Function at 0x479620
Capabilities:
Encode data using xor
Set environment variable

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], rbp
mov rax, qword [0x00489b10]
mov byte [rax], 1
nop
lea rcx, [0x00473138]
call fcn.0040f700
nop
mov rax, qword [0x00489960]
mov qword [rax], 0
mov rax, qword [0x00489800]
mov byte [rax], 0
mov rax, qword [0x004894f8]
mov byte [rax], 1
mov cl, 1
call fcn.00404d90
mov rax, qword [0x00489860]
mov rcx, qword [0x004898e0]
movzx rcx, word [rcx]
mov qword [rax], rcx
xor rcx, rcx
call fcn.0042a150
mov rcx, qword [0x00489670]
mov rdx, qword [0x004299f0]
mov r8d, 1
xor r9, r9
call fcn.0040cc30
mov rcx, qword [0x00489b50]
mov rdx, qword [0x00429a30]
mov r8d, 1
xor r9, r9
call fcn.0040cc30
mov rcx, qword [0x00472820]
mov dl, 1
call fcn.00472b40
mov qword [0x004a7838], rax
mov rcx, qword [0x004a7838]
lea rdx, [0x00479c9c]
call fcn.00472c50
test al, al
je 0x479746
mov rax, qword [0x004a7838]
mov rcx, qword [rax + 0x58]
lea rdx, [0x004a7840]
mov rax, qword [0x004a7838]
movsxd r8, dword [rax + 0x60]
call fcn.00405640
mov rcx, qword [0x004a7838]
call fcn.00472c30
mov rax, qword [0x00489bc0]
mov ecx, dword [0x004a784c]
mov dword [rax], ecx
mov rcx, qword [0x004a7838]
lea rdx, [0x00479cb0]
call fcn.00472c50
test al, al
je 0x479bf0
lea rcx, [rbp + 0x60]
call fcn.00429bb0
mov rcx, qword [rbp + 0x60]
call fcn.0040b6c0
mov qword [0x004a7830], rax
mov rcx, qword [0x004a7830]
mov edx, 0x8000
call fcn.0043d350
mov dword [0x004a7828], eax
mov rcx, qword [0x004a7830]
call fcn.0040aa60
mov dword [0x004a7818], eax
mov rax, qword [0x00489670]
mov rcx, qword [rax]
call fcn.0040c890
mov dword [0x004a781c], eax
mov rcx, qword [0x00489670]
mov rdx, qword [0x004299f0]
mov r8d, 1
mov r9d, dword [0x004a781c]
add r9d, 1
movsxd r9, r9d
call fcn.0040cc30
mov ecx, dword [0x004a7818]
lea rcx, [rcx + rcx*2]
movsxd rcx, ecx
call fcn.00405270
mov rcx, qword [0x00489670]
mov rcx, qword [rcx]
movsxd rdx, dword [0x004a781c]
add rdx, rdx
lea rdx, [rdx + rdx*2]
mov qword [rcx + rdx*8], rax
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
mov rcx, qword [rax + rcx*8]
mov rdx, qword [0x004a7830]
call fcn.0041d9e0
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
mov edx, dword [0x004a7828]
mov dword [rax + rcx*8 + 8], edx
mov ecx, dword [0x004a7828]
call sub.msvcrt.dll__get_osfhandle
mov rcx, qword [0x00489670]
mov rcx, qword [rcx]
movsxd rdx, dword [0x004a781c]
add rdx, rdx
lea rdx, [rdx + rdx*2]
mov qword [rcx + rdx*8 + 0x10], rax
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
mov rdx, qword [0x004a7838]
mov edx, dword [rdx + 0x60]
mov dword [rax + rcx*8 + 0x18], edx
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
movsxd rcx, dword [rax + rcx*8 + 0x18]
call fcn.00405270
mov rcx, qword [0x00489670]
mov rcx, qword [rcx]
movsxd rdx, dword [0x004a781c]
add rdx, rdx
lea rdx, [rdx + rdx*2]
mov qword [rcx + rdx*8 + 0x20], rax
mov rax, qword [0x004a7838]
mov rcx, qword [rax + 0x58]
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rdx, dword [0x004a781c]
add rdx, rdx
lea rdx, [rdx + rdx*2]
mov rdx, qword [rax + rdx*8 + 0x20]
mov rax, qword [0x004a7838]
