Function at 0x434033
Capabilities:
Create process on windows
Resume thread
Spoof parent pid

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00434033
xor esi, esi
xor edi, edi
mov ecx, 0xa6
push esi
dec ecx
jne 0x43404f
mov edx, 0x18608c8
call fcn.0045b687
mov eax, 0x80000104
call fcn.00452ee2
call fcn.0043474c
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, edi
test eax, eax
je 0x4340b5
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0xf01ff
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x208]
push ebx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_InitializeProcThreadAttributeList]
fldcw word [ebp - 0x10]
mov eax, 0x48
mov dword [ebp - 0x204], eax
push dword [ebp - 0x208]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
fldcw word [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x434495
lea ebx, [ebp - 0x208]
push ebx
push 0
push 1
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.DLL_InitializeProcThreadAttributeList]
fldcw word [ebp - 0x10]
test eax, eax
je 0x43445d
mov edx, 0x1864030
call fcn.0045b687
mov eax, 0x80000104
call fcn.00452ee2
call fcn.0043474c
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
test eax, eax
je 0x434430
push 0
push 0
push 4
lea ebx, [ebp - 0x1ac]
push ebx
push 0x20000
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.DLL_UpdateProcThreadAttribute]
fldcw word [ebp - 0x10]
test eax, eax
je 0x434413
mov ebx, dword [ebp + 8]
push ebx
call fcn.004344e8
push 0
lea ebx, [ebp - 0x1bc]
push ebx
lea ebx, [ebp - 0x204]
push ebx
mov edx, 0x1864044
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
push 0
fild dword [0x186aab4]
fild dword [0x186b354]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CreateProcessAsUserA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
test eax, eax
je 0x4343f6
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
fldcw word [ebp - 0x10]
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
push dword [ebp - 0x1bc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x20c], 1
jmp 0x4344ad
mov edx, 0x18640ac
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
jmp 0x43442b
mov edx, 0x18640d0
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
jmp 0x434448
mov edx, 0x18640fc
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
lea ebx, [ebp - 0x1c0]
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteProcThreadAttributeList]
fldcw word [ebp - 0x10]
jmp 0x434475
mov edx, 0x1864120
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
push dword [ebp - 0x1c0]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
fldcw word [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
fldcw word [ebp - 0x10]
jmp 0x4344ad
mov edx, 0x1864154
call fcn.0045b687
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
mov eax, esi
test eax, eax
je 0x4344bf
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4