Function at 0x140001490
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor edi, edi
mov dword [rbp - 0x39], 0x23486426
mov dword [rbp - 0x35], 0x67626448
mov dword [rbp - 0x31], 0x74486524
mov dword [rbp - 0x2d], 0x24266362
mov dword [rbp - 0x29], 0x62277448
mov dword [rbp - 0x25], 0x48247b67
mov word [rbp - 0x21], 0x242b
mov byte [rbp - 0x1f], 0x6a
mov eax, edi
movdqa xmm2, xmmword [0x140003620]
lea rcx, [rbp - 0x39]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 0x10
lea rcx, [rcx + 0x10]
cmp eax, 0x10
jb 0x140001510
movsxd rcx, eax
cmp rcx, 0x1b
jae 0x14000154e
lea rcx, [rbp + rcx - 0x39]
nop dword [rax]
xor byte [rcx], 0x17
inc eax
lea rcx, [rcx + 1]
cmp eax, 0x1b
jb 0x140001540
mov dword [rbp - 0x49], 0x62697077
mov dword [rbp - 0x45], 0x7f732963
mov byte [rbp - 0x41], 0x73
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rdi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x140001586
movabs r13, 0x7fffffffffffffff
cmp rbx, r13
ja 0x14000189e
movabs rax, 0x8000000000000000
mov ecx, 0x16
mov esi, 0xf
mov qword [rbp + 0x27], rsi
cmp rbx, 0x10
jae 0x1400015dd
mov qword [rbp + 0x1f], rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xf]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0xf], dil
jmp 0x140001662
mov r14, rbx
or r14, rsi
cmp r14, r13
jbe 0x14000160f
mov r14, r13
add rax, 0x27
mov rcx, rax
call fcn.140001ea0
test rax, rax
je 0x140001853
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140001644
cmp r14, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140001632
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001892
jmp 0x1400015ef
test rcx, rcx
je 0x140001641
call fcn.140001ea0
mov r12, rax
jmp 0x140001644
mov r12, rdi
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], r14
mov r8, rbx
mov rdx, r15
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], dil
mov r14, qword [rbp + 0x1f]
mov rax, r13
sub rax, r14
cmp rax, 1
jb 0x14000188c
lea r12, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae r12, qword [rbp + 0xf]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea r15, [r14 + 1]
lea rbx, [rbp - 0x11]
cmp r15, 0xf
jbe 0x140001714
mov rsi, r15
or rsi, 0xf
cmp rsi, r13
jbe 0x1400016d5
mov rsi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001ea0
test rax, rax
je 0x140001766
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001710
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400016fe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001898
jmp 0x1400016b6
test rcx, rcx
je 0x14000170d
call fcn.140001ea0
mov rbx, rax
jmp 0x140001710
mov rbx, rdi
mov qword [rbp - 0x11], rbx
mov qword [rbp - 1], r15
mov qword [rbp + 7], rsi
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0x5c
mov byte [rbx + r15], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140001772
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000176d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000176d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000212c
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbp + 0x1f], xmm1
mov ebx, edi
lea rsi, [rbp - 0x49]
nop dword [rax + rax]
movzx r9d, byte [rsi]
xor r9b, 7
mov rcx, qword [rbp + 0x1f]
mov rdx, qword [rbp + 0x27]
cmp rcx, rdx
jae 0x1400017c5
lea rax, [rcx + 1]
mov qword [rbp + 0x1f], rax
lea rax, [rbp + 0xf]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0xf]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400017ce
lea rcx, [rbp + 0xf]
call fcn.140001d10
inc ebx
inc rsi
cmp ebx, 9
jb 0x140001790
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rcx, qword [rbp + 0xf]
lea rdx, [0x140003404]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
lea rbx, [rbp - 0x39]
nop word [rax + rax]
movsx ecx, byte [rbx]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
inc edi
lea rbx, [rbx + 1]
cmp edi, 0x1b
jb 0x140001800
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14000185f
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000185a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000185a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000212c
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140001e80
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400012f0
nop
call fcn.140001250
nop
call fcn.140001250
nop
call fcn.1400012f0
int3