Function at 0x4018b0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate process modules
Link many functions at runtime
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12ec
call fcn.0041ca20
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xc44], 0x40000
push esi
push edi
mov eax, 0x766f
mov dword [ebx + 0x22c], 0
push dword [ebx + 0x21c]
mov word [ebp - 0xc3c], ax
lea eax, [ebx + 0x22c]
mov dword [ebp - 0x12dc], eax
lea eax, [ebx + 0x230]
push 0
push 0x1fffff
mov dword [ebp - 0xc40], 0xffff0000
mov dword [ebx + 0x224], 0
mov dword [ebp - 0x12e4], eax
mov dword [eax], 0
mov dword [ebx + 0x234], 0
mov dword [ebx + 0x238], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + 0x220], eax
test eax, eax
je 0x4019fb
push str.mscoree.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x12cc], eax
lea eax, [ebp - 0x210]
push 0x423554
push eax
mov dword [ebp - 0x12d8], 0
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebx + 0x21c]
xor edi, edi
push 0x18
mov dword [ebp - 0x12c8], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x12c4], esi
cmp esi, 0xffffffff
jne 0x4019c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4019fb
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405531
mov esp, ebp
pop ebp
ret
push 0x424
lea eax, [ebp - 0x12bc]
push 0
push eax
call fcn.00406ad0
add esp, 0xc
mov dword [ebp - 0x12c0], 0x428
lea eax, [ebp - 0x12c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x401a10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405531
mov esp, ebp
pop ebp
ret
mov ecx, str.System.Runtime.dll
lea eax, [ebp - 0x12a0]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401a46
test dx, dx
je 0x401a42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401a46
add eax, 4
add ecx, 4
test dx, dx
jne 0x401a20
xor eax, eax
jmp 0x401a4b
sbb eax, eax
or eax, 1
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
je 0x401a71
lea eax, [ebp - 0x12c0]
push eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x401a10
jmp 0x401afe
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x401a9c
cmp word [ebp + eax*2 - 0x10a0], 0x5c
je 0x401a9c
xor ecx, ecx
mov word [ebp + eax*2 - 0x10a0], cx
dec eax
test eax, eax
jg 0x401a82
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
push 0x104
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x620]
push eax
call edi
push 0x423580
lea eax, [ebp - 0x620]
push eax
call esi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x12c8], eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x401cda
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x423610
lea eax, [ebp - 0x828]
push eax
call esi
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x12c4], eax
xor edi, edi
cmp esi, 0xffffffff
je 0x401cb9
nop
test byte [ebp - 0xe98], 0x10
je 0x401c24
mov ax, word [ebp - 0xe6c]
cmp ax, 0x30
jb 0x401c24
cmp ax, 0x39
ja 0x401c24
lea eax, [ebp - 0xe6c]
push eax
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
push 0x423614
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00401840
add esp, 0x14
lea eax, [ebp - 0x12e0]
push eax
lea eax, [ebp - 0x12e8]
push eax
lea eax, [ebp - 0x12c8]
push eax
lea eax, [ebp - 0xe6c]
push str._d._d._d
push eax
call fcn.00401890
add esp, 0x14
cmp eax, 3
jne 0x401c24
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401c24
mov esi, dword [ebp - 0x12c8]
shl esi, 8
add esi, dword [ebp - 0x12e8]
shl esi, 8
add esi, dword [ebp - 0x12e0]
cmp esi, edi
jbe 0x401c1e
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edi, esi
mov esi, dword [ebp - 0x12c4]
lea eax, [ebp - 0xe98]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401b60
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x401cb9
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x210]
push str.C:Program_Files__x86_dotnet_sharedMicrosoft.NETCore.App_
push eax
call esi
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x42364c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call esi
push 0x423580
