Function at 0x6d8d90
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6d9610
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.006d9600
mov edx, dword [0x8775e8]
mov ecx, dword [0x8775d0]
mov esi, 0x3ccc
sub esi, eax
mov dword [ebp - 0x30], esi
sub ecx, esi
add ecx, edx
call dword [0x834360]
call ecx
xorps xmm0, xmm0
movsd qword [ebp - 0x93], xmm0
movsd qword [ebp - 0x98], xmm0
movzx ecx, byte [0x87756d]
mov dword [ebp - 0x24], eax
xor al, 0xbe
mov byte [ebp - 0x20], al
cmp cl, al
je 0x6d8e99
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor cl, 0x32
mov edx, eax
xor dl, 0x12
nop
mov eax, ecx
lock cmpxchg byte [0x87756d], dl
je 0x6d8e33
cmp al, byte [ebp - 0x20]
jne 0x6d8e20
jmp 0x6d8e99
nop
mov eax, dword [ebp - 0x24]
mov esi, eax
xor esi, 0xfa81caa6
mov edi, eax
xor edi, 0x5138fcd2
xor eax, 0x5138fcd7
cmp eax, 2
mov ebx, 1
cmovge ebx, eax
xor ecx, ecx
nop dword [eax]
lea eax, [esi + ecx]
xor edx, edx
div edi
not edx
movzx eax, byte [edi + edx + 0x7e8fc0]
xor al, byte [ebp - 0x24]
xor al, byte [ecx + 0x877560]
xor al, 0x8a
mov byte [ecx + 0x877560], al
inc ecx
cmp ebx, ecx
jne 0x6d8e60
nop
movzx eax, byte [ebp - 0x20]
xchg byte [0x87756d], al
mov dword [ebp - 0x10], 0xffffffff
nop
mov esi, dword [ebp - 0x24]
mov eax, esi
xor eax, 0x5138fcd7
mov dword [ebp - 0x10], 0xffffffff
lea edi, [ebp - 0x98]
push eax
push edi
push 0x877560
call dword [0x83414c]
xor esi, 0x5138fcd6
cmp byte [0x889b15], 0
jne 0x6d8ed5
cmp eax, esi
jne 0x6d9145
nop
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x24]
mov ebx, eax
xor ebx, 0x5138fcca
mov ecx, eax
xor ecx, 0x5138fcce
mov dword [ebp + ebx - 0x88], 0
mov esi, eax
xor esi, 0x5138fcd5
mov dword [ebp - 0x20], ecx
mov dword [ebp + ecx - 0x88], esi
mov byte [ebp - 0x88], 0
push edi
call fcn.00700090
add esp, 4
mov edi, eax
mov dword [ebp - 0x48], esi
cmp eax, esi
jbe 0x6d8f5d
nop
mov eax, dword [0x8775e4]
mov esi, dword [0x8775d8]
sub esi, dword [ebp - 0x30]
add esi, eax
mov ecx, esi
call dword [0x834360]
sub esp, 0xc
movzx eax, byte [ebp - 0x68]
mov byte [esp + 4], al
lea eax, [ebp - 0x98]
mov dword [esp + 8], eax
mov dword [esp], edi
lea ecx, [ebp - 0x88]
call esi
jmp 0x6d8f97
nop
mov dword [ebp + ebx - 0x88], edi
mov eax, dword [0x8775e0]
mov ecx, dword [0x8775d4]
sub ecx, dword [ebp - 0x30]
add ecx, eax
call dword [0x834360]
lea eax, [ebp - 0x88]
push edi
lea edx, [ebp - 0x98]
push edx
push eax
call ecx
add esp, 0xc
mov byte [ebp + edi - 0x88], 0
nop
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x40], eax
cmp eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x88]
lea esi, [ebp - 0x88]
mov dword [ebp - 0x34], eax
cmova esi, eax
mov eax, dword [ebp + ebx - 0x88]
mov dword [ebp - 0x20], eax
mov eax, dword [0x8775f8]
mov edi, dword [ebp - 0x24]
xor eax, edi
cmp eax, 0xb995c754
mov ebx, dword [0x8775f0]
jne 0x6d9017
mov eax, edi
xor eax, 0x2ec70320
mov eax, dword [ebx + eax*4]
mov edx, edi
xor edx, 0xc6
mov ecx, edi
shl ecx, 0x1e
xor ecx, edi
xor ecx, 0x524ff739
add ecx, edx
add ecx, eax
sub ecx, ebx
inc ecx
imul ecx, ebx
mov edx, eax
shl edx, cl
xor edi, edi
test cl, 0x20
cmove edi, edx
add edi, eax
mov dword [ebp - 0x58], edi
jmp 0x6d901d
nop
add ebx, dword [ebx]
mov dword [ebp - 0x58], ebx
nop
mov eax, dword [0x7e8fb0]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x8775f4]
add eax, dword [eax]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x20], 0
je 0x6d9179
mov edx, dword [ebp - 0x24]
mov eax, edx
xor al, 0xea
mov byte [ebp - 0x2c], al
mov eax, edx
xor al, 0x1c
mov byte [ebp - 0x3c], al
mov eax, edx
xor al, 0xdd
mov byte [ebp - 0x38], al
mov ah, dl
xor ah, 0x45
mov ch, dl
xor ch, 0x3c
mov dh, dl
xor dh, 0xbd
mov ebx, 1
nop word cs:[eax + eax]
nop
mov cl, byte [esi + ebx - 1]
cmp cl, byte [ebp - 0x2c]
jl 0x6d90e4
mov al, cl
add al, byte [ebp - 0x3c]
cmp al, byte [ebp - 0x38]
jb 0x6d90e4
mov al, cl
add al, ah
cmp al, ch
setb dl
cmp cl, dh
setb al
and al, dl
cmp al, 1
jne 0x6d90a2
lea edi, [ebx + 1]
cmp dword [ebp - 0x20], ebx
mov ebx, edi
jne 0x6d9070
test al, al
je 0x6d90e4
xorps xmm0, xmm0
movsd qword [ebp - 0x68], xmm0
mov dword [ebp - 0x60], 0
mov eax, dword [0x8775e0]
mov ecx, dword [0x8775d4]
sub ecx, dword [ebp - 0x30]
add ecx, eax
mov dword [ebp - 0x10], 0xffffffff
call dword [0x834360]
lea eax, [ebp - 0x68]
push dword [ebp - 0x20]
push esi
push eax
call ecx
add esp, 0xc
jmp 0x6d9188
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x48]
jbe 0x6d9145
mov eax, ecx
xor eax, 1
and ecx, 1
lea eax, [eax + ecx*2]
mov edx, dword [ebp - 0x24]
mov ecx, edx
xor ecx, 0x5138f325
cmp eax, ecx
jbe 0x6d9138
mov eax, edx
xor eax, 0xaec70326
mov esi, dword [ebp - 0x34]
lea ecx, [esi + eax]
mov esi, dword [esi + eax]
mov dword [ebp - 0x34], esi
sub ecx, esi
mov eax, edx
xor eax, 0x5138fcfa
cmp ecx, eax
jae 0x6d9511
mov eax, edx
xor eax, 0x5138fcfe
mov ecx, dword [ebp - 0x40]
add ecx, eax
mov eax, ecx
nop
push eax
push dword [ebp - 0x34]
call fcn.0071996d
add esp, 8
nop
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp - 0x24]
mov edx, ecx
xor edx, 0x5138fcde
mov dword [eax + edx], 0
mov edx, ecx
xor edx, 0x5138fcc6
mov byte [eax + edx], 0
xor ecx, 0x5138fcc7
mov byte [eax + ecx], 0
jmp 0x6d94ee
xorps xmm0, xmm0
movsd qword [ebp - 0x68], xmm0
mov dword [ebp - 0x60], 0
nop
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
mov ebx, dword [ebp - 0x24]
mov eax, ebx
xor eax, 0x5138fcde
mov dword [ebp - 0x50], eax
mov dword [ecx + eax], 0
mov edx, ecx
mov eax, dword [0x8775e0]
mov ecx, dword [0x8775d4]
sub ecx, dword [ebp - 0x30]
mov esi, ebx
xor esi, 0x5138fcc6
add ecx, eax
mov edi, ebx
xor edi, 0x5138fcc7
add edi, edx
call dword [0x834360]
lea eax, [ebp - 0x68]
push dword [ebp - 0x44]
push eax
push edi
call ecx
add esp, 0xc
mov eax, dword [ebp + 8]
mov byte [eax + esi], 1
mov ecx, dword [0x8775ec]
lea eax, [ecx + 1]
mov dword [0x8775ec], eax
mov edx, dword [0x8775fc]
xor edx, ebx
cmp edx, 0x147089e
jne 0x6d9221
nop
mov dword [0x8775f8], 0xf38ba5a5
mov dword [ebp - 0x4c], 0
test eax, ecx
je 0x6d923e
mov al, 1
mov dword [ebp - 0x20], eax
xor edi, edi
jmp 0x6d940e
mov edx, ecx
not edx
mov esi, 0xfffffffe
sub esi, ecx
and esi, edx
xor eax, ecx
or eax, esi
mov dword [ebp - 0x4c], 1
cmp eax, 0xffffffff
jne 0x6d9215
nop
mov eax, dword [ebp - 0x54]
mov ebx, dword [eax]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x5c], 0
jle 0x6d921a
add ebx, eax
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor ecx, 0xaec70321
mov dword [ebp - 0x70], ecx
mov ecx, eax
xor cl, 0xd9
mov byte [ebp - 0x25], cl
dec dword [ebp - 0x50]
xor eax, 0x7a67a581
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
jmp 0x6d92a9
mov ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
xor al, byte [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
inc eax
cmp eax, dword [ebp - 0x5c]
