Function at 0x18004316c
Capabilities:
Delete file
Read clipboard data

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x320
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor edi, edi
mov word [rsp + 0x100], di
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x226]
call fcn.180059f80
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.180002698
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str..jpg
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea esi, [rdi + 2]
mov ecx, esi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
cmp rax, rdi
jne 0x18004321b
mov ecx, esi
call fcn.180042bac
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
cmp rax, rdi
je 0x1800434b0
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0xf
mov ecx, esi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rdx, rax
mov rcx, rbx
call fcn.18000e750
mov rbx, rax
cmp rax, rdi
je 0x180043269
lea r8d, [rsi + 0x23]
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.18000e878
mov r11, qword [rbx]
lea edx, [rsi - 0xe]
mov rcx, rbx
call qword [r11]
lea rcx, [rsp + 0x100]
call fcn.180001f74
cmp rax, 0x400
ja 0x180043291
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1800434b0
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.1800167d4
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rdi
mov word [rsp + 0x80], di
lea rcx, [0x180079f80]
call fcn.180058e14
mov r8, rax
lea rdx, [0x180079f80]
lea rcx, [rsp + 0x78]
call fcn.1800076b4
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x28]
call fcn.18000e9a0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180016998
mov rbx, rax
lea rdx, str.cl_type
lea rcx, [rsp + 0xa0]
call fcn.180017f04
mov rcx, rax
mov rdx, rbx
call fcn.180016c24
nop
cmp qword [rsp + 0x48], 0x10
jb 0x18004333a
mov rcx, qword [rsp + 0x30]
call fcn.1800018ec
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], dil
cmp qword [rsp + 0x98], 8
jb 0x180043361
mov rcx, qword [rsp + 0x80]
call fcn.1800018ec
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, str.__image__
lea rcx, [rsp + 0x50]
call fcn.1800168f0
mov rbx, rax
lea rdx, str.cl_content
lea rcx, [rsp + 0xa0]
call fcn.180017f04
mov rcx, rax
mov rdx, rbx
call fcn.180016c24
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov byte [rsp + 0xd8], dil
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x28]
call fcn.180042fbc
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180016998
mov rbx, rax
lea rdx, str.cl_procname
lea rcx, [rsp + 0xa0]
call fcn.180017f04
mov rcx, rax
mov rdx, rbx
call fcn.180016c24
nop
cmp qword [rsp + 0x48], 0x10
jb 0x180043415
mov rcx, qword [rsp + 0x30]
call fcn.1800018ec
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.180016998
mov rbx, rax
lea rdx, str.cl_hash4k
lea rcx, [rsp + 0xa0]
call fcn.180017f04
mov rcx, rax
mov rdx, rbx
call fcn.180016c24
xor r9d, r9d
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xa0]
lea rcx, str.t_clipboard_log
call fcn.180026788
nop
cmp qword [rsp + 0xf0], 0x10
jb 0x18004348b
mov rcx, qword [rsp + 0xd8]
call fcn.1800018ec
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov byte [rsp + 0xd8], dil
lea rcx, [rsp + 0xa0]
call fcn.180016b8c
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret