Function at 0x1800039b0
Capabilities:
Open clipboard
Write clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov rdi, rcx
cmp dword [rcx + 0x1248], 2
jne 0x180003a15
movsxd rsi, dword [rcx + 0x123c]
lea rdx, [0x180007b18]
mov r14, qword [rcx + 0x1240]
add rcx, 0x1138
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x180003a15
mov r8, rsi
lea edx, [rbp + 1]
mov r9, rax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rbx, [rdi + 0x12c]
lea rsi, [0x180000000]
cmp byte [rbx], bpl
jne case.default.0x180003a3e
mov eax, dword [rdi + 0x1c]
dec eax
cmp eax, 8
ja case.default.0x180003a3e
cdqe
mov ecx, dword [rsi + rax*4 + 0x3e7c]
add rcx, rsi
jmp rcx
lea rdx, str.loader.bin
jmp 0x180003a8f
lea rdx, str.loader.b64
jmp 0x180003a8f
lea rdx, str.loader.rb
jmp 0x180003a8f
lea rdx, str.loader.c
jmp 0x180003a8f
lea rdx, str.loader.py
jmp 0x180003a8f
lea rdx, str.loader.ps1
jmp 0x180003a8f
lea rdx, str.loader.cs
jmp 0x180003a8f
lea rdx, str.loader.hex
jmp 0x180003a8f
lea rdx, str.loader.uuid
mov r8d, 0xff
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x180007b18]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x180003abe
lea eax, [rbx + 3]
jmp 0x180003e66
mov eax, dword [rdi + 0x1c]
dec eax
cmp eax, 8
ja case.default.0x180003add
cdqe
mov qword [rsp + 0x48], r15
mov ecx, dword [rsi + rax*4 + 0x3ea0]
add rcx, rsi
jmp rcx
movsxd r8, dword [rdi + 0x1258]
mov r9, rbx
mov rcx, qword [rdi + 0x1260]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180003e56
mov esi, dword [rdi + 0x1258]
mov eax, 0xaaaaaaab
mov r14, qword [rdi + 0x1260]
mov ecx, 1
mul esi
shr edx, 1
lea eax, [rdx*4 + 4]
lea edx, [rax + 1]
mov dword [rsp + 0x40], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x180003b3f
lea ebp, [rax + 6]
jmp 0x180003e56
lea r9, [rsp + 0x40]
mov r8, rdi
mov edx, esi
mov rcx, r14
call fcn.180004fd0
mov esi, dword [rsp + 0x40]
test eax, eax
je 0x180003b6d
mov r8d, esi
mov r9, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180003bd5
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, 2
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x180003bcf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003e56
mov r15d, dword [rdi + 0x1258]
lea rdx, str.unsigned_char_buf_____n
mov rsi, qword [rdi + 0x1260]
mov rcx, rbx
call fcn.180004f80
mov edi, ebp
test r15d, r15d
je 0x180003c3a
mov r14d, edi
and r14d, 0xf
jne 0x180003c4e
mov rdx, rbx
lea ecx, [r14 + 0x22]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
movzx r8d, byte [rsi]
lea rdx, str.x_02x
mov rcx, rbx
call fcn.180004f80
inc edi
inc rsi
cmp edi, r15d
jb 0x180003c07
lea rdx, [0x1800080a4]
mov rcx, rbx
call fcn.180004f80
jmp 0x180003e56
movzx r8d, byte [rsi]
lea rdx, str.x_02x
mov rcx, rbx
call fcn.180004f80
cmp r14d, 0xf
jne 0x180003c30
lea eax, [rdi + 1]
cmp eax, r15d
jae 0x180003c30
lea rdx, [0x1800080a0]
mov rcx, rbx
call fcn.180004f80
inc edi
inc rsi
jmp 0x180003c07
mov r15d, dword [rdi + 0x1258]
lea rdx, str.buf_______n
mov rsi, qword [rdi + 0x1260]
mov rcx, rbx
call fcn.180004f80
mov edi, ebp
test r15d, r15d
je 0x180003e56
nop dword [rax]
mov r14d, edi
mov rcx, rbx
and r14d, 0xf
jne 0x180003cdd
lea rdx, str.buff___
call fcn.180004f80
movzx r8d, byte [rsi]
lea rdx, str.x_02x
mov rcx, rbx
call fcn.180004f80
jmp 0x180003d02
movzx r8d, byte [rsi]
lea rdx, str.x_02x
call fcn.180004f80
cmp r14d, 0xf
jne 0x180003d02
lea rdx, [0x1800080a0]
mov rcx, rbx
call fcn.180004f80
inc edi
inc rsi
cmp edi, r15d
jb 0x180003cb0
test dil, 0xf
je 0x180003e56
mov rdx, rbx
mov ecx, 0x22
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
jmp 0x180003e56
mov r14d, dword [rdi + 0x1258]
lea rdx, str._Byte_____buf_
mov rsi, qword [rdi + 0x1260]
mov rcx, rbx
call fcn.180004f80
mov edi, ebp
test r14d, r14d
je 0x180003e56
lea r15d, [r14 - 1]
nop word [rax + rax]
movzx r8d, byte [rsi]
lea rdx, str.0x_02x
mov rcx, rbx
call fcn.180004f80
cmp edi, r15d
jae 0x180003d86
mov rdx, rbx
mov ecx, 0x2c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
inc edi
inc rsi
cmp edi, r14d
jb 0x180003d60
jmp 0x180003e56
mov r14d, dword [rdi + 0x1258]
lea rdx, str.byte___my_buf__new_byte__d___n
mov rsi, qword [rdi + 0x1260]
mov r8d, r14d
mov rcx, rbx
call fcn.180004f80
mov edi, ebp
test r14d, r14d
je 0x180003df0
lea r15d, [r14 - 1]
movzx r8d, byte [rsi]
lea rdx, str.0x_02x
mov rcx, rbx
call fcn.180004f80
cmp edi, r15d
jae 0x180003de6
mov rdx, rbx
mov ecx, 0x2c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
inc edi
inc rsi
cmp edi, r14d
jb 0x180003dc0
lea rdx, [0x180008108]
mov rcx, rbx
call fcn.180004f80
jmp 0x180003e56
mov eax, dword [rdi + 0x1258]
mov rdi, qword [rdi + 0x1260]
test eax, eax
je 0x180003e56
mov esi, eax
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rdi]
lea rdx, str.x_02x
mov rcx, rbx
call fcn.180004f80
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x180003e20
jmp 0x180003e56
mov edx, dword [rdi + 0x1258]
mov r8, rbx
mov rcx, qword [rdi + 0x1260]
call fcn.180005110
mov ebp, eax
mov r15, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret