Function at 0x140045970
Capabilities:
Check for time delay via queryperformancecounter
Get system information on windows

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
xor r12d, r12d
mov qword [rsp + 0x40], rcx
cmp qword [0x140328df0], r12
mov r13, rcx
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
jne 0x1400459d6
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x1400459d6
mov qword [rax], r12
mov qword [rax + 8], 0x19c
mov qword [0x140328df0], rax
mov qword [rsp + 0x738], rbx
lea rcx, str.Discord.exe
mov qword [rsp + 0x740], rsi
mov qword [rsp + 0x748], rdi
mov qword [rsp + 0x708], r14
mov qword [rsp + 0x700], r15
movaps xmmword [rsp + 0x6f0], xmm6
call fcn.14003c550
test eax, eax
jne 0x140045a4a
lea rcx, str.DiscordPTB.exe
call fcn.14003c550
test eax, eax
jne 0x140045a4a
lea rcx, str.DiscordCanary.exe
call fcn.14003c550
test eax, eax
jne 0x140045a4a
lea rcx, str.DiscordDevelopment.exe
call fcn.14003c550
test eax, eax
je 0x14004631f
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x1b8]
mov qword [rsp + 0x60], rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rsp + 0x48], rdi
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
cmp rdi, qword [rbp + 0xf0]
jae 0x140046311
movsd xmm6, qword [0x140204bf0]
nop word [rax + rax]
mov r9d, Ordinal_50
lea r8, [rbp + 0xb0]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rbp + 0xd4]
add eax, 0xfffffffe
test eax, 0xfffffffd
jne 0x1400462ab
mov rcx, qword [rbp + 0xc8]
call fcn.140190dd0
mov r9, qword [rbp + 0xc8]
mov rsi, rax
mov qword [rsp + 0x58], rax
mov r8, rsi
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], r12
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
mov r9d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rsi
call fcn.14003c970
mov rbx, rax
test rax, rax
je 0x14004629e
xor edx, edx
mov byte [rsp + 0x30], 1
mov r8d, 0x3fc
lea rcx, [rbp + 0x1e0]
call fcn.1401d1c40
mov rdx, qword [rbp + 0xb0]
lea rax, [rbp + 0x1a0]
sub rdx, rsi
mov qword [rsp + 0x20], rax
add rdx, rbx
lea r8, [rbp + 0x1e0]
mov r9d, 0x3fc
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rbp + 0x1e0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140045bb1
test r8, r8
je 0x140046298
xorps xmm0, xmm0
mov qword [rbp + 0x170], r12
lea rdx, [rbp + 0x1e0]
mov qword [rbp + 0x178], r12
lea rcx, [rbp + 0x160]
movups xmmword [rbp + 0x160], xmm0
call fcn.14003ce50
lea rcx, [rbp + 0x160]
call fcn.140044190
test al, al
je 0x140046298
xorps xmm0, xmm0
mov qword [rbp + 0x120], r12
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x128], r12
lea rax, [rbp + 0x1e0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140045c30
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x110]
call fcn.14003ce50
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x1c0]
call fcn.140044330
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.1400bb910
cmp qword [rbp + 0x1d8], 0xf
lea rcx, [rbp + 0x1c0]
mov rax, qword [rbp + 0x1d0]
lea r8, [rbp + 0x160]
cmova rcx, qword [rbp + 0x1c0]
lea rdx, [rsp + 0x70]
add rax, rcx
mov qword [rbp + 0x198], r12
cmp qword [rbp + 0x1d8], 0xf
lea rcx, [rbp + 0x1c0]
mov qword [rbp - 0x68], rax
mov r9b, 1
cmova rcx, qword [rbp + 0x1c0]
mov qword [rbp - 0x70], rcx
lea rcx, [rbp - 0x40]
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.140104a80
lea r8, [rbp + 0x150]
mov rcx, rax
call fcn.140100040
lea rcx, [rbp + 8]
call fcn.1400fff60
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140045d08
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xorps xmm0, xmm0
mov qword [rbp + 0x170], r12
mov r8d, 6
mov qword [rbp + 0x178], r12
lea rdx, str._state
lea rcx, [rbp + 0x160]
movups xmmword [rbp + 0x160], xmm0
call fcn.14003ce50
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x150]
call fcn.1400b5ac0
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400b5ff0
movzx ecx, byte [rbp + 0x150]
mov r8, rax
movzx eax, byte [rax]
mov byte [rbp + 0x150], al
mov byte [r8], cl
lea rcx, [r8 + 8]
mov rdx, qword [rcx]
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdx