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x401cd2
push str.dbgshim.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401d06
jmp 0x401ce0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x401ce0
mov esi, dword [ebp - 0x12c8]
push str.EnumerateCLRs
push esi
call edi
push str.CreateVersionStringFromModule
push esi
call edi
push str.CreateDebuggingInterfaceFromVersion
push esi
call edi
push str.CLRCreateInstance
push esi
call edi
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x12cc]
test eax, eax
je 0x401dd8
push str.CLRCreateInstance
push eax
call edi
mov esi, eax
test esi, esi
je 0x401dda
lea eax, [ebp - 0x12d4]
push eax
push 0x42346c
push 0x42347c
call esi
test eax, eax
jne 0x401dda
mov eax, dword [ebp - 0x12d4]
lea edx, [ebp - 0x12d0]
push edx
push dword [ebx + 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x401dca
mov dword [ebp - 0x12c8], eax
lea edx, [ebp - 0x12c8]
mov eax, dword [ebp - 0x12d0]
push edx
lea edx, [ebp - 0x12cc]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x12c8], 0
je 0x401dbe
push 0x10
call fcn.00405565
mov dword [ebp - 0x12e0], eax
add esp, 4
mov ecx, dword [ebp - 0x12cc]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x210]
mov dword [eax], vtable.CMyICLRDebuggingLibraryProvider.0
mov dword [eax + 4], 1
mov dword [eax + 0xc], ecx
mov dword [ebx + 0x234], eax
mov eax, dword [ebp - 0x12d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x12d4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x401dda
xor esi, esi
cmp dword [ebx + 0x234], 0
jne 0x401e16
push 0x10
call fcn.00405565
mov dword [ebp - 0x12cc], eax
lea ecx, [ebp - 0x210]
add esp, 4
mov dword [eax], vtable.CMyICLRDebuggingLibraryProvider.0
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov dword [ebx + 0x234], eax
test esi, esi
je 0x401e2d
lea eax, [ebx + 0x224]
push eax
push 0x42345c
push 0x42348c
call esi
mov ecx, dword [ebp - 0x12d8]
test ecx, ecx
je 0x401e4a
lea eax, [ebx + 0x228]
push eax
push 0x42345c
push 0x42348c
call ecx
push dword [ebx + 0x21c]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x12c4], eax
cmp eax, 0xffffffff
je 0x4019fb
push 0x424
lea eax, [ebp - 0x12bc]
push 0
push eax
call fcn.00406ad0
add esp, 0xc
mov dword [ebp - 0x12c0], 0x428
lea eax, [ebp - 0x12c0]
push eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401fbd
push 0x10
call fcn.00405565
add esp, 4
mov esi, eax
mov dword [ebp - 0x12cc], esi
mov ecx, dword [ebx + 0x220]
push str.IsWow64Process
push str.Kernel32.dll
mov dword [esi], vtable.CMyIcorDebugDataTarget.0
mov dword [esi + 8], 1
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov dword [esi + 0xc], eax
mov dword [ebx + 0x238], esi
mov esi, dword [ebp - 0x12e4]
nop dword [eax]
mov edi, dword [ebx + 0x224]
test edi, edi
je 0x401f38
mov ecx, dword [edi]
lea eax, [ebp - 0x12cc]
push eax
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebx + 0x22c]
push eax
push 0x41d960
lea eax, [ebp - 0xc44]
push eax
push dword [ebx + 0x234]
mov eax, dword [ebp - 0x12a4]
push dword [ebx + 0x238]
cdq
push edx
push eax
push edi
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
je 0x401fa5
mov edi, dword [ebx + 0x228]
test edi, edi
je 0x401f84
mov ecx, dword [edi]
lea eax, [ebp - 0x12cc]
push eax
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebx + 0x22c]
push eax
push 0x41d960
lea eax, [ebp - 0xc44]
push eax
push dword [ebx + 0x234]
mov eax, dword [ebp - 0x12a4]
push dword [ebx + 0x238]
cdq
push edx
push eax
push edi
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
je 0x401fa5
lea eax, [ebp - 0x12c0]
push eax
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x401ef0
jmp 0x401fbd
mov eax, dword [ebp - 0x12dc]
push dword [ebp - 0x12e4]
push 0x41d990
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx]
push dword [ebp - 0x12c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x12dc]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx], eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.00405531
mov esp, ebp
pop ebp
ret