Function at 0x1400021ca
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
push rbp
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
call fcn.1400020c9
mov dword [rbp + 0xe8], eax
cmp dword [rbp + 0xe8], 0
jne 0x14000222b
lea rax, [0x1401b41e0]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov ebx, 0
jmp 0x140002770
mov eax, dword [rbp + 0xe8]
mov r8d, eax
mov edx, 0
mov ecx, pe_nt_image_headers64
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
test rax, rax
jne 0x1400022a5
lea rax, [0x1401b4230]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call fcn.140173250
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov ebx, 0
jmp 0x140002770
mov qword [rbp + 0x98], 0
lea rax, [rbp + 0x98]
mov r9, rax
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
lea rax, [rbp + 0xaf]
mov qword [rbp + 0xd8], rax
nop
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0xaf]
lea rax, [rbp + 0x80]
mov r8, rcx
mov rcx, rax
call fcn.140185160
lea rax, [rbp + 0xaf]
mov rcx, rax
call fcn.140179140
nop
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.140185130
mov qword [rbp + 0xe0], rax
lea rdx, [rbp + 0x98]
mov rax, qword [rbp + 0xe0]
mov r9, rdx
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
test eax, eax
sete al
test al, al
je 0x1400023b8
lea rax, [0x1401b4280]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call fcn.140173250
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 0
jmp 0x140002761
lea rdx, [rbp + 0xa0]
mov rax, qword [rbp + 0xe0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
test eax, eax
sete al
test al, al
je 0x140002475
lea rax, [0x1401b42e0]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call fcn.140173250
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 0
jmp 0x140002761
lea rax, [rbp + 0x10]
mov r8d, 0x70
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp + 0x10], 0x70
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0xb0]
mov rdx, qword [rbp + 0x110]
mov r8, rdx
lea rdx, [0x1401b4328]
mov rcx, rax
call fcn.1401a82b0
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0xb0]
lea r8, [0x1401b4328]
mov rcx, rax
call fcn.1401a8260
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.14018e620
mov dword [rbp + 0xec], 0
mov rax, qword [rbp + 0x110]
mov r8d, 0
lea rdx, [0x1401b432c]
mov rcx, rax
call fcn.14010bf90
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x140002585
lea rax, [rbp - 0x30]
mov edx, 0
mov rcx, rax
call fcn.14018e800
mov rdx, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8080000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
mov dword [rbp + 0xec], eax
jmp 0x140002653
mov rax, qword [rbp + 0x110]
mov r8d, 0
lea rdx, [0x1401b4336]
mov rcx, rax
call fcn.14010bf90
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x140002616
lea rax, [rbp - 0x30]
mov edx, 0
mov rcx, rax
call fcn.14018e800
mov rdx, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
mov dword [rbp + 0xec], eax
jmp 0x140002653
lea rax, [0x1401b4348]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rcx, rax
mov rax, qword [rbp + 0x110]
mov rdx, rax
call fcn.1401a7d70
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
cmp dword [rbp + 0xec], 0
jne 0x1400026cd
lea rax, [0x1401b4378]
mov rdx, rax
mov rax, qword [0x140c89560]
mov rcx, rax
call fcn.1401a79c0
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call fcn.140173250
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 0
jmp 0x140002755
lea rax, [0x1401b43d0]
mov rdx, rax
mov rax, qword [0x140c89580]
mov rcx, rax
call fcn.1401a79c0
mov rcx, rax
mov rax, qword [rbp + 0x110]
mov rdx, rax
call fcn.1401a7d70
mov rcx, rax
mov rax, qword [0x140c89540]
mov rdx, rax
call fcn.140173010
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14018e620
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.1401851e0
mov eax, ebx
jmp 0x1400027d4
add rsp, 0x178
pop rbx
pop rbp
ret