mov qword [rcx], rax
movzx edx, byte [r8]
call fcn.1400bb410
xorps xmm0, xmm0
mov qword [rbp - 0x80], r12
mov r8d, 5
mov qword [rbp - 0x78], r12
lea rdx, str.users
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x70], xmm0
call fcn.14003ce50
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.1400b5ac0
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movabs r11, 0x8000000000000000
movdqu xmmword [rbp + 0x118], xmm0
movzx edx, byte [rax]
mov r8, rax
mov rdi, r11
movdqu xmmword [rbp + 0x120], xmm1
cmp edx, 9
ja case.default.0x140045e0f
lea r10, [0x140000000]
movsxd rax, edx
mov ecx, dword [r10 + rax*4 + 0x464e4]
add rcx, r10
jmp rcx
lea r10, [0x140000000]
cmp edx, 9
ja case.0x140045e28.3
mov ecx, dword [r10 + rdx*4 + 0x4650c]
add rcx, r10
jmp rcx
mov rax, qword [r8 + 8]
xor r9d, r9d
mov rbx, qword [rax]
mov rbx, qword [rbx]
jmp 0x140045e63
mov rsi, qword [r8 + 8]
xor r9d, r9d
mov rbx, qword [rbp + 0x118]
mov rsi, qword [rsi]
jmp 0x140045e6a
mov edi, 1
xor r9d, r9d
jmp 0x140045e5c
xor r9d, r9d
mov edi, r9d
mov rbx, qword [rbp + 0x118]
mov rsi, qword [rbp + 0x120]
movzx edx, byte [r8]
mov r14, r11
movdqu xmmword [rbp + 0x168], xmm0
movdqu xmmword [rbp + 0x170], xmm1
cmp edx, 9
ja case.0x140045ea6.0
movsxd rax, edx
mov ecx, dword [r10 + rax*4 + 0x46534]
add rcx, r10
jmp rcx
cmp edx, 9
ja case.0x140045ea6.0
mov ecx, dword [r10 + rdx*4 + 0x4655c]
add rcx, r10
jmp rcx
mov r15, qword [r8 + 8]
mov r15, qword [r15]
jmp 0x140045ed0
mov r12, qword [r8 + 8]
mov r15, qword [rbp + 0x168]
mov r12, qword [r12 + 8]
jmp 0x140045ed7
mov r15, qword [rbp + 0x168]
mov r14d, 1
mov r12, qword [rbp + 0x170]
movzx edx, byte [r8]
cmp edx, 9
ja case.0x140045eee.0
movsxd rax, edx
mov ecx, dword [r10 + rax*4 + 0x46584]
add rcx, r10
jmp rcx
cmp rbx, r15
jmp 0x140045efd
cmp rsi, r12
jmp 0x140045efd
cmp rdi, r14
sete al
test al, al
jne 0x140046262
cmp edx, 9
ja case.0x140045f18.3
mov ecx, dword [r10 + rdx*4 + 0x465ac]
add rcx, r10
jmp rcx
lea rax, [rbx + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x140045f3a
mov qword [rsp + 0x38], rsi
jmp 0x140045f3a
test rdi, rdi
jne case.0x140045f18.0
mov qword [rsp + 0x38], r8
xorps xmm0, xmm0
mov qword [rbp + 0x120], r9
movups xmmword [rbp + 0x110], xmm0
mov r8d, 8
lea rdx, str.username
movups xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0x160]
mov byte [rbp + 0x110], 0
mov byte [rbp + 0x130], 0
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x140], r9
mov qword [rbp + 0x148], reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r9
mov qword [rbp + 0x178], r9
call fcn.14003ce50
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0x160]
call fcn.1400b5ac0
cmp byte [rax], 3
jne 0x1400464d7
mov rax, qword [rax + 8]
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140045fd6
mov r9, qword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp + 0x128]
mov qword [rsp + 0x50], rax
cmp rax, rcx
ja 0x14004601f
cmp rcx, 0xf
mov qword [rbp + 0x120], rax
lea r13, [rbp + 0x110]
mov r8, rax
cmova r13, qword [rbp + 0x110]
mov rdx, r9
mov rcx, r13
call fcn.1401d15a0
mov rax, qword [rsp + 0x50]
mov byte [rax + r13], 0
jmp 0x14004602e
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.1400ff8b0
xor eax, eax
lea rdx, [0x1401fea24]
xorps xmm0, xmm0
mov qword [rbp + 0x170], rax
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x178], rax
movups xmmword [rbp + 0x160], xmm0
lea r8d, [rax + 2]
call fcn.14003ce50
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0x160]
call fcn.1400b5ac0
cmp byte [rax], 3
jne 0x1400464d7
mov rax, qword [rax + 8]
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14004608a
mov r9, qword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp + 0x148]
mov qword [rsp + 0x50], rax
cmp rax, rcx
ja 0x1400460d3
cmp rcx, 0xf
mov qword [rbp + 0x140], rax
lea r13, [rbp + 0x130]
mov r8, rax
cmova r13, qword [rbp + 0x130]
mov rdx, r9
mov rcx, r13
call fcn.1401d15a0
mov rax, qword [rsp + 0x50]
mov byte [rax + r13], 0
jmp 0x1400460e2
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1400ff8b0
