Function at 0x7ff743e915e0
Capabilities:
Load windows common language runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x628], rbx
mov rax, qword [0x7ff743eb0688]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov rdi, r9
mov qword [rsp + 0x50], r8
mov rsi, rcx
mov r13, qword [rbp + 0x540]
mov r12, qword [rbp + 0x560]
xor ebx, ebx
mov qword [rbp - 0x58], rbx
test rcx, rcx
je 0x7ff743e91f65
cmp bx, word [rcx]
je 0x7ff743e91f65
test r9, r9
je 0x7ff743e91f65
cmp bx, word [r9]
je 0x7ff743e91f65
mov qword [rsp + 0x58], rbx
cmp edx, 2
jne 0x7ff743e9181c
lea rcx, [0x7ff743eb1298]
call fcn.7ff743e9ad14
test al, al
je 0x7ff743e918e9
movups xmm0, xmmword [str._unknown_]
movaps xmmword [rbp + 0x2c0], xmm0
mov ebx, dword [0x7ff743ea8050]
mov dword [rbp + 0x2d0], ebx
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rbp + 0x2d4]
call sub.msvcrt.dll_memset
movups xmm0, xmmword [str._unknown_]
movaps xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], ebx
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rbp + 0xc4]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov ecx, eax
call fcn.7ff743e96f30
mov r15d, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7ff743e9172a
mov r9d, 0x104
lea r8, [rbp + 0x2c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, r15d
call fcn.7ff743e96f30
mov r14d, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7ff743e91780
mov r9d, 0x104
lea r8, [rbp + 0xb0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call fcn.7ff743e91254
cmp dword [section..data], 5
jbe 0x7ff743e91815
call fcn.7ff743e9130c
test al, al
je 0x7ff743e91815
mov qword [rbp - 0x38], 0x2000000
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x78], r14d
lea rax, [rbp + 0x2c0]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x74], r15d
mov dword [rbp - 0x70], 2
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff743eaa171]
call fcn.7ff743e91008
xor ebx, ebx
call fcn.7ff743e91260
mov r14d, ebx
mov rdx, rsi
call fcn.7ff743e93700
test al, al
jne 0x7ff743e91961
mov rdx, rdi
call fcn.7ff743e93700
test al, al
jne 0x7ff743e91961
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x7ff743ea77c8]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff743ea7808]
mov r8d, 4
lea rdx, [0x7ff743ea7a38]
mov rcx, rdi
call qword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
nop dword [rax + rax]
cmp eax, 0x80131700
je 0x7ff743e9193a
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7ff743e9193a
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
jns 0x7ff743e91967
mov rcx, qword [0x7ff743eb0fe8]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
xor edx, edx
lea r8d, [rdx + 5]
call qword [0x7ff743ea5f00]
mov r14d, 0xffff0000
lea rcx, [rsp + 0x58]
call fcn.7ff743e93eb4
jmp 0x7ff743e91f6b
call fcn.7ff743e91254
cmp dword [section..data], 5
jbe 0x7ff743e91817
call fcn.7ff743e9130c
test al, al
je 0x7ff743e91817
mov qword [rbp - 0x20], 0x2000000
mov dword [rbp - 0x6c], 2
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff743eaa203]
call fcn.7ff743e91120
jmp 0x7ff743e91817
mov rcx, qword [0x7ff743eb0fe8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor edx, edx
lea r8d, [rdx + 3]
mov rax, qword [rax + 8]
call qword [0x7ff743ea5f00]
jmp 0x7ff743e918d4
mov r14d, 0xffff0000
cmp r14d, 0xffff0000
je 0x7ff743e918da
test r12, r12
je 0x7ff743e918d4
mov dword [rbp - 0x5c], ebx
movsxd rbx, dword [rbp + 0x558]
mov eax, ebx
mov edi, dword [rbp + 0x550]
sub eax, edi
dec eax
mov dword [rbp - 0x60], eax
mov ecx, 8
lea r8, [rbp - 0x60]
mov r14d, 1
mov edx, r14d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x7ff743e918d4
mov dword [rsp + 0x78], 0
cmp dword [rbp - 0x60], 0
je 0x7ff743e91a3e
lea ecx, [rdi + 1]
movsxd rdi, ecx
mov r14, rbx
cmp rdi, rbx
jge 0x7ff743e91a38
nop dword [rax]
mov rcx, qword [r12 + rdi*8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7ff743e918d4
mov r8, rax
lea rdx, [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
inc dword [rsp + 0x78]
test ebx, ebx
js 0x7ff743e918d4
inc rdi
cmp rdi, r14
jl 0x7ff743e919e0
mov r14d, 1
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov rax, qword [rax + 0x68]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
js 0x7ff743e91f23
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff743e91f23
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [0x7ff743ea77e8]
mov rax, qword [rax]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
js 0x7ff743e91f23
cmp qword [rsp + 0x60], r12
je 0x7ff743e91f23
mov qword [rsp + 0x70], r12
lea ecx, [r12 + 0x18]
call fcn.7ff743e94174
mov rdi, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x7ff743e91aee
mov qword [rax + 8], r12
mov dword [rax + 0x10], r14d
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x7ff743e91af1
test r13, r13
jne 0x7ff743e91faf
jmp 0x7ff743e91af1
mov rdi, r12
mov qword [rbp - 0x10], rdi
test rdi, rdi
je 0x7ff743e91fbb
mov ecx, SafeArrayCopy
call fcn.7ff743e94174
mov rsi, rax
mov qword [rbp - 8], rax
test rax, rax
je 0x7ff743e91b3d
mov qword [rax + 8], r12
mov dword [rax + 0x10], r14d
lea rcx, str.Microsoft.PowerShell.UnmanagedPSEntry
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
je 0x7ff743e91fb5
jmp 0x7ff743e91b40
mov rsi, r12
mov qword [rbp - 8], rsi
test rsi, rsi
je 0x7ff743e91fa9
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
mov r8, qword [rsi]
mov rdx, qword [rdi]
mov rax, qword [rax + 0x128]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
js 0x7ff743e91eca
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff743e91eca
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov word [rbp - 0x50], r12w
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
mov rax, qword [rax + 0x70]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
jns 0x7ff743e91bde
mov rcx, qword [0x7ff743eb0ff8]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
xor edx, edx
lea r8d, [rdx + 7]
call qword [0x7ff743ea5f00]
mov r14d, 0xffff0000
lea rcx, [rbp - 0x50]
call fcn.7ff743e9ec44
jmp 0x7ff743e91eea
mov qword [rbp - 0x80], r12
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ATL.DLL_AtlComPtrAssign]
nop dword [rax + rax]
lea rax, str.Start
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp - 0x64]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x800
mov r9d, r14d
lea r8, [rbp - 0x18]
lea rdx, [0x7ff743ea6b20]
mov rax, qword [rax + 0x28]
call qword [0x7ff743ea5f00]
mov r9d, eax
test eax, eax
jns 0x7ff743e91c70
mov rcx, qword [0x7ff743eb0ff8]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
xor edx, edx
lea r8d, [rdx + 8]
call qword [0x7ff743ea5f00]
mov r14d, 0xffff0000
lea rcx, [rbp - 0x80]
call fcn.7ff743e93eb4
nop
lea rcx, [rbp - 0x50]
call fcn.7ff743e9ec44
jmp 0x7ff743e91eea
mov eax, 0x2000
mov word [rbp + 0x38], ax
mov qword [rbp + 0x40], r15
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x7ff743e91ccd
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rbp - 0x58], rax
test rax, rax
jne 0x7ff743e91cd1
mov r14d, 0xffff0000
lea rcx, [rbp - 0x80]
call fcn.7ff743e93eb4
nop
lea rcx, [rbp - 0x50]
call fcn.7ff743e9ec44
nop
mov ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jmp 0x7ff743e91ef9
mov rax, qword [rbp - 0x58]
mov ebx, 8
mov word [rbp + 0x50], bx
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x38]
mov qword [rbp], rax
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 2
mov eax, SafeArrayCopy
mov word [rbp + 0x18], ax
mov dword [rbp + 0x20], r12d
mov dword [rbp - 0x68], r12d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp]
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x20], r14w
mov r9d, 0x800
lea r8, [0x7ff743ea6b20]
mov edx, dword [rbp - 0x64]
mov rax, qword [rax + 0x30]
call qword [0x7ff743ea5f00]
mov r9d, eax
mov r14d, dword [rbp + 0x20]
test eax, eax
jns 0x7ff743e91d93
mov rcx, qword [0x7ff743eb0ff8]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
cmp r9d, 0x80020009
jne 0x7ff743e91d88
mov r9, qword [rbp + 0x80]
lea r8d, [rbx + 2]
call qword [0x7ff743ea5f00]
jmp 0x7ff743e91c52
mov r8d, 9
jmp 0x7ff743e91c4c
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x7ff743e91daa
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x7ff743ea5f00]
nop
mov eax, 0xfff
cmp word [rbp - 0x50], ax
jne 0x7ff743e91db9
mov word [rbp - 0x50], bx
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
nop
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x7ff743e91e1b
mov rcx, qword [rsi]
test rcx, rcx
je 0x7ff743e91df2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7ff743e91e0b
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov qword [rsi + 8], r12
mov rcx, rsi
call qword [sym.imp.msvcrt.dll___3_YAXPEAX_Z]
nop dword [rax + rax]
nop
lock xadd dword [rdi + 0x10], ebx
cmp ebx, 1
jne 0x7ff743e91e65
mov rcx, qword [rdi]
test rcx, rcx
je 0x7ff743e91e3c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x7ff743e91e55
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov qword [rdi + 8], r12
mov rcx, rdi
call qword [sym.imp.msvcrt.dll___3_YAXPEAX_Z]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff743e91e7d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x7ff743ea5f00]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff743e91e95
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x7ff743ea5f00]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x7ff743e91ead
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x7ff743ea5f00]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7ff743e91ec5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x7ff743ea5f00]
nop
jmp 0x7ff743e91f6b
mov rcx, qword [0x7ff743eb0ff8]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 7]
mov rax, qword [rax + 8]
call qword [0x7ff743ea5f00]
mov r14d, 0xffff0000
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x7ff743e91f04
mov rcx, rsi
call fcn.7ff743e93ef0
nop
lock xadd dword [rdi + 0x10], ebx
cmp ebx, 1
jne 0x7ff743e91f17
mov rcx, rdi
call fcn.7ff743e93ef0
nop
lea rcx, [rsp + 0x70]
call fcn.7ff743e93eb4
jmp 0x7ff743e91f43
mov rcx, qword [0x7ff743eb0ff8]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 6]
mov rax, qword [rax + 8]
call qword [0x7ff743ea5f00]
mov r14d, 0xffff0000
lea rcx, [rsp + 0x68]
call fcn.7ff743e93eb4
nop
lea rcx, [rsp + 0x60]
call fcn.7ff743e93eb4
nop
lea rcx, [rsp + 0x58]
call fcn.7ff743e93eb4
jmp 0x7ff743e91f6b
mov r14d, 0xffff0000
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.7ff743e94750
mov rbx, qword [rsp + 0x628]
add rsp, 0x5e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff743e9cba0
nop
call fcn.7ff743e9cba0
nop
call fcn.7ff743e9cba0
nop
call fcn.7ff743e9cba0
int3