movsxd r8, dword [rax + 0x60]
call fcn.00405640
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
mov rax, qword [rax + rcx*8 + 0x20]
mov qword [0x004a7820], rax
xor rax, rax
mov rcx, qword [0x004a7838]
mov ecx, dword [rcx + 0x60]
sub ecx, 1
mov dword [0x004a7814], eax
cmp dword [0x004a7814], ecx
jg 0x479993
add ecx, 1
mov rax, qword [0x004a7820]
xor byte [rax], 0xff
add qword [0x004a7820], 1
add dword [0x004a7814], 1
cmp dword [0x004a7814], ecx
jne 0x479972
nop
mov rax, qword [0x00489670]
mov rax, qword [rax]
movsxd rcx, dword [0x004a781c]
add rcx, rcx
lea rcx, [rcx + rcx*2]
mov dword [rax + rcx*8 + 0x28], 0
mov rcx, qword [0x004a7838]
call fcn.00407520
lea rcx, [rbp + 0x58]
mov edx, dword [0x004a7848]
call fcn.00472fb0
call sub.kernel32.dll_GetTickCount_1
lea rcx, [rbp + 0x50]
mov edx, eax
mov r8d, 6
call fcn.0041ce50
mov ecx, 0xff
call fcn.00405990
lea rcx, [rbp + 0x48]
mov edx, eax
mov r8d, 2
call fcn.0041ce30
mov rcx, qword [0x00489bd0]
mov edx, 5
mov r8, qword [rbp + 0x58]
lea r9, [0x00479cc4]
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [0x00479cd8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x30], rax
call fcn.0040bb80
mov rax, qword [0x00489bd0]
mov rcx, qword [rax]
call fcn.0041d940
mov rax, qword [0x00489bd0]
mov rcx, qword [rax]
call fcn.0040b6c0
lea rcx, [0x00479cdc]
mov rdx, rax
call sub.kernel32.dll_SetEnvironmentVariableW
mov rax, qword [0x00489858]
mov qword [rax], 0
nop
lea rcx, [rbp + 0x40]
xor rdx, rdx
call fcn.004058f0
mov rcx, qword [0x0046e778]
mov dl, 1
mov r8, qword [rbp + 0x40]
xor r9, r9
mov dword [rsp + 0x20], 0
call fcn.0046fb20
mov rcx, qword [0x00489858]
mov qword [rcx], rax
mov rax, qword [0x00489858]
mov rcx, qword [rax]
mov rax, qword [0x00489bd0]
mov rdx, qword [rax]
call fcn.00470620
jmp 0x479af0
call fcn.00471050
mov rcx, qword [0x00489ab0]
mov qword [rcx], rax
mov rax, qword [0x00489ab0]
cmp qword [rax], 0
je 0x479bfc
mov rcx, qword [0x00489af8]
call fcn.00429770
test eax, eax
je 0x479b43
mov rax, qword [0x004897d8]
cmp byte [rax], 0
je 0x479b38
mov rax, qword [0x00489800]
mov byte [rax], 1
jmp 0x479b43
mov ecx, 0xff
call fcn.004722f0
mov rax, qword [0x00489800]
cmp byte [rax], 0
jne 0x479bfc
mov ecx, 1
mov rax, qword [0x00489ab0]
mov edx, dword [rax]
mov rax, qword [0x00489718]
mov r8d, dword [rax]
call fcn.0042b020
mov rcx, qword [0x00489b68]
mov qword [rcx], rax
mov rax, qword [0x00489b68]
cmp qword [rax], 1
jne 0x479b93
mov ecx, 1
call fcn.004722f0
mov rax, qword [0x00489b68]
cmp qword [rax], 0xffffffffffffffff
jne 0x479ba8
xor rcx, rcx
call fcn.004722f0
xor rcx, rcx
mov rax, qword [0x00489b68]
mov rdx, qword [rax]
call fcn.004397d0
mov rcx, qword [0x00489508]
mov word [rcx], ax
call fcn.0043e180
mov rax, qword [0x004897d8]
cmp byte [rax], 0
jne 0x479be4
mov rax, qword [0x00489508]
movzx ecx, word [rax]
call fcn.004722f0
mov rax, qword [0x004897d8]
mov byte [rax], 0
jmp 0x479bfc
mov rcx, qword [0x004a7838]
call fcn.00407520
xor rcx, rcx
call fcn.004722f0
mov rax, qword [0x004893c0]
mov dword [rax], 0
nop
lea rcx, [rbp + 0x40]
mov edx, 5
call fcn.0040a350
call fcn.00409ea0
jmp 0x479c30
lea rsp, [rbp + 0x80]
pop rbp
ret