Function at 0x18000b750
Capabilities:
Get common file path
Move file
Terminate process
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
cmp edx, 1
jne 0x18000bc73
lea rax, [0x18000a520]
add rax, 0x18d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x18d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.180012310
lea rax, [0x18000ad10]
add rax, 0x27e
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x27e
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180014090
nop
lea rcx, [rsp + 0x48]
call fcn.1800187f0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, InitCommonControls
call fcn.180067238
xor ecx, ecx
call fcn.180070ea0
mov ecx, eax
call fcn.18006d14c
lea rbx, [0x18000aa80]
lea rax, [rbx + 0x19d]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x19d
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180013e60
nop
lea rcx, [rsp + 0x48]
call fcn.1800187f0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, InitCommonControls
call fcn.180067238
add rbx, 0x1bf
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 0x1bf
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180013e60
nop
lea rcx, [rsp + 0x48]
call fcn.1800187f0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, InitCommonControls
call fcn.180067238
lea rax, [0x18000ab70]
add rax, 0x25b
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x25b
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
lea r8, [rbp]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180013c20
nop
lea rcx, [rsp + 0x48]
call fcn.1800187f0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, InitCommonControls
call fcn.180067238
lea rax, [0x180004600]
add rax, 0x25a
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x25a
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.180012310
cmp dword [0x180117e58], 0xfa9fba72
jne 0x18000bc59
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.dlEbVU2pFCdQ7nh
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0xf8]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x108]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xchg dword [rdi], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov eax, 1
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
cmp edx, 2
je 0x18000bc59
cmp edx, 3
jne 0x18000bd80
cmp dword [0x180117e58], 0x35770b7e
jne 0x18000bc59
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetUserObjectInformationW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefDlgProcW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClipboardData]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
jmp 0x18000bc59
test edx, edx
jne 0x18000bc59
mov ecx, 0x1a90c
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000bd90
mov edx, 0xffff7617
sub edx, ecx
mov eax, 0xfffffa81
inc eax
test al, 1
jne 0x18000bdb3
sub edx, 0x364d
add eax, edx
lea eax, [rax*2 - 0x1962f]
lea ecx, [rax - 0x37c]
add ecx, edx
test cl, 1
je 0x18000bddc
inc ecx
test cl, 1
jne 0x18000bdd5
add eax, eax
mov r8d, ecx
sub r8d, eax
mov r9d, 0xffffc3e9
mov edx, eax
sub edx, ecx
sub edx, 0x63f
add r9d, eax
mov eax, 0xffff9948
lea ecx, [rdx + 0x19ac]
cmp ecx, 0xfffc0c7b
jne 0x18000be35
sub eax, ecx
cmp eax, 0x38ccd
jne 0x18000be35
cmp r9d, 0xfff2dc87
jne 0x18000be35
lea eax, [r8 + r8]
cmp eax, 0x80de4
jne 0x18000be35
lea eax, [rdx + rdx]
cmp eax, 0xfff7e59e
je 0x18000bc59
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]