Function at 0x18f88b4b40
Capabilities:
Contain obfuscated stackstrings
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rdi, rcx
mov dl, 0x4d
mov dword [rbp + 0x6f], 0x36354d
xor esi, esi
mov eax, esi
add dl, al
xor byte [rbp + rax + 0x70], dl
inc rax
cmp rax, 2
jae 0x18f88b4b83
mov dl, byte [rbp + 0x6f]
jmp 0x18f88b4b6f
mov byte [rbp + 0x72], sil
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x27]
call fcn.18f88bba44
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18f88b4ba1
mov rbx, qword [rax]
movdqa xmm0, xmmword [0x18f88de190]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x82756b76
mov dword [rbp + 0x1b], 0x706a7c5e
mov dword [rbp + 0x1f], 0x7078556e
mov byte [rbp + 0x23], sil
mov rax, rsi
add byte [rbp + rax + 7], 0xf7
inc rax
cmp rax, 0x1c
jb 0x18f88b4bca
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.18f88bba44
cmp qword [rax + 0x18], 0x10
jb 0x18f88b4bef
mov rax, qword [rax]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov r14d, 0x1000
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x18f88b4c38
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, r14
jb 0x18f88b4c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b4ff5
call fcn.18f88bd1e0
movdqa xmm0, xmmword [0x18f88de170]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], sil
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x18f88b4c80
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, r14
jb 0x18f88b4c7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b4ffb
call fcn.18f88bd1e0
mov rdx, rdi
lea rcx, [0x18f88e5410]
call fcn.18f88b3238
test eax, eax
je 0x18f88b4e21
mov rbx, qword [rdi + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rsi
mov dword [rbp - 0x39], 0x7a0057
mov dword [rbp - 0x35], 0x6f006c
mov dword [rbp - 0x31], 0x6f0070
mov dword [rbp - 0x2d], 0x39002b
mov dword [rbp - 0x29], 0x500059
mov dword [rbp - 0x25], 0x2b005f
mov dword [rbp - 0x21], 0x15003f
mov ecx, 0xb
mov word [rbp - 0x1d], cx
movzx eax, word [0x18f88ddc4e]
add ax, cx
mov word [rbp - 0x1b], ax
movzx eax, word [str.Loaded_.NET_2_n]
add ax, cx
mov word [rbp - 0x19], ax
movzx eax, word [0x18f88ddc52]
add ax, cx
mov word [rbp - 0x17], ax
movzx eax, word [0x18f88ddc54]
add ax, cx
mov word [rbp - 0x15], ax
movzx eax, word [0x18f88ddc56]
add ax, cx
mov word [rbp - 0x13], ax
movzx eax, word [0x18f88ddc58]
add ax, cx
mov word [rbp - 0x11], ax
movzx eax, word [0x18f88ddc5a]
add ax, cx
mov word [rbp - 0xf], ax
movzx eax, word [0x18f88ddc5c]
add ax, cx
mov word [rbp - 0xd], ax
movzx eax, word [0x18f88ddc5e]
add ax, cx
mov word [rbp - 0xb], ax
movzx eax, word [0x18f88ddc60]
add ax, cx
mov word [rbp - 9], ax
movzx eax, word [0x18f88ddc62]
add ax, cx
mov word [rbp - 7], ax
movzx eax, word [0x18f88ddc64]
add ax, cx
mov word [rbp - 5], ax
movzx eax, word [0x18f88ddc66]
add ax, cx
mov word [rbp - 3], ax
movzx eax, word [0x18f88ddc68]
add ax, cx
mov word [rbp - 1], ax
mov word [rbp + 1], si
mov rax, rsi
mov ecx, 0xfff5
add word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 0x1d
jb 0x18f88b4dac
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.18f88bba18
nop
lea r8, [rbp + 7]
mov rdx, rax
mov ecx, dword [rdi]
call rbx
nop
lea rcx, [rbp + 0x27]
call fcn.18f88baf4c
nop
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18f88b4fc3
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, r14
jb 0x18f88b4fbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b4fef
jmp 0x18f88b4fbe
mov rdx, rdi
lea rcx, [0x18f88e5410]
call fcn.18f88b2164
test eax, eax
je 0x18f88b4fca
mov rbx, qword [rdi + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rsi
mov edx, 0x97cf
mov dword [rbp - 0x39], 0x978397cf
mov dword [rbp - 0x35], 0x97b097bf
mov dword [rbp - 0x31], 0x97b697b6
mov dword [rbp - 0x2d], 0x97f597b0
mov dword [rbp - 0x29], 0x979997f8
mov dword [rbp - 0x25], 0x978d979d
mov dword [rbp - 0x21], 0x97e997fa
lea ecx, [rdx + 0x1a]
mov dword [rbp - 0x1d], 0x97dd97d6
lea eax, [rdx + 0xf]
xor ax, word [0x18f88ddc6e]
mov word [rbp - 0x19], ax
lea eax, [rdx + 0x10]
xor ax, word [str.Create_AppDomain_____08X_n]
mov word [rbp - 0x17], ax
lea eax, [rdx + 0x11]
xor ax, word [0x18f88ddc72]
mov word [rbp - 0x15], ax
lea eax, [rdx + 0x12]
xor ax, word [0x18f88ddc74]
mov word [rbp - 0x13], ax
lea eax, [rdx + 0x13]
xor ax, word [0x18f88ddc76]
mov word [rbp - 0x11], ax
lea eax, [rdx + 0x14]
xor ax, word [0x18f88ddc78]
mov word [rbp - 0xf], ax
lea eax, [rdx + 0x15]
xor ax, word [0x18f88ddc7a]
mov word [rbp - 0xd], ax
lea eax, [rdx + 0x16]
xor ax, word [0x18f88ddc7c]
mov word [rbp - 0xb], ax
lea eax, [rdx + 0x17]
xor ax, word [0x18f88ddc7e]
mov word [rbp - 9], ax
lea eax, [rdx + 0x18]
xor ax, word [0x18f88ddc80]
mov word [rbp - 7], ax
lea eax, [rdx + 0x19]
xor ax, word [0x18f88ddc82]
mov word [rbp - 5], ax
xor cx, word [0x18f88ddc84]
mov word [rbp - 3], cx
lea eax, [rdx + 0x1b]
xor ax, word [0x18f88ddc86]
mov word [rbp - 1], ax
lea eax, [rdx + 0x1c]
xor ax, word [0x18f88ddc88]
mov word [rbp + 1], ax
xor eax, eax
mov word [rbp + 3], ax
mov rax, rsi
add dx, ax
xor word [rbp + rax*2 - 0x37], dx
inc rax
cmp rax, 0x1d
jae 0x18f88b4f69
movzx edx, word [rbp - 0x39]
jmp 0x18f88b4f52
mov word [rbp + 3], si
lea rdx, [rbp - 0x37]
lea rcx, [rbp + 0x27]
call fcn.18f88bba18
nop
lea r8, [rbp + 7]
mov rdx, rax
mov ecx, dword [rdi]
call rbx
nop
lea rcx, [rbp + 0x27]
call fcn.18f88baf4c
nop
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18f88b4fc3
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, r14
jb 0x18f88b4fbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b4fe9
call fcn.18f88bd1e0
mov eax, 1
jmp 0x18f88b4fcc
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18f88c3388
int3
call fcn.18f88c3388
nop
call fcn.18f88c3388
nop
call fcn.18f88c3388
int3