Function at 0x14000b1c0
Capabilities:
Check for debugger via api
Load windows common language runtime

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x348
mov rax, qword [0x14003f080]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov byte [rsp + 0x34], 0
mov edx, 8
lea rcx, [rsp + 0x1c8]
call fcn.140007230
lea rcx, [rsp + 0x1c8]
call fcn.140002f40
mov edx, 8
lea rcx, [rsp + 0x1c0]
call fcn.140007230
lea rcx, [rsp + 0x1c0]
call fcn.140002f40
mov edx, 8
lea rcx, [rsp + 0x1b8]
call fcn.140007230
lea rcx, [rsp + 0x1b8]
call fcn.140002f40
mov edx, 8
lea rcx, [rsp + 0x1b0]
call fcn.140007230
lea rcx, [rsp + 0x1b0]
call fcn.140002f40
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xb8], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc0], rax
xor ecx, ecx
call fcn.14000ba30
mov ecx, eax
call fcn.140013c44
mov dword [rsp + 0x38], 0
xor eax, eax
cmp eax, 1
je 0x14000b3a2
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rsp + 0x180]
mov edx, 7
mov rcx, rax
call qword [rsp + 0xc0]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000b320
mov rax, qword [rsp + 0x188]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14000b320
mov dword [rsp + 0x38], SafeArrayGetDim
xor ecx, ecx
call fcn.14000ba30
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x1f0]
call fcn.14000ba10
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 7
jl 0x14000b362
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 9
jge 0x14000b362
cmp dword [rsp + 0x38], 0x78
jbe 0x14000b362
jmp 0x14000b3a2
call fcn.140007a80
mov dword [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x108]
call fcn.140001110
mov rcx, rax
call fcn.140002ae0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000b39d
mov eax, dword [rsp + 0x38]
dec eax
mov dword [rsp + 0x38], eax
jmp 0x14000b2b8
mov dword [rsp + 0x1d0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x1d0], 0
je 0x14000b413
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x1b0]
call fcn.1400045c0
lea rcx, [rsp + 0x1b8]
call fcn.1400045c0
lea rcx, [rsp + 0x1c0]
call fcn.1400045c0
lea rcx, [rsp + 0x1c8]
call fcn.1400045c0
mov eax, dword [rsp + 0x54]
jmp 0x14000b9f4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x158], 0
lea r8, [rsp + 0x158]
lea rdx, [0x14002f558]
lea rcx, [0x14002f568]
call sub.mscoree.dll_CLRCreateInstance
mov qword [rsp + 0x160], 0
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
lea r9, [rsp + 0x160]
lea r8, [0x14002f578]
lea rdx, str.v4.0.30319
mov rcx, qword [rsp + 0x158]
call qword [rax + SafeArrayCopy]
mov rax, qword [rsp + 0x160]
mov rax, qword [rax]
lea r9, [rsp + 0x150]
lea r8, [0x14002f490]
lea rdx, [0x14002f480]
mov rcx, qword [rsp + 0x160]
call qword [rax + 0x48]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14000b4fc
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x1b0]
call fcn.1400045c0
lea rcx, [rsp + 0x1b8]
call fcn.1400045c0
lea rcx, [rsp + 0x1c0]
call fcn.1400045c0
lea rcx, [rsp + 0x1c8]
call fcn.1400045c0
mov eax, dword [rsp + 0x58]
jmp 0x14000b9f4
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x150]
call qword [rax + 0x50]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b99d
lea rcx, [rsp + 0x1c8]
call fcn.140004fc0
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx]
mov qword [rsp + 0xc8], rcx
mov rdx, rax
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0xc8]
call qword [rax + 0x68]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b987
lea rcx, [rsp + 0x1c8]
call fcn.140004f90
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x1c0]
call fcn.140004fc0
mov rcx, rax
call fcn.1400016b0
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
mov qword [rsp + 0xd0], rcx
mov r8, rax
lea rdx, [0x14002f868]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0xd0]
call qword [rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b95c
mov dword [rsp + 0x1e4], 0
mov r8d, 0x104
lea rdx, [rsp + 0x220]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x1d4]
lea rcx, [rsp + 0x220]
call fcn.140008300
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0x1d4]
mov dword [rsp + 0x1e0], eax
lea r8, [rsp + 0x1e0]
mov edx, 1
mov cx, 0x11
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000b931
mov eax, dword [rsp + 0x1d4]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rsp + 0xd8]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x1c0]
call fcn.140004f90
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x1b8]
call fcn.140004fc0
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
mov qword [rsp + 0xe0], rcx
mov r8, rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0xe0]
call qword [rax + 0x168]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b926
lea rcx, [rsp + 0x1b8]
call fcn.140004f90
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x1b0]
call fcn.140004fc0
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rsp + 0xe8], rcx
mov rdx, rax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0xe8]
call qword [rax + 0x80]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b8fb
mov eax, 1
mov word [rsp + 0xf0], ax
mov qword [rsp + 0xf8], 0
mov eax, 0x2008
mov word [rsp + 0x168], ax
mov eax, 8
imul rax, rax, 0
mov dword [rsp + rax + 0x21c], 0
mov eax, 8
imul rax, rax, 0
mov dword [rsp + rax + 0x218], 0
lea r8, [rsp + 0x218]
mov edx, 1
mov cx, 8
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x60], 0
mov eax, 8
imul rax, rax, 0
mov dword [rsp + rax + 0x214], 0
mov eax, 8
imul rax, rax, 0
mov dword [rsp + rax + 0x210], 1
lea r8, [rsp + 0x210]
mov edx, 1
mov cx, SafeArrayDestroy
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rsp + 0x60], rax
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x1d8], 0
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
lea rcx, [rsp + 0x1b0]
call fcn.140004f90
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x110]
lea rcx, [rsp + 0xf0]
mov rdi, rax
mov rsi, rcx
mov ecx, SafeArrayCopy
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
lea r9, [rsp + 0x1f8]
xor r8d, r8d
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x98]
call qword [rax + 0x128]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x8002000e
jne 0x14000b8c4
lea rcx, [rsp + 0x1b0]
call fcn.140004f90
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x130]
lea rcx, [rsp + 0xf0]
mov rdi, rax
mov rsi, rcx
mov ecx, SafeArrayCopy
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
lea r9, [rsp + 0x1f8]
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0xa0]
call qword [rax + 0x128]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000b8d0
mov byte [rsp + 0x34], 1
lea rcx, [rsp + 0x1b0]
call fcn.140004f90
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x1b8]
call fcn.140004f90
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x1c0]
call fcn.140004f90
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x1c8]
call fcn.140004f90
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x150]
call qword [rax + 0x58]
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x150]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
movzx eax, byte [rsp + 0x34]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x1b0]
call fcn.1400045c0
lea rcx, [rsp + 0x1b8]
call fcn.1400045c0
lea rcx, [rsp + 0x1c0]
call fcn.1400045c0
lea rcx, [rsp + 0x1c8]
call fcn.1400045c0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14000ceb0
add rsp, 0x348
pop rdi
pop rsi
ret