Function at 0x10022923
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1005437d
call fcn.10053340
sub esp, 0xb4
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
je 0x10022c61
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp dword [eax + 0x10], ebx
je 0x10022c4b
push 0x2e
pop eax
push 2
pop edi
mov ecx, ebx
mov dword [ebp - 0x14], 0x79014d00
mov word [ebp - 0x1c], ax
mov esi, edi
mov dword [ebp - 0x20], ecx
cmp esi, edi
jne 0x10022985
mov ecx, edi
mov esi, edi
mov dword [ebp - 0x20], ecx
jmp 0x100229cb
movzx edx, byte [ebp + esi - 0x13]
mov eax, esi
sub eax, ecx
push ebx
movzx eax, byte [ebp + eax - 0x16]
movzx ecx, word [ebp + eax*2 - 0x1c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x14]
add ecx, edx
mov edx, 0x358
mov word [ebp + eax*2 - 0x1c], cx
lea eax, [ebp - 0x20]
push eax
push 0xe1
mov ecx, 0x74b1
call fcn.10022ff5
mov ecx, dword [ebp - 0x20]
add esp, 0xc
add esi, edi
cmp esi, 4
jb 0x10022978
mov dword [ebp - 0x18], 0x76ea
cmp dword [ebp - 0x18], 0x7a89
jle 0x10022a16
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1006de98
xor eax, esi
cdq
push edx
push eax
call fcn.1000bb28
inc edi
cmp edi, 0x6d89
jl 0x100229e6
inc esi
cmp esi, 0x74e
jl 0x100229e4
push 0x2681
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0x7389
mov word [ebp - 0x1a], ax
jge 0x10022a56
mov edx, str.oop_yia_hbpug_ozpimlwxu
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x10022a56
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x58], ebx
call fcn.10020a6d
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.1002154e
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.1000c8be
mov edi, dword [ebp - 0x2c]
mov eax, edi
mov esi, dword [ebp - 0x30]
sub eax, esi
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x1c], ebx
test eax, eax
jne 0x10022c3c
push 0x2d
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x24], 0x3000
mov word [ebp - 0x32], ax
mov dword [ebp - 0x38], 0x60fe
cmp dword [ebp - 0x38], 0x62c7
jle 0x10022b46
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
add eax, esi
xor eax, edi
xor eax, ecx
lea ecx, [ebp - 0xbc]
cdq
push edx
push eax
call fcn.10002543
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022b02
mov eax, dword [eax]
push eax
call fcn.1003de4c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xbc]
call fcn.1000c586
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x6b06
jl 0x10022ae4
inc esi
cmp esi, 0x4c28
jl 0x10022adf
inc edi
cmp edi, 0x29d7
jl 0x10022add
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x65d2
jl 0x10022adb
xor eax, eax
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x70], ebx
push eax
call fcn.10020a6d
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 6
call fcn.1002154e
pop ecx
mov esi, eax
lea eax, [ebp - 0x30]
cmp eax, esi
je 0x10022ba2
mov ecx, eax
call fcn.10025a2c
mov ecx, dword [esi]
mov dword [ebp - 0x30], ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [ebp - 0xa4]
call fcn.10025a2c
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.1000c8be
cmp dword [ebp - 0x38], 0x5e05
jge 0x10022bcc
push str.tegzvrad_pgu_ndu_chvo_ravvbmrsw_hmjmf_pxafivpry_zxxvedzqw_umi_hzalvxkl_oib_taaf
call fcn.1003de4c
pop ecx
mov dword [ebp - 4], 5
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
jmp 0x10022c3c
push esi
lea ecx, [ebp - 0x98]
call fcn.1000bc3d
mov byte [ebp - 4], 0xa
lea ebx, [ebp - 0x98]
cmp dword [ebp - 0x84], 8
cmovae ebx, dword [ebp - 0x98]
call fcn.1003e463
push 0xa
and dword [eax], 0
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.1003e698
add esp, 0xc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x48]
push eax
call fcn.100256db
xor ebx, ebx
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x98]
call fcn.1000c8be
add esi, 0x18
cmp esi, edi
jne 0x10022bdb
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.10025a2c
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x48]
push eax
call fcn.10025733
lea ecx, [ebp - 0x48]
call fcn.10025b05
jmp 0x10022c69
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret