Function at 0x1400239b4
Capabilities:
Encode data using xor
Query environment variable
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebp, ebp
cmp qword [rcx + 0x50], 0xffffffffffffffff
mov rdi, rcx
mov ebx, ebp
mov esi, 0x80004005
jne 0x140023bc6
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, ebp
ja 0x140023a0a
lea eax, [rbp + 1]
jmp 0x140023bd8
lea rcx, [rsp + 0x92]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x90]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jne 0x140023a47
mov ebx, esi
jmp 0x140023a78
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x90]
lea edx, [r9 + 1]
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], 3
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x48], rax
mov rcx, qword [rdi + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x140023bba
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
lea r8d, [r9 + 2]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rdi + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x140023bb1
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x58], rax
cmp rax, rbp
je 0x140023bba
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x34]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x48]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edx, dword [rsp + 0x64]
mov dword [rdi + 0x60], edx
cmp dword [rsp + 0x54], ebp
jne 0x140023b08
lea rax, [rsp + 0x44]
cmp dword [rsp + 0x58], ebp
je 0x140023b0d
lea rax, [rsp + 0x54]
mov rax, qword [rax]
cmp edx, 0x10
mov qword [rdi + 0x40], rax
mov eax, 0x80070018
cmovbe ebx, eax
cmp ebx, ebp
jl 0x140023bbe
mov rax, qword [rdi + 0x58]
lea rcx, [rax + 0x10]
cmp rax, rbp
jne 0x140023b37
mov rcx, rbp
xor r8d, r8d
add edx, 0xfffffff0
mov qword [rsp + 0x78], r8
mov r9, r8
mov qword [rsp + 0x80], r8
cmp rcx, rbp
je 0x140023baa
cmp edx, ebp
jbe 0x140023baa
shr edx, 3
cmp edx, ebp
jbe 0x140023b7d
mov r10d, edx
xor r8, qword [rcx]
add r9, qword [rcx]
add rcx, 8
sub r10, 1
jne 0x140023b60
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x78]
mov ebx, ebp
mov rdx, qword [rcx]
cmp rdx, qword [rax]
jne 0x140023b9a
mov rdx, qword [rcx + 8]
cmp rdx, qword [rax + 8]
jne 0x140023b9a
mov eax, ebp
jmp 0x140023b9f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x140023bc6
mov ebx, 0x80070017
jmp 0x140023bba
mov ebx, 0x80070057
jmp 0x140023bbe
cmp ebx, ebp
jl 0x140023bbe
mov ebx, 0x80070002
cmp ebx, ebp
jge 0x140023bc6
mov rcx, rdi
call fcn.1400238e4
cmp qword [rdi + 0x50], 0xffffffffffffffff
je 0x140023bd1
xor eax, eax
jmp 0x140023bd8
cmp ebx, ebp
cmovl esi, ebx
mov eax, esi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14003a6d0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret