Function at 0x140075df0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14025e008]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x68], rdi
lea rcx, [0x1402450a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea r15d, [rdi - 1]
test rax, rax
jne 0x140075e6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140076161
lea rdx, str.CLRCreateInstance
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140075e8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140075f2d
lea r8, [rsp + 0x60]
lea rdx, [0x140245150]
lea rcx, [0x140245190]
call rax
test eax, eax
js 0x140075f31
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rsp + 0x50]
lea r8, [0x1402451a0]
lea rdx, [0x140245030]
call qword [rax + SafeArrayCopy]
test eax, eax
jns 0x140075ef0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rsp + 0x50]
lea r8, [0x1402451a0]
lea rdx, str.v4.0.30319
call qword [rax + SafeArrayCopy]
test eax, eax
js 0x140075f31
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x50]
test eax, eax
js 0x140075f31
cmp dword [rsp + 0x40], 0
je 0x140075f31
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [0x140245160]
lea rdx, [0x140245180]
call qword [rax + 0x48]
test eax, eax
jns 0x140075f7a
lea rdx, str.CorBindToRuntime
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400762d5
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9, [0x140245160]
lea r8, [0x140245180]
lea rdx, [0x140245078]
lea rcx, [0x140245030]
call rax
test eax, eax
js 0x1400762d5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
js 0x1400762da
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140075fa0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x58], rdi
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x68]
mov ebx, eax
test eax, eax
js 0x1400762da
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400763db
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140075fde
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x38], rdi
mov rax, qword [rbx]
lea r8, [rsp + 0x38]
lea rdx, [0x140245170]
mov rcx, rbx
call qword [rax]
mov ebx, eax
test eax, eax
js 0x1400762da
mov qword [rsp + 0x78], 0xfc00
mov ecx, SafeArrayUnlock
lea r8, [rsp + 0x78]
lea edx, [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
test rax, rax
je 0x140076169
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov ebx, eax
test eax, eax
js 0x140076158
mov r8d, 0xfc00
lea rdx, [0x14025e1b0]
mov rcx, qword [r14 + 0x10]
call fcn.140199f60
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400763db
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007607a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x30], rdi
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, rbx
call qword [rax + 0x168]
mov ebx, eax
test eax, eax
js 0x140076158
mov ecx, SafeArrayCopy
call fcn.1401bc1fc
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400760d0
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.MSF.Powershell.Runner
call fcn.1401bd240
mov qword [rsi], rax
jmp 0x1400760d3
mov rsi, rdi
mov qword [rbp - 0x80], rsi
test rsi, rsi
je 0x1400763e6
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400763f1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400760ff
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x68], rdi
mov rax, qword [rbx]
lea r8, [rsp + 0x68]
mov rdx, qword [rsi]
mov rcx, rbx
call qword [rax + 0x88]
mov ebx, eax
mov eax, r15d
lock xadd dword [rsi + 0x10], eax
dec eax
test eax, eax
jne 0x140076158
mov rcx, qword [rsi]
test rcx, rcx
je 0x140076139
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14007614b
call fcn.1401bc1f4
mov qword [rsi + 8], rdi
mov edx, SafeArrayCopy
mov rcx, rsi
call fcn.1401bc1f4
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
test ebx, ebx
js 0x1400762da
mov rcx, qword [0x140272578]
mov rbx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x1400761a2
test rbx, rbx
je 0x14007618f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x140272578]
mov qword [0x140272578], rbx
test rcx, rcx
je 0x1400761a2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [0x140272570]
mov rbx, qword [rsp + 0x58]
cmp rcx, rbx
je 0x1400761db
test rbx, rbx
je 0x1400761c8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x140272570]
mov qword [0x140272570], rbx
test rcx, rcx
je 0x1400761db
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [0x140272568]
mov rbx, qword [rsp + 0x30]
cmp rcx, rbx
je 0x140076214
test rbx, rbx
je 0x140076201
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x140272568]
mov qword [0x140272568], rbx
test rcx, rcx
je 0x140076214
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [0x140272560]
mov rbx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x14007624d
test rbx, rbx
je 0x14007623a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x140272560]
mov qword [0x140272560], rbx
test rcx, rcx
je 0x14007624d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea r9, [fcn.140075de0]
lea r8, str._MSF.Powershell.Meterpreter.Core_::SetInvocationPointer_0x_p__n
mov edx, 0xff
lea rcx, [rbp - 0x70]
call fcn.1400757f0
mov qword [rsp + 0x70], rdi
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
call fcn.140075a90
nop
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140076369
lock xadd dword [rax + 0x10], r15d
cmp r15d, 1
jne 0x140076369
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400762b1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400762c3
call fcn.1401bc1f4
mov qword [rbx + 8], rdi
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.1401bc1f4
jmp 0x140076369
mov ebx, 0x80004001
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140076301
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400762fc
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x30], rdi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140076328
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140076323
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rsp + 0x38], rdi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007633d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140076352
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x50], rdi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140076367
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x60], rdi
mov edi, ebx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14007637a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007638b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007639c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400763ad
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov eax, edi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1401bc1d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004003
call fcn.1401bd230
int3
mov ecx, 0x8007000e
call fcn.1401bd230
nop
mov ecx, 0x80004003
call fcn.1401bd230
int3