mov rax, qword [rsp + 0x40]
mov r13, qword [rax + 8]
cmp r13, qword [rax + 0x10]
je 0x14004611c
lea rdx, [rbp + 0x110]
mov rcx, r13
call fcn.140040c90
lea rcx, [r13 + 0x20]
lea rdx, [rbp + 0x130]
call fcn.140040c90
mov r13, qword [rsp + 0x40]
add qword [r13 + 8], 0x40
jmp 0x140046133
lea r8, [rbp + 0x110]
mov rdx, r13
mov rcx, rax
call fcn.14010e2d0
mov r13, qword [rsp + 0x40]
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140046174
mov rcx, qword [rbp + 0x130]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004616f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464d1
call fcn.140190a2c
mov rdx, qword [rbp + 0x128]
xor r9d, r9d
mov qword [rbp + 0x140], r9
mov qword [rbp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x130], r9b
cmp rdx, 0xf
jbe 0x1400461d4
mov rcx, qword [rbp + 0x110]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400461cc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464d1
call fcn.140190a2c
xor r9d, r9d
mov r8, qword [rsp + 0x70]
lea r10, [0x140000000]
movzx eax, byte [r8]
cmp eax, 9
ja case.0x1400461f4.0
mov ecx, dword [r10 + rax*4 + 0x465d4]
add rcx, r10
jmp rcx
mov rax, rbx
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14004622d
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
jne 0x140045ed7
cmp rax, qword [rbx + 0x10]
jne 0x140045ed7
mov rax, rbx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
je 0x140046211
jmp 0x140045ed7
mov rax, qword [rbx]
cmp byte [rax + 0x19], 0
jne 0x140045ed7
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140046240
jmp 0x140045ed7
add rsi, 0x10
jmp 0x140045ed7
inc rdi
jmp 0x140045ed7
movzx edx, byte [rbp + 0x150]
lea rcx, [rbp + 0x158]
call fcn.1400bb410
mov rax, qword [rbp + 0x1d8]
cmp rax, 0xf
ja 0x140046395
mov rdi, qword [rsp + 0x48]
xor r12d, r12d
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
movzx r15d, byte [rsp + 0x30]
mov rcx, rsi
call fcn.140190a2c
test r15b, r15b
jne 0x140046311
mov rax, qword [rbp + 0xc8]
add rdi, rax
mov qword [rsp + 0x48], rdi
test rax, rax
jne 0x1400462cb
add rdi, 0x1000
mov qword [rsp + 0x48], rdi
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x1a8]
xorps xmm1, xmm1
sub rax, qword [rbp + 0x1b0]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x1b8]
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
comisd xmm1, xmm6
ja 0x140046311
cmp rdi, qword [rbp + 0xf0]
jb 0x140045ad0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov r14, qword [0x140328df0]
mov edi, r12d
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14004645a
lea rbx, [r14 + 0x10]
nop dword [rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp - 0x50], xmm0
test rax, rax
je 0x140046448
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x140046448
movzx ecx, byte [rbp - 0x50]
test cl, cl
jne 0x1400463d9
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x140046448
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400463c5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464dd
call fcn.140190a2c
mov rcx, qword [rsp + 0x58]
call fcn.140190a2c
jmp 0x140046311
cmp cl, 1
jne 0x140046448
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140040c90
cmp qword [rbp + 0x178], 0xf
lea rax, [rbp + 0x160]
cmova rax, qword [rbp + 0x160]
mov byte [rax], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x140046448
mov rcx, qword [rbp + 0x160]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046443
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464cb
call fcn.140190a2c
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x140046350
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
movaps xmm6, xmmword [rsp + 0x6f0]
mov rax, r13
mov r15, qword [rsp + 0x700]
mov r14, qword [rsp + 0x708]
mov rdi, qword [rsp + 0x748]
mov rsi, qword [rsp + 0x740]
mov rbx, qword [rsp + 0x738]
mov qword [0x140328df0], r12
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.140190770
add rsp, 0x710
pop r13
pop r12
pop rbp
ret
call fcn.1401ac89c
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac89c
int3
call fcn.1401ac538
int3