Function at 0x1800049e0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1138
call fcn.18004a520
sub rsp, rax
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x10a0], xmm15
movdqa xmmword [rbp + 0x1090], xmm14
movdqa xmmword [rbp + 0x1080], xmm13
movdqa xmmword [rbp + 0x1070], xmm12
movdqa xmmword [rbp + 0x1060], xmm11
movdqa xmmword [rbp + 0x1050], xmm10
movdqa xmmword [rbp + 0x1040], xmm9
movdqa xmmword [rbp + 0x1030], xmm8
movdqa xmmword [rbp + 0x1020], xmm7
movdqa xmmword [rbp + 0x1010], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov r15, rcx
mov rdi, qword [0x18005f470]
cmp byte [0x180060c5e], 0
movabs rbx, 0x194076abf508bc97
jne 0x180004c92
movabs rax, 0x194076abf508bca1
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc91
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c56], al
movabs rax, 0x194076abf508bca2
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc92
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c57], al
movabs rax, 0x194076abf508bca3
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc93
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c58], al
movabs rax, 0x194076abf508bca4
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc94
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c59], al
movabs rax, 0x194076abf508bca5
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc95
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c5a], al
movabs rax, 0x194076abf508bca6
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc96
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c5b], al
movabs rax, 0x194076abf508bca7
movzx eax, byte [rdi + rax]
movzx ecx, byte [rdi + rbx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c5c], al
movabs rax, 0x194076abf508bca8
movzx eax, byte [rdi + rax]
movabs rcx, 0x194076abf508bc98
movzx ecx, byte [rdi + rcx]
not al
mov edx, ecx
and dl, al
or al, cl
mov ecx, edx
xor cl, 0xaf
mov r8d, eax
xor r8b, 0x50
xor dl, 0x50
and dl, r8b
xor al, 0xaf
and al, cl
or al, dl
mov byte [0x180060c5d], al
mov byte [0x180060c5e], 1
lea rcx, [0x180060c56]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
cmp byte [0x180060c6c], 0
mov qword [rbp + 0xfd8], rax
jne 0x180004e15
mov qword [rbp + 0xad8], r15
movabs rax, 0x194076abf508bcc7
add rax, rdi
movabs rcx, 0x194076abf508bcd8
mov qword [rbp + 0xfb8], rdi
add rcx, rdi
xor edx, edx
lea r8, [0x180060c5f]
nop word [rax + rax]
movzx ebx, byte [rcx + rdx]
mov r11d, ebx
not r11b
movzx r12d, byte [rax + rdx]
mov r9d, r12d
not r9b
mov r13d, ebx
or r13b, 0xbd
mov r10d, r13d
not r10b
and r11b, 0x42
xor bl, 0xbd
or bl, r11b
mov esi, r12d
and sil, 0xbd
mov r15d, r9d
and r15b, 0x42
mov r11d, ebx
not r11b
and r11b, r10b
and r13b, 0xec
and r10b, 2
or r10b, r13b
xor r10b, bl
mov ebx, r12d
xor bl, 2
and bl, r15b
mov r14d, r12d
and r14b, 0x95
mov r13d, r12d
xor r13b, 0x95
and r13b, sil
and r12b, 0x40
xor bl, r12b
lea edi, [rbx - 0x6b]
xor r14b, r13b
and r13b, 0x95
xor r14b, 0xd5
or r13b, r14b
xor bl, 0x68
and bl, r14b
not r13b
and r13b, dil
or r13b, bl
and r9b, 2
or r9b, r12b
or r9b, 0x19
or r15b, sil
xor r9b, sil
xor r9b, 0xa6
and r9b, r15b
or r9b, r13b
mov ebx, r10d
and bl, 0x46
xor bl, 2
and r10b, 0xb9
or r10b, r11b
or r10b, bl
mov r11d, r10d
xor r11b, 0x57
mov ebx, r9d
and bl, 0x46
or bl, 9
and r9b, 0xb9
xor r9b, bl
mov ebx, r9d
xor bl, 0x4f
xor r10b, 0xa8
and r10b, bl
xor r9b, 0xb0
and r9b, r11b
or r9b, r10b
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0xd
jne 0x180004cf0
mov byte [0x180060c6c], 1
mov r15, qword [rbp + 0xad8]
mov rsi, qword [rbp + 0xfd8]
mov rdi, qword [rbp + 0xfb8]
movabs rbx, 0x194076abf508bc97
lea rcx, [0x180060c5f]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, qword [0x18005f488]
add rbx, rcx
movabs rdx, 0x194076abf508bb3f
add rdx, rcx
test rsi, rsi
cmovne rdx, rbx
movabs r8, 0xd2104f9f76d659e2
mov rdx, qword [rdx]
add rdx, r8
jmp rdx