Function at 0x401a00
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate process modules
Link many functions at runtime
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12ec
call fcn.0041c800
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc44], 0x40000
mov eax, 0x766f
mov dword [edi + 0x22c], 0
mov word [ebp - 0xc3c], ax
lea eax, [edi + 0x22c]
mov dword [ebp - 0x12dc], eax
lea eax, [edi + 0x230]
push dword [edi + 0x21c]
mov dword [ebp - 0x12d0], edi
push 0
push 0x1fffff
mov dword [ebp - 0xc40], 0xffff0000
mov dword [edi + 0x224], 0
mov dword [ebp - 0x12e4], eax
mov dword [eax], 0
mov dword [edi + 0x234], 0
mov dword [edi + 0x238], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [edi + 0x220], eax
test eax, eax
je 0x401b47
push str.mscoree.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x12cc], eax
lea eax, [ebp - 0x210]
push 0x423db4
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [edi + 0x21c]
xor ebx, ebx
push 0x18
mov dword [ebp - 0x12c8], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x12c4], esi
cmp esi, 0xffffffff
jne 0x401b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x401b47
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004050db
mov esp, ebp
pop ebp
ret
push 0x424
lea eax, [ebp - 0x12bc]
push 0
push eax
call fcn.00406620
add esp, 0xc
mov dword [ebp - 0x12c0], 0x428
lea eax, [ebp - 0x12c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x401b60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004050db
mov esp, ebp
pop ebp
ret
mov ecx, str.System.Runtime.dll
lea eax, [ebp - 0x12a0]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b96
test dx, dx
je 0x401b92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b96
add eax, 4
add ecx, 4
test dx, dx
jne 0x401b70
xor eax, eax
jmp 0x401b9b
sbb eax, eax
or eax, 1
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
je 0x401bc1
lea eax, [ebp - 0x12c0]
push eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x401b60
jmp 0x401c4e
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x401bec
cmp word [ebp + eax*2 - 0x10a0], 0x5c
je 0x401bec
xor ecx, ecx
mov word [ebp + eax*2 - 0x10a0], cx
dec eax
test eax, eax
jg 0x401bd2
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
push 0x104
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x620]
push eax
call ebx
push 0x423de0
lea eax, [ebp - 0x620]
push eax
call esi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x12c8], eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x401f02
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x423e70
lea eax, [ebp - 0x828]
push eax
call esi
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x12c4], eax
xor ebx, ebx
cmp esi, 0xffffffff
je 0x401e0d
nop
test byte [ebp - 0xe98], 0x10
je 0x401d74
mov ax, word [ebp - 0xe6c]
cmp ax, 0x30
jb 0x401d74
cmp ax, 0x39
ja 0x401d74
lea eax, [ebp - 0xe6c]
push eax
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
push 0x423e74
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00401810
add esp, 0x14
lea eax, [ebp - 0x12e0]
push eax
lea eax, [ebp - 0x12e8]
push eax
lea eax, [ebp - 0x12c8]
push eax
lea eax, [ebp - 0xe6c]
push str._d._d._d
push eax
call fcn.00401860
add esp, 0x14
cmp eax, 3
jne 0x401d74
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401d74
mov esi, dword [ebp - 0x12c8]
shl esi, 8
add esi, dword [ebp - 0x12e8]
shl esi, 8
add esi, dword [ebp - 0x12e0]
cmp esi, ebx
jbe 0x401d6e
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebx, esi
mov esi, dword [ebp - 0x12c4]
lea eax, [ebp - 0xe98]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401cb0
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x401e0d
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x210]
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
push eax
call ebx
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x423eac
