Function at 0x180094968
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, r8
mov rdi, rdx
mov rax, qword [rdx]
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x41], 0x35
mov edx, 0x71
mov word [rbp - 0x3d], dx
lea ecx, [rdx - 0x21]
mov word [rbp - 0x3b], cx
lea eax, [rdx - 0x2e]
mov word [rbp - 0x39], ax
lea r12d, [rdx - 0x15]
mov word [rbp - 0x37], r12w
lea eax, [rdx - 0x1b]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], cx
lea eax, [rdx + 0xb]
mov word [rbp - 0x31], ax
mov word [rbp - 0x2f], dx
xor eax, eax
mov word [rbp - 0x2d], ax
movzx eax, word [rbp - 0x3d]
xor ebx, ebx
mov edx, ebx
lea r15d, [rcx - 0x4f]
lea r13d, [rcx - 0x48]
movzx eax, word [rbp + rdx*2 - 0x3d]
mov ecx, dword [rbp - 0x41]
xor cx, ax
mov word [rbp + rdx*2 - 0x3d], cx
add rdx, r15
cmp rdx, r13
jb 0x1800397e7
mov word [rbp - 0x2d], bx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, [rbp - 0x3d]
mov rcx, rdi
call r10
mov r14d, eax
xor edx, edx
lea r8d, [rdx + 0x12]
lea rcx, [rbp - 0x3d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [rdi]
mov r10, qword [rax + 0x20]
mov word [rbp - 0x4d], r12w
mov eax, 0x72
mov word [rbp - 0x4b], ax
mov eax, 0x83
mov word [rbp - 0x49], ax
mov eax, 0x6e
mov word [rbp - 0x47], ax
mov word [rbp - 0x45], bx
movzx eax, word [rbp - 0x4d]
mov rcx, rbx
mov r12d, 4
movzx eax, word [rbp + rcx*2 - 0x4d]
sub ax, 9
mov word [rbp + rcx*2 - 0x4d], ax
add rcx, r15
cmp rcx, r12
jb 0x180039869
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xf]
xor r8d, r8d
lea rdx, [rbp - 0x4d]
mov rcx, rdi
call r10
mov edi, eax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp - 0x4d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov word [rbp - 0x29], bx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x27], xmm0
mov qword [rbp - 0x17], rax
mov dword [rbp - 0xf], eax
mov word [rbp - 0xb], ax
mov dword [rbp - 0x69], 0x37
mov eax, dword [rbp - 0x69]
xor ax, 0x53
mov word [rbp - 0x65], ax
mov eax, dword [rbp - 0x69]
add ax, r15w
xor ax, 0x79
mov word [rbp - 0x63], ax
mov eax, dword [rbp - 0x69]
add ax, 2
xor ax, 0x73
mov word [rbp - 0x61], ax
mov eax, dword [rbp - 0x69]
add ax, 3
xor ax, 0x74
mov word [rbp - 0x5f], ax
mov eax, dword [rbp - 0x69]
add ax, r12w
xor ax, 0x65
mov word [rbp - 0x5d], ax
mov eax, dword [rbp - 0x69]
add ax, 5
xor ax, 0x6d
mov word [rbp - 0x5b], ax
mov eax, dword [rbp - 0x69]
add ax, 6
xor ax, 0x44
mov word [rbp - 0x59], ax
mov eax, dword [rbp - 0x69]
add ax, 7
xor ax, 0x72
mov word [rbp - 0x57], ax
mov eax, dword [rbp - 0x69]
add ax, r13w
xor ax, 0x69
mov word [rbp - 0x55], ax
mov eax, dword [rbp - 0x69]
add ax, 9
xor ax, 0x76
mov word [rbp - 0x53], ax
mov eax, dword [rbp - 0x69]
mov r12d, 0xa
add ax, r12w
xor ax, 0x65
mov word [rbp - 0x51], ax
xor eax, eax
mov word [rbp - 0x4f], ax
movzx eax, word [rbp - 0x65]
mov rdx, rbx
movzx eax, word [rbp + rdx*2 - 0x65]
mov ecx, dword [rbp - 0x69]
add cx, dx
xor cx, ax
mov word [rbp + rdx*2 - 0x65], cx
add rdx, r15
cmp rdx, 0xb
jb 0x18003997f
mov word [rbp - 0x4f], bx
mov r8d, 0x10
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x65]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rbp - 0x65]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test r14d, r14d
js 0x180039a2a
test edi, edi
js 0x180039a2a
cmp word [rbp - 9], r15w
je 0x180039a2a
cmp word [rbp + 0xf], r15w
je 0x180039a2a
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x180039a16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebx
mov r8d, r12d
xor edx, edx
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wcstoui64]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], ebx
jne 0x180039a16
mov qword [rsi], rdi
mov bl, r15b
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov al, bl
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8, qword [r8]
mov rdx, qword [rdx]
jmp 0x18003975c