Function at 0x1400176e2
Capabilities:
Create process on windows
Protect spawned processes with mitigation policies
Spoof parent pid

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x570
movaps xmmword [rsp + 0x560], xmm7
movaps xmmword [rsp + 0x550], xmm6
mov rbx, r8
mov r14, rcx
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x548], rax
movsxd rdi, edx
mov rcx, rdi
call fcn.140028994
mov rsi, rax
mov rcx, rax
mov rdx, r14
mov r8, rdi
call fcn.140020110
test rbx, rbx
je 0x14001793b
cmp byte [rbx], 0
je 0x14001793b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xd0], 0x70
mov dword [rsp + 0x10c], 0x80000
lea r8, [0x1400e153a]
lea rcx, [rsp + 0x140]
mov edx, 0x400
mov r9, rbx
call fcn.1400179a1
mov eax, dword [0x1400fb8f8]
cmp eax, 4
jl 0x1400178e8
xor r15d, r15d
lea r14, [rsp + 0xa8]
mov qword [r14], r15
cmp eax, 8
mov ebp, 1
sbb ebp, 0xffffffff
mov r12, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor ecx, ecx
mov edx, ebp
xor r8d, r8d
mov r9, r14
call r12
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x138], rax
mov rcx, rax
mov edx, ebp
xor r8d, r8d
mov r9, r14
call r12
call fcn.140017630
lea rcx, [rsp + 0xa0]
mov qword [rcx], r15
lea r8, [rsp + 0x70]
mov dword [r8], 0x30
movups xmmword [r8 + 8], xmm6
mov dword [r8 + 0x18], 0x40
mov eax, eax
movups xmmword [r8 + 0x20], xmm6
lea r9, [rsp + 0x60]
mov qword [r9], rax
mov qword [r9 + 8], r15
mov edx, 0x1fffff
call fcn.140026d50
test eax, eax
js 0x140017993
xorps xmm7, xmm7
movups xmmword [rsp + 0x28], xmm7
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0xa0]
mov r8d, 0x20000
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
cmp dword [0x1400fb8f8], 8
jl 0x1400178e8
movabs rax, 0x100000000000
lea r9, [rsp + 0x58]
mov qword [r9], rax
movups xmmword [rsp + 0x28], xmm7
mov qword [rsp + 0x20], 8
mov r8d, 0x20007
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8080004
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x140]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140017959
mov rax, qword [rsp + 0xb0]
jmp 0x140017941
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140017959
lea rcx, [rsp + 0xb0]
mov rdx, rsi
mov r8, rdi
call fcn.140017415
mov rcx, rsi
call fcn.140028960
mov rcx, qword [rsp + 0x548]
xor rcx, rsp
call fcn.140034c20
movaps xmm6, xmmword [rsp + 0x550]
movaps xmm7, xmmword [rsp + 0x560]
add rsp, 0x570
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.NtOpenProcess_failed_
call fcn.14000d25d
jmp 0x140017959