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x423de0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x401efa
push str.dbgshim.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x401f08
mov eax, dword [ebp - 0x12cc]
test eax, eax
je 0x401f2f
push str.CLRCreateInstance
push eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x401f31
lea eax, [ebp - 0x12d8]
push eax
push 0x423c84
push 0x423c94
call ebx
test eax, eax
jne 0x401f31
mov eax, dword [ebp - 0x12d8]
lea edx, [ebp - 0x12d4]
push edx
push dword [edi + 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x401eec
mov dword [ebp - 0x12c8], eax
lea edx, [ebp - 0x12c8]
mov eax, dword [ebp - 0x12d4]
push edx
lea edx, [ebp - 0x12cc]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x12c8], 0
je 0x401ee0
push 0x10
call fcn.0040510c
mov dword [ebp - 0x12e0], eax
add esp, 4
mov ecx, dword [ebp - 0x12cc]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x210]
mov dword [eax], vtable.CMyICLRDebuggingLibraryProvider.0
mov dword [eax + 4], 1
mov dword [eax + 0xc], ecx
mov dword [edi + 0x234], eax
mov eax, dword [ebp - 0x12d4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x12d8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x401f31
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x401f08
mov esi, dword [ebp - 0x12c8]
push str.EnumerateCLRs
push esi
call ebx
push str.CreateVersionStringFromModule
push esi
call ebx
push str.CreateDebuggingInterfaceFromVersion
push esi
call ebx
push str.CLRCreateInstance
push esi
call ebx
mov esi, eax
jmp 0x401e28
xor ebx, ebx
cmp dword [edi + 0x234], 0
jne 0x401f6d
push 0x10
call fcn.0040510c
mov dword [ebp - 0x12cc], eax
lea ecx, [ebp - 0x210]
add esp, 4
mov dword [eax], vtable.CMyICLRDebuggingLibraryProvider.0
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov dword [edi + 0x234], eax
test ebx, ebx
je 0x401f84
lea eax, [edi + 0x224]
push eax
push 0x423c74
push 0x423cac
call ebx
test esi, esi
je 0x401f9b
lea eax, [edi + 0x228]
push eax
push 0x423c74
push 0x423cac
call esi
push dword [edi + 0x21c]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401b47
push 0x424
lea eax, [ebp - 0x12bc]
push 0
push eax
call fcn.00406620
add esp, 0xc
mov dword [ebp - 0x12c0], 0x428
lea eax, [ebp - 0x12c0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x402113
push 0x10
call fcn.0040510c
add esp, 4
mov esi, eax
mov dword [ebp - 0x12cc], esi
mov ecx, dword [edi + 0x220]
push str.IsWow64Process
push str.Kernel32.dll
mov dword [esi], vtable.CMyIcorDebugDataTarget.0
mov dword [esi + 8], 1
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xc], eax
mov eax, edi
mov edi, dword [ebp - 0x12e4]
mov dword [eax + 0x238], esi
nop word [eax + eax]
mov esi, dword [eax + 0x224]
test esi, esi
je 0x40208e
mov ecx, dword [esi]
lea edx, [ebp - 0x12cc]
push edx
lea edx, [ebp - 0xc44]
push edx
lea edx, [eax + 0x22c]
push edx
push 0x41d410
lea edx, [ebp - 0xc44]
push edx
push dword [eax + 0x234]
push dword [eax + 0x238]
mov eax, dword [ebp - 0x12a4]
cdq
push edx
push eax
push esi
call dword [ecx + 0xc]
mov edi, eax
mov eax, dword [ebp - 0x12d0]
test edi, edi
je 0x4020fb
mov esi, dword [eax + 0x228]
test esi, esi
je 0x4020de
mov ecx, dword [esi]
lea edx, [ebp - 0x12cc]
push edx
lea edx, [ebp - 0xc44]
push edx
lea edx, [eax + 0x22c]
push edx
push 0x41d410
lea edx, [ebp - 0xc44]
push edx
push dword [eax + 0x234]
push dword [eax + 0x238]
mov eax, dword [ebp - 0x12a4]
cdq
push edx
push eax
push esi
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
je 0x4020fb
lea eax, [ebp - 0x12c0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x402113
mov eax, dword [ebp - 0x12d0]
jmp 0x402040
mov eax, dword [ebp - 0x12dc]
push dword [ebp - 0x12e4]
push 0x41d440
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x12dc]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx], eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.004050db
mov esp, ebp
pop ebp
ret