Function at 0x140001b20
Capabilities:
Check if file exists
Create process on windows
Enumerate files on windows
Enumerate gui resources
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
movaps xmmword [rsp + 0x510], xmm6
lea rax, str.discordptb.exe
xor ebx, ebx
mov ecx, 0x41
lea rsi, str.discord.exe
movq xmm1, rax
lea rax, str.discordcanary.exe
movq xmm0, rsi
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x70], rax
lea rdi, [rsp + 0xb0]
mov rax, rbx
lea rsi, [rsp + 0x2c0]
rep stosq qword [rdi], rax
movaps xmmword [rsp + 0x60], xmm0
mov rdi, rsi
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov ecx, 0x4a
lea r9, [rsp + 0x5c]
xor edx, edx
mov r10, rax
mov rax, rbx
mov dword [rsp + 0x5c], 0x104
mov ebx, 0x104
rep stosq qword [rdi], rax
lea rdi, [rsp + 0xb0]
mov rcx, r10
mov r8, rdi
call qword [sym.imp.KERNEL32.DLL_QueryFullProcessImageNameW]
lea rax, [rsp + 0x2b8]
jmp 0x140001bdc
sub ebx, 1
sub rax, 2
cmp ebx, 0xffffffff
je 0x140001c23
cmp word [rax], 0x5c
jne 0x140001bd0
mov ebp, ebx
xor eax, eax
mov rcx, rdi
mov word [rsp + rbp*2 + 0xb0], ax
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
lea eax, [rbx + 1]
mov edx, 0x5c
xor r8d, r8d
mov ecx, 0x2a
mov word [rsp + rbp*2 + 0xb0], dx
mov word [rsp + rax*2 + 0xb0], cx
lea eax, [rbx + 2]
mov word [rsp + rax*2 + 0xb0], r8w
mov dword [rsp + 0x28], 2
mov r9d, 1
mov r8, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_FindFirstFileExW]
mov rbx, rax
test rax, rax
je 0x140001d02
mov r12, qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov rbp, qword [sym.imp.KERNEL32.DLL_FindNextFileW]
lea rdi, [rsp + 0x2ec]
lea r13, [0x1400050ec]
jmp 0x140001c8c
mov rdx, rsi
mov rcx, rbx
call rbp
test eax, eax
je 0x140001cf8
mov rcx, rdi
call r12
test eax, eax
je 0x140001c80
mov rdx, r13
mov rcx, rdi
call sub.ucrtbase.dll_wcscmp
test eax, eax
je 0x140001c80
lea rdx, [0x1400050f0]
mov rcx, rdi
call sub.ucrtbase.dll_wcscmp
test eax, eax
je 0x140001c80
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test eax, eax
je 0x140001c80
lea rax, [rsp + 0x78]
lea r15, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov r14, qword [r15]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140001d20
mov rax, qword [rsp + 0x48]
add r15, 8
cmp r15, rax
jne 0x140001cd4
jmp 0x140001c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindClose]
nop
movaps xmm6, xmmword [rsp + 0x510]
xor eax, eax
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [0x1400090a0], r14
xor edx, edx
pxor xmm6, xmm6
lea rcx, [0x140001a50]
call qword [sym.imp.USER32.dll_EnumWindows]
mov r8, qword [0x1400090a0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r15, [rsp + 0x80]
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x30], 0
xor r8d, r8d
lea r9, [0x1400017d0]
mov dword [rsp + 0x28], 0
mov edx, 0x8000
mov ecx, 0x8000
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov r14, qword [sym.imp.USER32.dll_GetMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov rcx, r15
movaps xmmword [rsp + 0xa0], xmm6
call r14
test eax, eax
jne 0x140001da0
jmp 0x140001c80