byte [rsi + 0x26], al
lea rcx, [rsi + 0x27]
mov r8, rdx
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov r8d, 7
lea rdx, str._nTime:
lea rcx, [rbp - 0x79]
call fcn.140001b90
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov byte [rax], bl
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8, qword [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.140001b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov byte [rax], bl
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, r13
call fcn.140002450
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400014d8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000267c
movdqa xmm0, xmmword [0x140004570]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140001529
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001524
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000267c
movdqa xmm0, xmmword [0x140004570]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x140001578
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001573
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000267c
lea rdx, str._n1___Start_n2___Exit
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c10
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rbp - 0x59], 1
jne 0x140001b00
lea rcx, [0x14000452c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp - 0x51], rax
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp - 0x19]
sub rax, r13
cmp rax, 7
jb 0x140001b09
lea r14, [rbp - 0x29]
mov r15, qword [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova r14, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r13 + 7]
lea rbx, [rsp + 0x30]
cmp rsi, 0xf
jbe 0x140001698
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001659
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002640
test rax, rax
je 0x140001737
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001693
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001682
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b15
jmp 0x14000163a
test rcx, rcx
je 0x140001691
call fcn.140002640
mov rbx, rax
jmp 0x140001693
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rax, qword [0x140004530]
mov dword [rbx], eax
movzx eax, word [0x140004534]
mov word [rbx + 4], ax
movzx eax, byte [0x140004536]
mov byte [rbx + 6], al
lea rcx, [rbx + 7]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x51]
call fcn.140002450
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001743
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000173e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000173e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000267c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp - 0x51], rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp - 9]
lea r8, str._H:_M:_S
mov edx, 9
lea rcx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x1f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140001796
lea rdx, [rbp + 0x1f]
lea rcx, [rsp + 0x30]
call fcn.140001e20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rbx
mov r8d, 5
cmp qword [rsp + 0x40], r8
cmovb r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
lea rcx, [rbp - 0x79]
call fcn.140001e20
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, r15
lea rcx, [rbp - 0x79]
mov rsi, qword [rbp - 0x61]
cmp rsi, 0xf
seta r14b
mov rbx, qword [rbp - 0x79]
cmova rcx, rbx
mov r8, qword [rbp - 0x69]
cmp r8, r13
jne 0x140001824
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001824
mov dil, 1
jmp 0x140001827
xor dil, dil
test r14b, r14b
je 0x14000185a
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001851
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018a8
mov rcx, rbx
call fcn.14000267c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001893
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000188e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018af
call fcn.14000267c
test dil, dil
jne 0x1400018b6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001743
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140004538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c10
lea rdx, [0x140001de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001910
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdi, qword [rbp - 0x39]
lea rdx, [rdi + 1]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x140001a46
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rbp - 0x31]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.steam:__run_252490
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x493e0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x70
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x70
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x56
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x56
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x70
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x70
call qword [sym.imp.USER32.dll_keybd_event]
nop
mov rax, qword [rbp - 0x11]
cmp rax, 0xf
jbe 0x140001a96
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001a8d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rbp - 0x49]
mov rsi, qword [rbp - 0x31]
cmp rsi, 0xf
cmova rdx, r12
lea r8, [rdi + 1]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140001914
mov rcx, r15
call fcn.14000267c
nop
cmp rsi, 0xf
jbe 0x140001ad1
lea rdx, [rsi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001ac9
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ac9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14000267c
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140002620
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400011a0
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.1400011a0
int3