Function at 0x14001b548
Capabilities:
Encode data using xor
Query environment variable
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebp, ebp
cmp qword [rcx + 0x50], 0xffffffffffffffff
mov rdi, rcx
mov ebx, ebp
mov esi, 0x80004005
jne 0x14001b75a
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, ebp
ja 0x14001b59e
lea eax, [rbp + 1]
jmp 0x14001b76c
lea rcx, [rsp + 0x92]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x90]
mov r8d, 0x104
call qword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jne 0x14001b5db
mov ebx, esi
jmp 0x14001b60c
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x90]
lea edx, [r9 + 1]
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], 3
mov r8d, edx
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW]
mov qword [rdi + 0x48], rax
mov rcx, qword [rdi + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14001b74e
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
lea r8d, [r9 + 2]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_CreateFileMappingW]
mov qword [rdi + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14001b745
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_MapViewOfFile]
mov qword [rdi + 0x58], rax
cmp rax, rbp
je 0x14001b74e
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x34]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x48]
lea rdx, [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_GetFileInformationByHandle]
mov edx, dword [rsp + 0x64]
mov dword [rdi + 0x60], edx
cmp dword [rsp + 0x54], ebp
jne 0x14001b69c
lea rax, [rsp + 0x44]
cmp dword [rsp + 0x58], ebp
je 0x14001b6a1
lea rax, [rsp + 0x54]
mov rax, qword [rax]
cmp edx, 0x10
mov qword [rdi + 0x40], rax
mov eax, 0x80070018
cmovbe ebx, eax
cmp ebx, ebp
jl 0x14001b752
mov rax, qword [rdi + 0x58]
lea rcx, [rax + 0x10]
cmp rax, rbp
jne 0x14001b6cb
mov rcx, rbp
xor r8d, r8d
add edx, 0xfffffff0
mov qword [rsp + 0x78], r8
mov r9, r8
mov qword [rsp + 0x80], r8
cmp rcx, rbp
je 0x14001b73e
cmp edx, ebp
jbe 0x14001b73e
shr edx, 3
cmp edx, ebp
jbe 0x14001b711
mov r10d, edx
xor r8, qword [rcx]
add r9, qword [rcx]
add rcx, 8
sub r10, 1
jne 0x14001b6f4
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x78]
mov ebx, ebp
mov rdx, qword [rcx]
cmp rdx, qword [rax]
jne 0x14001b72e
mov rdx, qword [rcx + 8]
cmp rdx, qword [rax + 8]
jne 0x14001b72e
mov eax, ebp
jmp 0x14001b733
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x14001b75a
mov ebx, 0x80070017
jmp 0x14001b74e
mov ebx, 0x80070057
jmp 0x14001b752
cmp ebx, ebp
jl 0x14001b752
mov ebx, 0x80070002
cmp ebx, ebp
jge 0x14001b75a
mov rcx, rdi
call fcn.14001b478
cmp qword [rdi + 0x50], 0xffffffffffffffff
je 0x14001b765
xor eax, eax
jmp 0x14001b76c
cmp ebx, ebp
cmovl esi, ebx
mov eax, esi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret