Function at 0x180004690
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x708
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x670], xmm13
movdqa xmmword [rbp + 0x660], xmm12
movdqa xmmword [rbp + 0x650], xmm11
movdqa xmmword [rbp + 0x640], xmm10
movdqa xmmword [rbp + 0x630], xmm9
movdqa xmmword [rbp + 0x620], xmm8
movdqa xmmword [rbp + 0x610], xmm7
movdqa xmmword [rbp + 0x600], xmm6
mov qword [rbp + 0x5e0], 0xfffffffffffffffe
mov rdi, qword [0x18004a540]
cmp byte [0x18004bc04], 0
jne 0x1800047ce
movabs rax, 0x5f1d9ba1abdf4867
add rax, rdi
movabs rcx, 0x5f1d9ba1abdf487e
add rcx, rdi
xor edx, edx
lea r8, [0x18004bbfc]
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rdx]
movzx ebx, byte [rax + rdx]
mov r11d, ebx
and r11b, 0x28
mov r10d, r11d
xor r10b, 0x28
mov esi, r10d
or r10b, bl
xor bl, 0xd7
or sil, bl
mov r14d, esi
not r14b
mov r15d, r14d
and r15b, 0xc
and bl, 0x11
or bl, r15b
and sil, 0xe0
and r14b, 2
or r14b, sil
or bl, 0xe0
or r14b, 0xc
xor r14b, bl
xor r14b, r11b
xor r14b, 0x35
not r10b
and r10b, 0x28
or r10b, r14b
mov r11d, r9d
xor r11b, 0xd7
xor r9b, r10b
xor r9b, 0x28
and r9b, r10b
or r11b, r10b
not r11b
or r11b, r9b
mov byte [rdx + r8], r11b
inc rdx
cmp rdx, 8
jne 0x180004740
mov byte [0x18004bc04], 1
lea rcx, [0x18004bbfc]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
cmp byte [0x18004bc12], 0
jne 0x18000499f
movabs rax, 0x5f1d9ba1abdf48a2
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48ba
xor al, byte [rdi + rcx]
mov byte [0x18004bc05], al
movabs rax, 0x5f1d9ba1abdf48a3
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48bb
xor al, byte [rdi + rcx]
mov byte [0x18004bc06], al
movabs rax, 0x5f1d9ba1abdf48a4
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48bc
xor al, byte [rdi + rcx]
mov byte [0x18004bc07], al
movabs rax, 0x5f1d9ba1abdf48a5
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48bd
xor al, byte [rdi + rcx]
mov byte [0x18004bc08], al
movabs rax, 0x5f1d9ba1abdf48a6
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48be
xor al, byte [rdi + rcx]
mov byte [0x18004bc09], al
movabs rax, 0x5f1d9ba1abdf48a7
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48bf
xor al, byte [rdi + rcx]
mov byte [0x18004bc0a], al
movabs rax, 0x5f1d9ba1abdf48a8
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c0
xor al, byte [rdi + rcx]
mov byte [0x18004bc0b], al
movabs rax, 0x5f1d9ba1abdf48a9
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c1
xor al, byte [rdi + rcx]
mov byte [0x18004bc0c], al
movabs rax, 0x5f1d9ba1abdf48aa
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c2
xor al, byte [rdi + rcx]
mov byte [0x18004bc0d], al
movabs rax, 0x5f1d9ba1abdf48ab
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c3
xor al, byte [rdi + rcx]
mov byte [0x18004bc0e], al
movabs rax, 0x5f1d9ba1abdf48ac
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c4
xor al, byte [rdi + rcx]
mov byte [0x18004bc0f], al
movabs rax, 0x5f1d9ba1abdf48ad
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c5
xor al, byte [rdi + rcx]
mov byte [0x18004bc10], al
movabs rax, 0x5f1d9ba1abdf48ae
movzx eax, byte [rdi + rax]
movabs rcx, 0x5f1d9ba1abdf48c6
xor al, byte [rdi + rcx]
mov byte [0x18004bc11], al
mov byte [0x18004bc12], 1
lea rcx, [0x18004bc05]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, qword [0x18004a558]
movabs rdx, 0x5f1d9ba1abdf458b
add rdx, rcx
movabs r8, 0x5f1d9ba1abdf45eb
add r8, rcx
test rsi, rsi
cmovne r8, rdx
movabs rdx, 0x6cf8387f1b0d2fb8
mov r8, qword [r8]
add r8, rdx
jmp r8