Function at 0x7ff7529715f0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rbx, r9
mov r15, r8
mov esi, edx
mov rdi, rcx
xor r12d, r12d
mov qword [rbp - 0x70], r12
test rcx, rcx
je 0x7ff752971e46
cmp r12w, word [rcx]
je 0x7ff752971e46
test rbx, rbx
je 0x7ff752971e46
cmp r12w, word [r9]
je 0x7ff752971e46
mov qword [rsp + 0x50], r12
lea rcx, [0x7ff75298d338]
call fcn.7ff75297bf14
test al, al
je 0x7ff7529716ae
cmp esi, 2
jne 0x7ff7529716ae
call fcn.7ff75297114c
cmp dword [section..data], 5
jbe 0x7ff7529716a9
call fcn.7ff752971218
test al, al
je 0x7ff7529716a9
mov qword [rbp - 0x50], 0x2000000
mov dword [rbp + 0xd8], esi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff752988601]
call fcn.7ff752971008
call fcn.7ff752971158
mov rdx, rdi
call fcn.7ff7529736b0
test al, al
jne 0x7ff752971e35
mov rdx, rbx
call fcn.7ff7529736b0
test al, al
jne 0x7ff752971e35
mov esi, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [0x7ff752985fe8]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff752986028]
lea r8d, [rsi + 3]
lea rdx, [0x7ff752986248]
mov rcx, rbx
call qword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
nop dword [rax + rax]
cmp eax, 0x80131700
je 0x7ff752971e09
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x7ff752971e09
mov rax, qword [rcx]
movabs r10, 0xf8951f327adfa870
mov rax, qword [rax + 0x50]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
jns 0x7ff752971778
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
xor edx, edx
lea r8d, [rsi + 4]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
jmp 0x7ff752971e35
movzx r13d, sil
mov r14, qword [rbp + 0xf0]
test r14, r14
je 0x7ff752971e35
mov dword [rbp - 0x74], r12d
movsxd rbx, dword [rbp + 0xe8]
mov eax, ebx
mov edi, dword [rbp + 0xe0]
sub eax, edi
dec eax
mov dword [rbp - 0x78], eax
mov ecx, 8
lea r8, [rbp - 0x78]
mov edx, esi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x7ff752971e35
mov dword [rbp + 0xb0], 0
cmp dword [rbp - 0x78], 0
je 0x7ff752971859
lea eax, [rdi + 1]
movsxd rdi, eax
mov r15, rbx
cmp rdi, rbx
jge 0x7ff752971852
nop dword [rax + rax]
mov rcx, qword [r14 + rdi*8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7ff752971e35
mov r8, rax
lea rdx, [rbp + 0xb0]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
inc dword [rbp + 0xb0]
test ebx, ebx
js 0x7ff75297184a
inc rdi
cmp rdi, r15
jl 0x7ff7529717f0
jmp 0x7ff75297184d
xor r13b, r13b
mov esi, 1
mov r15, qword [rbp + 0xc0]
test r13b, r13b
je 0x7ff752971e35
xor r13d, r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
movabs r10, 0xf028bebe30501170
lea rdx, [rsp + 0x60]
mov rax, qword [rax + 0x68]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
js 0x7ff752971dbe
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x7ff752971dbe
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x58]
lea rdx, [0x7ff752986008]
mov rax, qword [rax]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
js 0x7ff752971dbe
cmp qword [rsp + 0x58], r13
je 0x7ff752971dbe
mov qword [rsp + 0x68], r13
lea ecx, [r13 + 0x18]
call fcn.7ff752974b0c
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x7ff75297192c
mov qword [rax + 8], r13
mov dword [rax + 0x10], esi
mov rbx, qword [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x7ff75297192f
test rbx, rbx
jne 0x7ff752971e7f
jmp 0x7ff75297192f
mov rdi, r13
mov qword [rbp - 0x10], rdi
test rdi, rdi
je 0x7ff752971e8b
mov ecx, 0x18
call fcn.7ff752974b0c
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x7ff75297197b
mov qword [rax + 8], r13
mov dword [rax + 0x10], esi
lea rcx, str.Microsoft.PowerShell.UnmanagedPSEntry
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x7ff752971e85
jmp 0x7ff75297197e
mov r14, r13
mov qword [rbp - 8], r14
test r14, r14
je 0x7ff752971e79
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
movabs r10, 0xbec4a74d1ad11270
lea r9, [rsp + 0x68]
mov r8, qword [r14]
mov rdx, qword [rdi]
mov rax, qword [rax + 0x128]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
js 0x7ff752971d5b
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff752971d5b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
mov word [rbp - 0x68], r13w
mov rax, qword [rcx]
movabs r10, 0xa5d8b7575a51ab70
lea rdx, [rbp - 0x68]
mov rax, qword [rax + 0x70]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
jns 0x7ff752971a39
mov rcx, qword [0x7ff75298d080]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
xor edx, edx
lea r8d, [rdx + 7]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
mov esi, 0xffff0000
lea rcx, [rbp - 0x68]
call fcn.7ff75297ef20
jmp 0x7ff752971d84
mov qword [rsp + 0x78], r13
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ATL.DLL_AtlComPtrAssign]
