Function at 0x1801c2ae0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov word [rax + 8], cx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov r12, r9
mov r14, r8
mov r13, rdx
movabs rdi, 0xb026e4ab68d438e9
mov qword [rsp + 0x30], rdi
movabs rbx, 0xed4c2e26f4897ac6
mov qword [rsp + 0x38], rbx
movabs rax, 0xd1a3c4e5cbbc3a8b
mov qword [rsp + 0x40], rax
movabs rcx, 0x99399348c0d69bc8
mov qword [rsp + 0x48], rcx
movabs r15, 0xd34f92d90d877dab
mov qword [rsp + 0x70], r15
movabs rax, 0x95290012c2f125a3
mov qword [rsp + 0x78], rax
movabs rax, 0xd1a3c4e5cbbc3aee
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rcx
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm1
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
movabs rsi, 0xef4389ca2fb84bbd
mov qword [rsp + 0x30], rsi
movabs rax, 0xed4c4b5e91a73993
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x70], rsi
movabs rax, 0xed4c4b5e91a7319c
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0xd1a3c4e5cbbc3a8b
mov qword [rsp + 0x40], rax
movabs rax, 0x99399348c0d69bc8
mov qword [rsp + 0x48], rax
movabs rax, 0xd144bbd90cb85b9c
mov qword [rsp + 0x70], rax
movabs rax, 0x98235c4191e50eb2
mov qword [rsp + 0x78], rax
movabs rax, 0xb48da88294cf5ee5
mov qword [rbp - 0x80], rax
movabs rax, 0x99399348c0d6feb0
mov qword [rbp - 0x78], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm1
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x70], rsi
movabs rax, 0xed4c4b5e91a73f84
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0xc843cac81ea75393
mov qword [rsp + 0x70], rax
movabs rax, 0xed4c2e26f4897aa3
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0xd74491fb0bb140ac
mov qword [rsp + 0x70], rax
movabs rax, 0xed4c2e2691f11fe8
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x70], r15
movabs rax, 0xed4c2e438cec54a3
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1801c3441
cmp dword [r14 + 0x28], 1
jle 0x1801c343a
lea rcx, [rbp - 0x10]
call fcn.1801c45a4
mov r15, rax
mov edx, dword [r14 + 0x30]
xor ebx, ebx
mov edi, dword [rbp - 0x10]
test edi, edi
jle 0x1801c343a
lea rcx, [rax + 0x24]
mov r8d, 0x274
cmp dword [rcx], edx
je 0x1801c2e30
inc ebx
add rcx, r8
cmp ebx, edi
jl 0x1801c2e21
jmp 0x1801c2e49
movsxd rax, ebx
imul rdx, rax, 0x274
add rdx, r15
lea rcx, [rbp + 0x210]
call fcn.1801dd380
cmp ebx, edi
jge 0x1801c343a
mov ebx, 0x104
mov dword [rbp - 0xc], ebx
lea r9, [rbp - 8]
lea r8, [rbp - 0xc]
lea rdx, [rbp]
lea rcx, [rbp + 0x224]
call qword [sym.imp.WS2_32.dll_WSCGetProviderPath]
or rsi, 0xffffffffffffffff
cmp eax, esi
je 0x1801c343a
mov r8d, ebx
lea rdx, [rbp]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1801c343a
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.1801c3d68
cmp qword [rax + 0x18], 0xf
jbe 0x1801c2eaf
mov rax, qword [rax]
mov rcx, rax
call fcn.1801c3e48
mov rbx, rax
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1801c2ef6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801c2ef1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c346a
call fcn.180014dbc
movdqa xmm0, xmmword [0x1802581e0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
nop
mov dword [rsp + 0x30], 0xb3366718
nop
mov dword [rsp + 0x34], 0xd567c40
nop
mov word [rsp + 0x38], 0x535b
mov byte [rsp + 0x3a], 0x76
mov ecx, 0xfc36ba1f
xor edx, edx
mov edi, 0x269ec3
imul ecx, ecx, 0x343fd
add ecx, edi
mov eax, ecx
shr eax, 0x10
xor byte [rsp + rdx + 0x30], al
inc rdx
cmp rdx, 0xb
jb 0x1801c2f33
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rbp + 0x210]
cmp dword [rbp + 0x238], 1
cmovne r8, r14
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [r12 + 0x10]
movaps xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [r12 + 0x20]
movaps xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [r12 + 0x30]
movaps xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [r12 + 0x40]
movaps xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [r12 + 0x50]
movaps xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [r12 + 0x60]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm1, qword [r12 + 0x70]
movsd qword [rbp - 0x20], xmm1
mov rbx, qword [rbp + 0x4e0]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov rdx, r13
movzx ecx, word [rbp + 0x4c0]
call rax
mov r12d, eax
mov r8d, 0xf0
mov rdx, rbx
lea rcx, [0x180298720]
call fcn.1801dd380
nop
nop
mov dword [rsp + 0x30], 0xb6015dfc
nop
mov dword [rsp + 0x34], 0x6d5a0aef
nop
mov dword [rsp + 0x38], 0xfba3641a
mov ecx, 0x86a6d36f
xor r13d, r13d
mov edx, r13d
