Function at 0x1400ce10c
Capabilities:
Encode data using xor
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xa08]
sub rsp, 0xb00
xor ebx, ebx
cmp dword [0x14049d6cc], ebx
mov esi, ebx
je 0x1400ce142
lea eax, [rbx + 1]
jmp 0x1400ce5d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
lea rdi, [rbp - 0x30]
mov ecx, 0x410
lea rdx, [rbp - 0x30]
rep stosb byte [rdi], al
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1400ce5a0
lea rdx, [0x14042d7a0]
lea rcx, [rbp - 0x30]
call fcn.1400ced2c
lea rdi, [rbp - 0x30]
cmp word [rbp - 0x30], bx
je 0x1400ce196
add rdi, 2
cmp word [rdi], bx
jne 0x1400ce18d
lea rdx, str.dbghelp.dll
mov rcx, rdi
call fcn.1400ced2c
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14049d6d8], rax
test rax, rax
je 0x1400ce5a0
lea rcx, str.symsrv.dll
mov eax, reloc.WS2_32.dll_WSAStartup
sub rcx, rdi
mov word [rdi], ax
lea rdi, [rdi + 2]
movzx eax, word [rcx + rdi]
test ax, ax
jne 0x1400ce1ce
lea rcx, [rbp - 0x30]
mov word [rdi], bx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14049d6d0], rax
test rax, rax
je 0x1400ce5a0
cmp byte [0x14042e785], bl
mov r14d, 0x5397829d
mov eax, dword [0x14042e780]
movsd xmm0, qword [str.gL_d_MuKHTQQ3A]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14042e784]
mov word [rsp + 0x3c], ax
movsd qword [rsp + 0x30], xmm0
je 0x1400ce256
mov edi, ebx
lea r8, [rsp + 0x30]
mov eax, r14d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0xe
jl 0x1400ce234
mov rcx, qword [0x14049d6d8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsd xmm0, qword [str.gL_VPNR_QWE_]
lea r8, [rsp + 0x20]
mov qword [0x14049ce88], rax
mov edi, ebx
mov eax, dword [0x14042e760]
mov dword [rsp + 0x28], eax
movzx eax, word [0x14042e764]
mov word [rsp + 0x2c], ax
mov al, byte [0x14042e766]
mov byte [rsp + 0x2e], al
movsd qword [rsp + 0x20], xmm0
mov eax, r14d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0xf
jl 0x1400ce2a4
mov rcx, qword [0x14049d6d8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movups xmm0, xmmword [str.gL_WXvSYKS_]
mov qword [0x14049ce80], rax
lea r8, [rsp + 0x3e]
mov al, byte [0x14042e7a8]
mov edi, ebx
movups xmmword [rsp + 0x3e], xmm0
mov byte [rsp + 0x4e], al
mov eax, r14d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0x11
jl 0x1400ce2fc
mov rcx, qword [0x14049d6d8]
lea rdx, [rsp + 0x3e]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14042e793], bl
movsd xmm0, qword [str.gL_qJVWu_P__]
mov qword [0x14049ce70], rax
mov eax, dword [0x14042e790]
mov dword [rsp + 0x38], eax
movsd qword [rsp + 0x30], xmm0
je 0x1400ce380
mov edi, ebx
lea r8, [rsp + 0x30]
mov eax, r14d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0xc
jl 0x1400ce35e
mov rcx, qword [0x14049d6d8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x14049ce88]
mov qword [0x14049ce78], rax
test rdx, rdx
je 0x1400ce5a0
cmp qword [0x14049ce80], rbx
je 0x1400ce5a0
cmp qword [0x14049ce70], rbx
je 0x1400ce5a0
test rax, rax
je 0x1400ce5a0
mov ecx, 0x10603
call rdx
movsd xmm0, qword [0x14042e768]
lea rdi, [rbp + 0x5f0]
xor eax, eax
movsd qword [rsp + 0x20], xmm0
mov ecx, 0x410
lea r8, [rsp + 0x20]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x3e0]
mov ecx, 0x20a
rep stosb byte [rdi], al
mov eax, dword [0x14042e770]
mov edi, ebx
mov dword [rsp + 0x28], eax
movzx eax, word [0x14042e774]
mov word [rsp + 0x2c], ax
mov eax, r14d
mul edi
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, di
inc edi
sub ax, cx
add ax, 0x34
xor word [r8], ax
lea r8, [r8 + 2]
cmp edi, 7
jl 0x1400ce41c
mov r8d, 0x104
lea rdx, [rbp + 0x3e0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400ce5a0
cmp eax, 0x104
jae 0x1400ce5a0
movaps xmm0, xmmword [0x14042e7d0]
lea r8, [rsp + 0x58]
movaps xmm1, xmmword [0x14042e7e0]
mov edi, ebx
movups xmmword [rsp + 0x58], xmm0
movaps xmm0, xmmword [0x14042e7f0]
movups xmmword [rsp + 0x78], xmm0
movaps xmm0, xmmword [0x14042e810]
movups xmmword [rbp - 0x68], xmm0
movaps xmm0, xmmword [0x14042e830]
movups xmmword [rsp + 0x68], xmm1
movaps xmm1, xmmword [0x14042e800]
movups xmmword [rbp - 0x48], xmm0
movsd xmm0, qword [0x14042e840]
movups xmmword [rbp - 0x78], xmm1
movaps xmm1, xmmword [0x14042e820]
movsd qword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x58], xmm1
mov eax, r14d
mul edi
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, di
inc edi
sub ax, cx
add ax, 0x34
xor word [r8], ax
lea r8, [r8 + 2]
cmp edi, 0x3c
jl 0x1400ce4d2
lea r9, [rbp + 0x3e0]
mov edx, 0x208
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x5f0]
call fcn.1400c7e14
xor r8d, r8d
lea rdx, [rbp + 0x5f0]
or rcx, 0xffffffffffffffff
call qword [0x14049ce80]
mov esi, eax
test eax, eax
je 0x1400ce59a
cmp byte [0x14042e7c9], bl
movups xmm0, xmmword [0x14042e7b0]
movzx ecx, word [0x14042e7c8]
mov word [rsp + 0x56], cx
movups xmmword [rsp + 0x3e], xmm0
movsd xmm0, qword [0x14042e7c0]
movsd qword [rsp + 0x4e], xmm0
je 0x1400ce583
lea rdi, [rsp + 0x3e]
mov eax, r14d
mul ebx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
mov al, bl
inc ebx
sub al, dl
add al, 0x34
xor byte [rdi], al
inc rdi
cmp ebx, 0x1a
jl 0x1400ce563
lea rdx, [rsp + 0x3e]
mov ecx, 2
call fcn.1400c963c
mov dword [0x14049d6cc], esi
jmp 0x1400ce5d2
mov dword [0x14049d6cc], esi
mov rcx, qword [0x14049d6d8]
test rcx, rcx
je 0x1400ce5b9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14049d6d8], rbx
mov rcx, qword [0x14049d6d0]
test rcx, rcx
je 0x1400ce5d2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14049d6d0], rbx
mov eax, esi
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret