Function at 0x180004550
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x758
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x6c0], xmm15
movdqa xmmword [rbp + 0x6b0], xmm14
movdqa xmmword [rbp + 0x6a0], xmm13
movdqa xmmword [rbp + 0x690], xmm12
movdqa xmmword [rbp + 0x680], xmm11
movdqa xmmword [rbp + 0x670], xmm10
movdqa xmmword [rbp + 0x660], xmm9
movdqa xmmword [rbp + 0x650], xmm8
movdqa xmmword [rbp + 0x640], xmm7
movdqa xmmword [rbp + 0x630], xmm6
mov qword [rbp + 0x608], 0xfffffffffffffffe
mov rsi, qword [0x18004d560]
cmp byte [0x18004ec3e], 0
jne 0x1800046f1
movabs rax, 0x917af8d45bc5af68
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af7d
xor al, byte [rsi + rcx]
mov byte [0x18004ec36], al
movabs rax, 0x917af8d45bc5af69
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af7e
xor al, byte [rsi + rcx]
mov byte [0x18004ec37], al
movabs rax, 0x917af8d45bc5af6a
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af7f
xor al, byte [rsi + rcx]
mov byte [0x18004ec38], al
movabs rax, 0x917af8d45bc5af6b
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af80
xor al, byte [rsi + rcx]
mov byte [0x18004ec39], al
movabs rax, 0x917af8d45bc5af6c
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af81
xor al, byte [rsi + rcx]
mov byte [0x18004ec3a], al
movabs rax, 0x917af8d45bc5af6d
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af82
xor al, byte [rsi + rcx]
mov byte [0x18004ec3b], al
movabs rax, 0x917af8d45bc5af6e
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af83
xor al, byte [rsi + rcx]
mov byte [0x18004ec3c], al
movabs rax, 0x917af8d45bc5af6f
movzx eax, byte [rsi + rax]
movabs rcx, 0x917af8d45bc5af84
xor al, byte [rsi + rcx]
mov byte [0x18004ec3d], al
mov byte [0x18004ec3e], 1
lea rcx, [0x18004ec36]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
cmp byte [0x18004ec4c], 0
jne 0x18000484d
mov qword [rbp + 0x5f0], rbx
movabs rax, 0x917af8d45bc5af95
add rax, rsi
mov qword [rbp + 0x5f8], rax
movabs rcx, 0x917af8d45bc5afa9
mov qword [rbp + 0x508], rsi
add rcx, rsi
xor edx, edx
nop
movzx esi, byte [rcx + rdx]
mov ebx, esi
not bl
mov rax, qword [rbp + 0x5f8]
movzx r9d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov eax, ebx
and al, 0x38
mov r14d, ebx
or r14b, 0x38
mov r12d, r14d
and r12b, 0x5f
mov r10d, esi
and r10b, 0x80
or r10b, r12b
mov edi, esi
xor dil, 8
and dil, al
mov r8d, r10d
xor r8b, 0x5f
mov r12d, esi
and r12b, 0x30
mov r13d, r8d
and r13b, 2
mov r15d, r14d
and r15b, 0x60
or r15b, r13b
and r14b, 0x84
mov r13d, esi
and r13b, 1
or r13b, r14b
or r15b, 0x84
or r13b, 0x12
or r12b, 0x42
xor r12b, dil
xor r12b, r13b
xor r12b, r15b
and bl, 0x18
and sil, 0x20
or sil, bl
mov ebx, r8d
and bl, 1
and r10b, 0xc6
or r10b, sil
or r10b, bl
or r8b, al
xor r10b, 0x99
and r10b, r8b
or r10b, r12b
mov eax, r11d
and al, 1
mov r8d, r9d
or r8b, 0x40
or r11b, 2
xor r11b, r8b
and r11b, 0x42
and r9b, 0xbc
or r9b, al
or r9b, r11b
mov eax, r9d
xor al, 0xc4
or al, r10b
xor r9b, r10b
xor r9b, 0x3b
and r9b, r10b
not al
or al, r9b
lea r8, [0x18004ec3f]
mov byte [rdx + r8], al
inc rdx
cmp rdx, 0xd
jne 0x180004740
mov byte [0x18004ec4c], 1
mov rbx, qword [rbp + 0x5f0]
mov rsi, qword [rbp + 0x508]
lea rcx, [0x18004ec3f]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rbx, rbx
mov ecx, 0xd0
cmove rcx, rbx
movabs rdx, 0x917af8d45bc5ac17
mov r8, qword [0x18004d578]
add r8, rdx
movabs rdx, 0x98c43fbea3abaa7d
mov rcx, qword [rcx + r8]
add rcx, rdx
jmp rcx