Function at 0x1800019c0
Capabilities:
Create pipe
Create process on windows
Open clipboard
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28d0]
mov eax, 0x29d0
call fcn.180017310
sub rsp, rax
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x2a08], rbx
mov qword [rsp + 0x2a10], rsi
mov qword [rsp + 0x2a18], rdi
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp + 0x28c0], rax
mov r14, rcx
movzx edi, word [rdx + 0x10]
cmp di, 2
ja 0x180001d66
mov dword [rsp + 0x68], 0x18
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov esi, 1
mov dword [rsp + 0x78], esi
mov rax, qword [0x180025e28]
mov qword [rax + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x58]
mov r8, rbx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor edx, edx
lea r8d, [r15 + 0x68]
lea rcx, [rbp - 0x50]
call fcn.180007090
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 0x100
mov rax, qword [rsp + 0x60]
mov qword [rbp], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 8], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x10], rax
mov r12d, dword [r14 + 0x30]
lea rbx, [0x1800204f2]
mov ecx, dword [r14 + 0x54]
call sym.fastex64.dll_GetMenuFlags
mov ecx, eax
cmp di, 2
jne 0x180001bb5
cmp dword [r14 + 0x50], r15d
jne 0x180001bc7
test r12d, r12d
jne 0x180001b18
lea rax, str._cmddelete
cmp di, si
cmovne rax, rbx
mov rbx, rax
mov dword [rsp + 0x28], ecx
lea rax, str._fc_shell_ext1
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [0x180025e28]
mov r8, qword [r8 + 0x18]
lea rdx, str.__s___s__s_x
lea rcx, [rbp + 0x20]
call fcn.1800010c0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
mov rcx, qword [0x180025e28]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180001d57
lea rsi, [r14 + 0x20]
cmp di, 2
jne 0x180001bd3
lea r15, [r14 + 0x40]
cmp dword [r14 + 0x30], 0
jne 0x180001bd6
jmp 0x180001bda
cmp di, si
jne 0x180001b02
test r12d, r12d
je 0x180001b07
lea rbx, str._cmdmove
jmp 0x180001b18
mov r15, rsi
lea rsi, [r14 + 0x30]
mov rcx, r15
call fcn.1800028f0
mov dword [rsp + 0x50], eax
mov ecx, 0x820
cmp eax, ecx
cmova ecx, eax
mov eax, 2
mul rcx
mov r14, rax
mov rax, 0xffffffffffffffff
cmovo r14, rax
mov rcx, r14
call fcn.1800050c0
mov rbx, rax
test rax, rax
je 0x180001c25
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.180007090
jmp 0x180001c27
xor ebx, ebx
mov qword [rbp - 0x78], rbx
test r12d, r12d
jne 0x180001c3d
cmp di, 2
je 0x180001c3d
lea r14d, [r12 + 1]
jmp 0x180001c40
xor r14d, r14d
mov r8d, dword [rsp + 0x50]
mov rdx, rbx
mov rcx, r15
call fcn.180002840
lea r8d, [rax + r14]
mov dword [rsp + 0x50], r8d
add r8d, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r12d, r12d
jne 0x180001c89
cmp di, 2
jne 0x180001d17
jmp 0x180001c8f
cmp di, 2
jne 0x180001cb8
cmp dword [rsi], 0
jle 0x180001c9d
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
jmp 0x180001c9f
xor ecx, ecx
lea rdx, [rbp + 0x840]
call fcn.180003420
test eax, eax
je 0x180001cb8
lea rdx, [rbp + 0x840]
jmp 0x180001cc8
cmp dword [rsi], 0
jle 0x180001cc6
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
jmp 0x180001cc8
xor edx, edx
lea rcx, [rbp + 0x1880]
call fcn.180003260
lea r8, [rbp + 0x1880]
mov rdx, qword [0x180025e30]
mov rcx, rbx
call fcn.180001060
lea r8d, [rax + 1]
mov dword [rsp + 0x50], r8d
lea r8d, [r8*8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp di, 2
jne 0x180001d4a
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180001d4a
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
test rbx, rbx
je 0x180001d57
mov rcx, rbx
call fcn.180004fa4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180001d6b
mov eax, 0x80070057
mov rcx, qword [rbp + 0x28c0]
xor rcx, rsp
call fcn.180004f80
lea r11, [rsp + 0x29d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret