Function at 0x180005b60
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3f8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x360], xmm6
mov qword [rbp + 0x340], 0xfffffffffffffffe
mov rdi, qword [0x1800464e0]
cmp byte [0x180047884], 0
jne 0x180005d41
movabs rax, 0x4488015ab84193ec
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193db
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x18004787c], al
movabs rax, 0x4488015ab84193ed
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193dc
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x18004787d], al
movabs rax, 0x4488015ab84193ee
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193dd
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x18004787e], al
movabs rax, 0x4488015ab84193ef
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193de
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x18004787f], al
movabs rax, 0x4488015ab84193f0
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193df
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x180047880], al
movabs rax, 0x4488015ab84193f1
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193e0
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x180047881], al
movabs rax, 0x4488015ab84193f2
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193e1
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x180047882], al
movabs rax, 0x4488015ab84193f3
movzx eax, byte [rdi + rax]
movabs rcx, 0x4488015ab84193e2
movzx ecx, byte [rdi + rcx]
mov edx, ecx
xor dl, 0xe3
xor cl, al
xor al, 0x1c
and cl, dl
or al, dl
not al
or al, cl
mov byte [0x180047883], al
mov byte [0x180047884], 1
lea rcx, [0x18004787c]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
cmp byte [0x180047892], 0
jne 0x180005e02
movabs rax, 0x4488015ab8419405
add rax, rdi
movabs rcx, 0x4488015ab8419416
add rcx, rdi
xor edx, edx
lea r8, [0x180047885]
nop word cs:[rax + rax]
movzx r10d, byte [rcx + rdx]
movzx r9d, byte [rax + rdx]
mov esi, r10d
not sil
and sil, r9b
mov r11d, r9d
not r11b
and r11b, r10b
mov r14d, r11d
not r14b
mov r15d, r14d
and r15b, 0x40
mov r12d, r11d
and r12b, 0x82
mov r13d, r11d
and r13b, 0x2d
or r12b, 0x29
xor r12b, r13b
and r11b, 0x10
or r11b, r15b
or r11b, r12b
xor r11b, sil
xor r11b, 0x69
xor r14b, sil
xor r9b, r10b
or r9b, r14b
not r9b
or r9b, r11b
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0xd
jne 0x180005d90
mov byte [0x180047892], 1
lea rcx, [0x180047885]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, qword [0x1800464f8]
movabs rdx, 0x4488015ab84190f5
add rdx, rcx
movabs r8, 0x4488015ab8419155
add r8, rcx
test rbx, rbx
cmovne r8, rdx
mov r12, rax
movabs rdx, 0xd38c46189ec47419
mov rax, qword [r8]
add rax, rdx
jmp rax