Function at 0x1001e520
Capabilities:
Hash data using djb2
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x168
mov rax, qword [0x10050650]
mov qword [rsp + 0x140], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], r12
mov r12, rcx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
mov qword [r11 - 0x18], r13
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
lea rsi, [r12 + 8]
mov ebp, reloc.WS2_32.dll_send
xor r13d, r13d
mov qword [rsp + 0x160], rdi
lea rbx, [rsi + 4]
mov qword [r12], rax
nop
nop
xor eax, eax
mov dword [rsi], r13d
lea r8, [0x1003dce0]
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
lea rdx, [0x10040f14]
mov rcx, rbx
mov qword [rbx + 0x18], rax
call qword [sym.imp.msvcrt.dll_sprintf]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1001e5e1
movzx edx, byte [rbx]
mov eax, 0x1505
mov rcx, rbx
test edx, edx
je 0x1001e5df
imul eax, eax, 0x21
inc rcx
add eax, edx
movzx edx, byte [rcx]
test edx, edx
jne 0x1001e5d0
mov dword [rsi], eax
mov eax, dword [reloc.WS2_32.dll_closesocket]
add rbx, 0x28
add rsi, 0x28
dec ebp
mov dword [rbx - 8], eax
jns 0x1001e580
xor eax, eax
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x328]
mov byte [rsp + 0x20], al
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const____ptr64____ptr64]
mov dword [r12 + 0x348], r13d
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea rcx, [r12 + 0x328]
xor edx, edx
mov r8, qword [r8]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], r13b
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
lea rcx, str._SystemRoot_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r13, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x188]
test eax, eax
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x178]
je 0x1001e6a3
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x328]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rdx, str.gwlogger.cfg
mov rcx, rax
jmp 0x1001e6b2
lea rdx, str.C:WINDOWSgwlogger.cfg
lea rcx, [r12 + 0x328]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
call sub.KERNEL32.dll_GetCurrentProcessId
mov rcx, r12
mov dword [r12 + 0x174c], eax
call fcn.1001e2a0
mov rdi, qword [rsp + 0x160]
mov rax, r12
mov r12, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
call fcn.1003b040
add rsp, 0x168
ret