Function at 0x140001c80
Capabilities:
Create process on windows
Load windows common language runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140028028]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp qword [0x140029f28], 0
jne 0x140002016
xor r15d, r15d
mov qword [rbp - 0x11], r15
lea r8, [rbp - 0x11]
lea rdx, [0x140024770]
lea rcx, [0x140024780]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
test eax, eax
js 0x140001d53
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
lea r9, [rbp - 0x19]
lea r8, [0x140024790]
lea rdx, str.v4.0.30319
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140001d41
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
lea r9, [0x140029f28]
lea r8, [0x140024740]
lea rdx, [0x140024760]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x140001d37
mov rcx, qword [0x140029f28]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x140002016
lea rdx, [0x140024270]
lea rcx, [rbp + 0x17]
call fcn.1400030b0
nop
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov r9d, 0x10
lea r8, [0x140024040]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x1400245bc]
mov ecx, 2
call fcn.14000aa24
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001db0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x14000204d
cmp rbx, 0x10
jae 0x140001df7
mov qword [rbp + 7], rbx
mov qword [rbp + reloc.OLEAUT32.dll_SafeArrayDestroy], 0xf
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 9]
call fcn.140006740
mov byte [rbp + rbx - 9], 0
jmp 0x140001e8b
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001e30
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400044d0
test rax, rax
je 0x140002053
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001e6d
mov rdi, rax
mov ecx, SafeArrayGetElement
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001e5b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002047
jmp 0x140001e11
test rcx, rcx
je 0x140001e6a
call fcn.1400044d0
mov rsi, rax
jmp 0x140001e6d
mov rsi, r15
mov qword [rbp - 9], rsi
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.140006740
mov byte [rsi + rbx], 0
lea rdi, [rbp - 9]
mov rdx, qword [rbp - 9]
mov r8, qword [rbp + 0xf]
cmp r8, 0x10
cmovae rdi, rdx
lea rsi, [rbp - 9]
cmovae rsi, rdx
mov rcx, qword [rbp + 7]
add rsi, rcx
lea rbx, [rbp - 9]
cmp r8, 0x10
cmovae rbx, rdx
cmp rbx, rsi
je 0x140001ee1
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.14000ac40
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jne 0x140001ec2
mov r8, qword [rbp + 0xf]
mov rcx, qword [rbp + 7]
mov rdx, qword [rbp - 9]
lea rdi, [rbp - 9]
cmp r8, 0x10
cmovae rdi, rdx
cmp rcx, 7
jb 0x140001f6a
lea rsi, [rdi + rcx]
lea r8, [rsi - 6]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call fcn.140019dc0
mov rbx, rax
test rax, rax
je 0x140001f6a
nop dword [rax]
nop word [rax + rax]
mov r8d, 7
lea rdx, str.chinese
mov rcx, rbx
call fcn.140019ba0
test eax, eax
je 0x140001f5a
inc rbx
lea r8, [rsi - 6]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call fcn.140019dc0
mov rbx, rax
test rax, rax
jne 0x140001f20
jmp 0x140001f6a
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
lea r8, str.https:__dotnet.microsoft.com_zh_cn_download_dotnet_framework
jne 0x140001f71
lea r8, str.https:__dotnet.microsoft.com_en_us_download_dotnet_framework
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140001fc6
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002053
call fcn.14000475c
mov qword [rbp + 7], r15
mov qword [rbp + reloc.OLEAUT32.dll_SafeArrayDestroy], 0xf
mov byte [rbp - 9], 0
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140002012
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000200d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002041
call fcn.14000475c
xor al, al
jmp 0x140002018
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400044b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14000b08c
nop
call fcn.140001140
nop
call fcn.1400011e0
int3
call fcn.14000b08c
int3