nop dword [rax + rax]
lea rax, str.Start
mov qword [rbp - 0x48], rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
movabs r10, 0xfc2887f25c553070
lea rdx, [rbp - 0x7c]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x800
mov r9d, esi
lea r8, [rbp - 0x48]
lea rdx, [0x7ff752985330]
mov rax, qword [rax + 0x28]
call qword [0x7ff752984648]
mov r9d, eax
test eax, eax
jns 0x7ff752971ae4
mov rcx, qword [0x7ff75298d080]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
mov r8d, 8
xor edx, edx
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
mov esi, 0xffff0000
lea rcx, [rsp + 0x78]
call fcn.7ff752974800
nop
lea rcx, [rbp - 0x68]
call fcn.7ff75297ef20
jmp 0x7ff752971d84
mov eax, 0x2000
mov word [rbp], ax
mov qword [rbp + 8], r12
test r15, r15
je 0x7ff752971b10
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x7ff752971b14
jmp 0x7ff752971ac6
mov rax, qword [rbp - 0x70]
mov ebx, 8
mov word [rbp + 0x18], bx
mov qword [rbp + 0x20], rax
lea rax, [rbp]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], 2
mov eax, 0x17
mov word [rbp - 0x28], ax
mov dword [rbp - 0x20], r13d
mov dword [rbp - 0x80], r13d
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
movabs r10, 0xdb54af4d72d25a70
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x20], si
mov r9d, 0x800
lea r8, [0x7ff752985330]
mov edx, dword [rbp - 0x7c]
mov rax, qword [rax + 0x30]
call qword [0x7ff752984648]
mov r9d, eax
mov esi, dword [rbp - 0x20]
test eax, eax
jns 0x7ff752971bf0
mov rcx, qword [0x7ff75298d080]
mov rax, qword [rcx]
cmp r9d, 0x80020009
jne 0x7ff752971bdb
movabs r10, 0x93002f291450c270
mov r9, qword [rbp + 0x40]
xor edx, edx
lea r8d, [rbx + 2]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
jmp 0x7ff752971ac6
movabs r10, 0x93002f291450c270
mov r8d, 9
jmp 0x7ff752971aba
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x7ff752971c12
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff752984648]
nop
mov eax, 0xfff
cmp word [rbp - 0x68], ax
jne 0x7ff752971c21
mov word [rbp - 0x68], bx
lea rcx, [rbp - 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
nop
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x7ff752971c84
mov rcx, qword [r14]
test rcx, rcx
je 0x7ff752971c5b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x7ff752971c74
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov qword [r14 + 8], r13
mov rcx, r14
call qword [sym.imp.msvcrt.dll___3_YAXPEAX_Z]
nop dword [rax + rax]
nop
lock xadd dword [rdi + 0x10], ebx
cmp ebx, 1
jne 0x7ff752971cce
mov rcx, qword [rdi]
test rcx, rcx
je 0x7ff752971ca5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x7ff752971cbe
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov qword [rdi + 8], r13
mov rcx, rdi
call qword [sym.imp.msvcrt.dll___3_YAXPEAX_Z]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff752971cf0
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff752984648]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x7ff752971d12
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff752984648]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7ff752971d34
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff752984648]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x7ff752971d56
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x7ff752984648]
nop
jmp 0x7ff752971e4b
mov rcx, qword [0x7ff75298d080]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
xor edx, edx
lea r8d, [rdx + 7]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
mov esi, 0xffff0000
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x7ff752971d9f
mov rcx, r14
call fcn.7ff752974880
nop
lock xadd dword [rdi + 0x10], ebx
cmp ebx, 1
jne 0x7ff752971db2
mov rcx, rdi
call fcn.7ff752974880
nop
lea rcx, [rsp + 0x68]
call fcn.7ff752974800
jmp 0x7ff752971de7
mov rcx, qword [0x7ff75298d080]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
xor edx, edx
lea r8d, [rdx + 6]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
mov esi, 0xffff0000
lea rcx, [rsp + 0x60]
call fcn.7ff752974800
nop
lea rcx, [rsp + 0x58]
call fcn.7ff752974800
nop
lea rcx, [rsp + 0x50]
call fcn.7ff752974800
jmp 0x7ff752971e4b
mov rcx, qword [0x7ff75298d070]
mov rax, qword [rcx]
movabs r10, 0x93002f291450c270
mov qword [rsp + 0x20], rdi
mov r9, rbx
xor edx, edx
lea r8d, [rdx + 3]
mov rax, qword [rax + 8]
call qword [0x7ff752984648]
mov esi, 0xffff0000
lea rcx, [rsp + 0x50]
call fcn.7ff752974800
jmp 0x7ff752971e4b
mov esi, 0xffff0000
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov eax, esi
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff75297d474
nop
call fcn.7ff75297d474
nop
call fcn.7ff75297d474
nop
call fcn.7ff75297d474
int3