imul ecx, ecx, 0x343fd
add ecx, edi
mov eax, ecx
shr eax, 0x10
xor byte [rsp + rdx + 0x30], al
inc rdx
cmp rdx, 0xc
jb 0x1801c301b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1801c342c
movabs rax, 0xb026e4ab68d438e9
mov qword [rsp + 0x30], rax
movabs rbx, 0xed4c2e26f4897ac6
mov qword [rsp + 0x38], rbx
movabs rax, 0xd1a3c4e5cbbc3a8b
mov qword [rsp + 0x40], rax
movabs rax, 0x99399348c0d69bc8
mov qword [rsp + 0x48], rax
movabs rax, 0xba36b66fc1e7863d
mov qword [rsp + 0x50], rax
movabs rax, 0xa730ca5a23daf78a
mov qword [rsp + 0x58], rax
movabs rax, 0x351dc4c96c8ebb6f
mov qword [rsp + 0x60], rax
movabs rax, 0x30f20d6c26be6f4c
mov qword [rsp + 0x68], rax
movabs rcx, 0xc35481d83d8802aa
mov qword [rsp + 0x70], rcx
movabs rcx, 0xb12f474a96fc2a9a
mov qword [rsp + 0x78], rcx
movabs rcx, 0x81d7aa90a4df59ca
mov qword [rbp - 0x80], rcx
movabs rcx, 0xc54af63ab5a2f8a1
mov qword [rbp - 0x78], rcx
movabs rcx, 0xd346db0082a3b579
mov qword [rbp - 0x70], rcx
movabs rcx, 0xc31eff627ca892e6
mov qword [rbp - 0x68], rcx
movabs rcx, 0x351dc4c96c8ed703
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
movups xmm2, xmmword [rbp - 0x70]
movups xmm3, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm1
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x70], xmm2
xorps xmm3, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x60], xmm3
lea rax, [rsp + 0x70]
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], r13b
jne 0x1801c316b
mov rax, qword [0x18028c3a0]
lea r14, [0x18028c388]
cmp rdi, rax
ja 0x1801c31bd
mov rbx, r14
cmp rax, 0xf
cmova rbx, qword [0x18028c388]
mov qword [0x18028c398], rdi
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1801dd380
mov byte [rbx + rdi], r13b
movabs rbx, 0xed4c2e26f4897ac6
jmp 0x1801c31cd
lea r9, [rsp + 0x70]
mov rdx, rdi
mov rcx, r14
call fcn.180003a7c
lea rcx, [rsp + 0x70]
call fcn.1801c3bc8
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1801c31e5
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.1800038d8
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1801c322c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801c3227
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3464
call fcn.180014dbc
movabs rdi, 0xb026e4ab68d438e9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0xb026e4ab04b85cc7
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rax, [rsp + 0x70]
mov r8, rsi
inc r8
cmp byte [rax + r8], r13b
jne 0x1801c326c
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1800038d8
cmp qword [0x18028c3a0], 0xf
cmova r14, qword [0x18028c388]
mov qword [0x18028c330], r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0xd1a3c4e5cbbc3a8b
mov qword [rsp + 0x40], rax
movabs rax, 0x99399348c0d69bc8
mov qword [rsp + 0x48], rax
movabs rax, 0xba36b66fc1e7863d
mov qword [rsp + 0x50], rax
movabs rax, 0xa730ca5a23daf78a
mov qword [rsp + 0x58], rax
movabs rax, 0x351dc4c96c8ebb6f
mov qword [rsp + 0x60], rax
movabs rax, 0x30f20d6c26be6f4c
mov qword [rsp + 0x68], rax
movabs rcx, 0xc35481d83d8802aa
mov qword [rsp + 0x70], rcx
movabs rcx, 0xb12f474a96fc2a9a
mov qword [rsp + 0x78], rcx
movabs rcx, 0x81d7aa90a4df59ca
mov qword [rbp - 0x80], rcx
movabs rcx, 0xc54af63ab5a2f8a1
mov qword [rbp - 0x78], rcx
movabs rcx, 0xd346db0082a3b579
mov qword [rbp - 0x70], rcx
movabs rcx, 0xc31eff627ca892e6
mov qword [rbp - 0x68], rcx
movabs rcx, 0x351dc4c96c8ed703
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
movups xmm2, xmmword [rbp - 0x70]
movups xmm3, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm1
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x70], xmm2
xorps xmm3, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x60], xmm3
lea rax, [rsp + 0x70]
inc rsi
cmp byte [rax + rsi], r13b
jne 0x1801c33a4
mov rax, qword [0x18028c380]
lea rdi, [0x18028c368]
cmp rsi, rax
ja 0x1801c33ec
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x18028c368]
mov qword [0x18028c378], rsi
mov r8, rsi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1801dd380
mov byte [rbx + rsi], r13b
jmp 0x1801c33fc
lea r9, [rsp + 0x70]
mov rdx, rsi
mov rcx, rdi
call fcn.180003a7c
cmp qword [0x18028c380], 0xf
cmova rdi, qword [0x18028c368]
mov qword [0x18028c338], rdi
mov rdx, qword [0x18028c330]
mov rcx, rdi
call fcn.1801a3080
call fcn.1801c3478
call fcn.1801c3f54
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, r12d
jmp 0x1801c3443
mov eax, 0x277a
jmp 0x1801c3443
xor eax, eax
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18019c4a8
int3
call fcn.18019c4a8
int3