Function at 0x180003570
Capabilities:
Copy file
Create thread
Read clipboard data
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1800038b9
call fcn.1800546f8
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.18004e89c
mov edx, dword [rbx + 0x18]
mov rbp, rax
sub edx, 1
je 0x18000389c
sub edx, 1
je 0x1800035f7
cmp edx, 1
jne 0x1800038ac
mov edx, 0x3ec0
mov rcx, rax
call fcn.180005370
mov qword [rbx + 0x10], rax
jmp 0x1800038ac
mov qword [rsp + 0x88], r13
mov eax, 0xfffff6dd
inc eax
test al, 1
jne 0x180003604
mov r9d, 0x1199
mov esi, 0xfffff308
sub r9d, eax
mov r8d, 0xffffc864
sub esi, r9d
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180003630
lea edi, [r9 - 0x30f]
mov r14d, 0xe6f7
sub r14d, r9d
lea r15d, [r8 + 0x198e7]
mov r10d, 0x10cc9
add edi, r14d
sub r10d, r9d
add esi, 0x20fba
add r10d, r10d
lea r9d, [r8*2 + 0x149e8]
sub esi, edi
mov r11d, 0x1c2b
nop word [rax + rax]
inc r11d
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
jne 0x180003690
lea ecx, [r10 + 0x37f8]
add r15d, r9d
add r9d, 0x1113
sub r11d, ecx
mov eax, 0xfffebb5b
mov r8d, 0x17fc8
sub eax, r10d
sub r8d, r9d
add edi, eax
lea r10d, [rsi - 0x2efd]
lea r13d, [r9 - 0x745c]
mov eax, r10d
add r13d, esi
sub eax, r13d
add ecx, eax
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
je 0x18000370b
mov eax, 0xffffecc4
test r8d, r8d
jg 0x180003710
mov eax, 0x133c
lea esi, [r8 + rax]
add r11d, 0x23a6
mov eax, 0x55555556
add r9d, esi
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x180003757
nop dword [rax]
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180003740
sub ecx, r11d
lea edx, [r10 + 0x1974]
sub r11d, edx
lea eax, [r13 + 0x1c85]
mov r13, qword [rsp + 0x88]
lea r8d, [rax + 0x9a7]
add ecx, edi
lea r12d, [r14 + r9]
add esi, 0xfffffb9d
lea r14d, [r9 - 0x121c]
add ecx, 0x1cfc
lea r10d, [r15 - 0x1681]
add r10d, eax
mov eax, 0xfffff4a1
add r8d, r10d
sub eax, esi
sub r11d, r8d
lea r9d, [rsi - 0x89a]
add edi, eax
sub edx, r10d
sub r10d, edi
mov eax, 0xfffffadd
lea r15d, [rdx - 0x3a7]
lea edx, [r11 - 0x1664]
sub eax, r15d
add edi, eax
add edx, esi
mov r11d, esi
lea eax, [r10*2 + 0x1748]
sub r11d, edi
sub esi, 0x29f2
sub r11d, r9d
sub eax, esi
add r11d, ecx
sub edi, r14d
add r11d, r8d
lea r8d, [r9 - 0x1fb2]
lea r9d, [rcx + 0x1015]
add r8d, r14d
mov ecx, r14d
add r11d, r15d
sub ecx, edx
add r9d, r14d
add edx, r8d
add r8d, 0x2331
cmp eax, 0xcd922
jne 0x180003890
cmp ecx, 0x91e86
jne 0x180003890
lea eax, [r14 - 0x5736]
add eax, r12d
cmp eax, 0x33c02
jne 0x180003890
cmp esi, 0x5272
jne 0x180003890
cmp edi, 0xfffea66c
jne 0x180003890
cmp r9d, 0x2949a
jne 0x180003890
cmp r15d, 0xfffd2d65
jne 0x180003890
sub edx, r9d
sub edx, r8d
cmp edx, 0xfff5841f
jne 0x180003890
cmp r8d, 0x1d1b9
jne 0x180003890
cmp r11d, 0x3be76
jne 0x180003890
mov edx, 0x3ec0
mov rcx, rbp
call fcn.180005370
mov qword [rbx + 8], rax
jmp 0x1800038ac
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
mov rcx, rbp
call fcn.180005370
mov qword [rbx], rax
mov edx, 1
mov rcx, rbp
call fcn.18004e7b0
mov edx, dword [0x1800de574]
xor esi, esi
cmp edx, 0x59f488
jne 0x18000399a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowTextW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ValidateRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ValidateRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumPropsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsHungAppWindow]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor r9d, r9d
mov dword [rsp + 0x20], esi
lea r8, str.Ie7UT9EqOvHzIpG8
xor edx, edx
lea rcx, str.Q1eEBkHi3Nr9I4792beLq
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov edx, dword [0x1800de574]
mov ecx, dword [rbx + 0x18]
mov rdi, rsi
sub ecx, 1
je 0x1800039bb
sub ecx, 1
je 0x1800039b5
cmp ecx, 1
jne 0x1800039be
mov rdi, qword [rbx + 0x10]
jmp 0x1800039be
mov rdi, qword [rbx + 8]
jmp 0x1800039be
mov rdi, qword [rbx]
cmp edx, 0xecbd2d11
jne 0x180003b27
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipboardData]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
call qword [sym.imp.USER32.dll_GetInputState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAncestor]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenInputDesktop]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InternalGetWindowText]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rsi
xor edx, edx
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
lea r11, [rsp + 0x50]
mov rax, rdi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret