Function at 0x10001a70
Capabilities:
Load windows common language runtime
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x1001d004]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x34]
push edi
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call esi
lea eax, [esp + 0x48]
push eax
call esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x1001ba90
push 0x1001bad0
mov dword [esp + 0x20], 0
xor bl, bl
call dword [sym.imp.mscoree.dll_CLRCreateInstance]
test eax, eax
jns 0x10001b17
push eax
push str.CLRCreateInstance_failed_w_hr_0x_08lx_n
call fcn.10001780
add esp, 8
jmp 0x10001bac
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push 0x1001bae0
push str.v4.0.30319
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x10001b44
push eax
push str.ICLRMetaHost::GetRuntime_failed_w_hr_0x_08lx_n
call fcn.10001780
add esp, 8
jmp 0x10001bac
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x10001b67
push eax
push str.ICLRRuntimeInfo::IsLoadable_failed_w_hr_0x_08lx_n
call fcn.10001780
add esp, 8
jmp 0x10001bac
cmp dword [esp + 0x10], 0
jne 0x10001b7d
push str..NET_runtime_v4.0.30319_cannot_be_loaded_n
call fcn.10001780
add esp, 4
jmp 0x10001bac
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
push 0x1001baa0
push 0x1001bac0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x10001baa
push eax
push str.ICLRRuntimeInfo::GetInterface_failed_w_hr_0x_08lx_n
call fcn.10001780
add esp, 8
jmp 0x10001bac
mov bl, 1
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10001bc2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10001bd0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
test bl, bl
jne 0x10001c62
push str.Failed_to_create_the_runtime_host_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x48]
push eax
call esi
lea eax, [esp + 0x38]
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10001c05
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10001c13
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10001c21
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10001c2f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10001c3d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10001c4b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x264]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002224
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x10001be3
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10001c82
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x30]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
js 0x10001be3
mov esi, dword [esp + 0x30]
test esi, esi
je 0x10001f7d
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10001cb3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
lea ecx, [esp + 0x2c]
push ecx
push 0x1001bab0
push esi
call dword [eax]
test eax, eax
js 0x10001be3
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x10001f7d
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10001ce4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [eax + 0x28]
test eax, eax
js 0x10001be3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x10001f7d
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10001d11
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [eax + 0x50]
test eax, eax
js 0x10001be3
mov esi, dword [esp + 0x24]
test esi, esi
je 0x10001f7d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10001d3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xc
call fcn.1000223a
mov edi, eax
add esp, 4
test edi, edi
je 0x10001f87
lea ebx, [edi + 8]
mov dword [edi + 4], 0
push str.System.Reflection.Assembly
mov dword [ebx], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x10001f87
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push dword [edi]
push esi
call dword [eax + 0x44]
mov esi, eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
jne 0x10001dc5
mov ecx, dword [edi]
test ecx, ecx
je 0x10001da3
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10001dba
push eax
call fcn.10002235
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.1000226a
add esp, 8
test esi, esi
js 0x10001be3
push 0x208
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.100039a0
add esp, 0xc
lea eax, [esp + 0x58]
push 0x104
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, 0x82
lea eax, [esp + 0x58]
nop
cmp word [eax], 0
je 0x10001e0e
add eax, 2
sub ecx, 1
jne 0x10001e00
mov edx, 0x82
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10001e66
lea ecx, [esp + 0x58]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x10001e59
mov edi, str.Reference_AssembliesDiagServicesDiagnosticsNet.ClientService.dll
mov eax, SysReAllocString
sub edi, ecx
nop word [eax + eax]
test eax, eax
je 0x10001e59
movzx esi, word [edi + ecx]
test si, si
je 0x10001e59
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x10001e40
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x5c]
push ecx
mov ecx, esp
mov dword [ecx], eax
test eax, eax
je 0x10001e82
mov esi, dword [eax]
push eax
call dword [esi + 4]
mov edx, edi
mov ecx, str.LoadFrom
call fcn.100018d0
add esp, 8
cmp word [esp + 0x38], 9
jne 0x10001be3
mov esi, dword [esp + 0x40]
test esi, esi
je 0x10001f7d
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10001eb7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xc
call fcn.1000223a
mov edi, eax
add esp, 4
test edi, edi
je 0x10001f87
lea ebx, [edi + 8]
mov dword [edi + 4], 0
push str.ScreenConnect.ClientService
mov dword [ebx], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x10001f87
mov eax, dword [esi]
lea ecx, [esp + 0x1c]
push ecx
push dword [edi]
push esi
call dword [eax + 0x44]
mov dword [esp + 0x10], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
jne 0x10001f44
mov ecx, dword [edi]
test ecx, ecx
je 0x10001f1e
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10001f35
push eax
call fcn.10002235
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.1000226a
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
js 0x10001f72
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, esp
mov dword [ecx], eax
test eax, eax
je 0x10001f60
mov edi, dword [eax]
push eax
call dword [edi + 4]
mov edx, str.diagnosticshub.net.service
mov ecx, str.RunService
call fcn.100018d0
add esp, 8
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x10001be3
push 0x80004003
call fcn.10002fa0
push 0x8007000e
call fcn.10002fa0
int3