jge 0x6d9404
mov edx, eax
mov eax, dword [0x877600]
xor eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x20], edx
lea edi, [ecx + edx]
cmp eax, 0x8e94d1bc
jne 0x6d92e0
mov eax, ebx
sub eax, edi
mov ecx, dword [ebp - 0x38]
sbb ecx, 0
cmp eax, 1
sbb ecx, 0
movzx ecx, byte [edi]
mov byte [ebp - 0x2c], cl
jge 0x6d9293
mov dh, al
jmp 0x6d932b
mov ecx, edi
sub ecx, ebx
mov edx, dword [ebp - 0x38]
mov eax, edx
shld eax, ebx, cl
mov esi, ebx
shl esi, cl
test cl, 0x20
cmovne eax, esi
mov ecx, 0
cmovne esi, ecx
mov dword [ebp - 0x44], ebx
sub ebx, esi
sbb edx, eax
xor ebx, 1
or ebx, edx
mov dword [0x877600], 0xea3bc8b6
mov eax, dword [ebp - 0x70]
movzx eax, byte [edi + eax]
mov byte [ebp - 0x2c], al
jne 0x6d9290
mov dh, 1
mov eax, 1
nop
mov esi, dword [0x877604]
xor esi, dword [ebp - 0x24]
cmp esi, 0x1cdcaea7
jne 0x6d93c0
nop
movzx ecx, byte [ebp - 0x25]
sub cl, dh
mov dl, cl
sub dl, dh
shl dl, cl
mov eax, edx
mul dl
mov ecx, eax
inc cl
mul cl
mov dh, al
mov ecx, edx
shl dh, cl
shl dh, cl
mov eax, dword [ebp - 0x30]
shl eax, 2
mov esi, 1
sub esi, eax
mov al, dh
mov edi, esi
mov ecx, dword [ebp - 0x6c]
shl edi, cl
not al
movzx ecx, byte [ebp - 0x2c]
add cl, al
mov al, dh
mul dh
mul cl
and al, dh
mov byte [ebp - 0x2c], al
mov eax, esi
sub eax, edi
imul eax, edi
sub esi, eax
mov edx, 3
sub edx, dword [ebp - 0x20]
lea ecx, [eax + 1]
imul ecx, esi
sub ecx, eax
imul ecx, eax
mov dword [0x877604], 0xa22095eb
nop
mov dword [ebp - 0x20], edx
jmp 0x6d93eb
nop
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x50]
add ecx, eax
mov dword [ebp - 0x20], ecx
movzx ecx, byte [ebp - 0x25]
shl dh, cl
mov al, 0xff
mov cl, dh
shl al, cl
not al
and byte [ebp - 0x2c], al
mov dword [0x8775f8], 0x815d7b6e
mov ecx, dword [ebp - 0x30]
inc ecx
nop
mov eax, dword [ebp - 0x54]
lea ebx, [eax + ecx*4]
mov dword [ebp - 0x30], ecx
add ebx, dword [eax + ecx*4]
mov dword [ebp - 0x38], 0
jmp 0x6d9293
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x3c]
nop
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x48]
jbe 0x6d94ea
mov esi, dword [ebp - 0x4c]
add esi, eax
mov ebx, dword [ebp - 0x24]
mov eax, ebx
xor eax, 0x5138f325
cmp esi, eax
jbe 0x6d94ab
mov ecx, ebx
xor ecx, 0xaec70326
mov esi, dword [ebp - 0x34]
mov eax, dword [esi + ecx]
mov edx, esi
xor edx, ecx
mov dword [0x8775fc], 0x361268fd
and ecx, esi
lea ecx, [edx + ecx*2]
mov dword [ebp - 0x2c], eax
sub ecx, eax
mov edx, ebx
xor edx, 0x5138fcfa
cmp ecx, edx
jae 0x6d9504
mov ecx, ebx
xor ecx, 0x5138fcfe
mov edx, dword [0x877608]
xor edx, ebx
cmp edx, 0x7f9dca85
movzx edx, byte [0x7e8fac]
jne 0x6d94b0
nop
mov dword [0x8775fc], 0xa29c31b
mov dword [0x877604], 0x3b93de55
movzx edx, byte [0x889b15]
mov dword [0x877604], 0x77983be1
jmp 0x6d94cc
mov eax, dword [ebp - 0x34]
jmp 0x6d94df
mov dh, bl
xor dh, 0xfd
xor bl, 2
add bl, dh
add bl, byte [ebp - 0x20]
mov eax, edi
sub dl, al
test dl, bl
setne dl
or dl, byte [0x889b15]
nop
mov esi, dword [ebp - 0x40]
add esi, ecx
and dl, 1
mov byte [0x889b15], dl
nop
mov eax, dword [ebp - 0x2c]
nop
push esi
push eax
call fcn.0071996d
add esp, 8
nop
mov eax, dword [ebp + 8]
nop
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
nop
mov dword [ebp - 0x10], 0
call fcn.006fce21
nop
mov dword [ebp - 0x10], 1
call fcn.006fce21
nop
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.007311e0
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
call fcn.007311e0
int3