Function at 0x14003d490
Capabilities:
Spoof parent pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401c7b80]
xor rax, rsp
mov qword [rbp + 0x160], rax
xorps xmm0, xmm0
lea r9, [rbp + 8]
movups xmmword [rcx + 4], xmm0
xor eax, eax
xor esi, esi
movups xmmword [rcx + 0x14], xmm0
mov rdi, rcx
xor r8d, r8d
movups xmmword [rcx + 0x24], xmm0
lea edx, [rsi + 2]
mov qword [rbp + 0x20], rsi
movups xmmword [rcx + 0x34], xmm0
mov qword [rbp + 8], rsi
movups xmmword [rcx + 0x44], xmm0
movups xmmword [rcx + 0x54], xmm0
mov qword [rcx + 0x64], rax
mov dword [rcx + 0x6c], eax
movabs rax, 0x20000000000
mov dword [rcx], reloc.WS2_32.dll_WSASetLastError
xor ecx, ecx
mov qword [rbp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rbp + 8]
test rcx, rcx
jne 0x14003d856
call fcn.140004040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaa9b545aec3dfd5e
mov qword [rbp], rax
movabs rax, 0xdee953bd753c27a7
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
movabs rax, 0x338e472c63c788bd
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], rax
movabs rax, 0x41e99cb24234012
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xfbf9b95475bceea0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x19791e49483257c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xf9697fd86da6fe6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x3ae49478fcaffb30
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xe57dc14c8cc5bbe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xeae442aa930b956c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8bb7690f9d2f892a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xb524f82eb433c9bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xb9dadd5bad6910fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x1d45acf8b5f7eca7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x8ac60615be6fb805
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xb78532d4015549ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x5bda24431197edc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x766aed8a40422560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x8890f53101c98cc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x7d1c7220295477b2
mov qword [rbp], rax
lea rdx, [rbp + 0x60]
mov rax, qword [rbp]
movabs rcx, 0x829062ccfc2bf016
mov qword [rbp + 0x108], rax
movabs rax, 0xd91d1abf4dc98a4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x5f87f116dcca9344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x6724fc6dbaad28cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rcx
mov rcx, rbx
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xe9de1b7be94ea94f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xc15791429456bdc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x99a8b229df2c30d1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x1d45acf8d1d2cc9a
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa xmm2, xmmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x80], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
mov qword [rbp + 0x148], rax
vpxor xmm2, xmm2, xmmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqa xmmword [rbp + 0xc0], xmm2
vzeroupper
call fcn.140007aa0
xor al, al
jmp 0x14003e04a
call fcn.14013c96c
mov qword [rdi + 0x68], rax
test rax, rax
jne 0x14003daaf
call fcn.140004040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaa9b545aec3dfd5e
mov qword [rbp], rax
movabs rax, 0xd1a551bb6d3928a3
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
movabs rax, 0x34ae042774fb84a6
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], rax
movabs rax, 0x20b8ee52c2e4440
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0x829062ccfc2bf016
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xf1e29a5c64a4acac
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x96813005b3b1192
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xb53d7fcb38abe339
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x2df5b436f0bee02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x6740d94d878d5aa2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8ac60615be6fb805
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xb78532d4015549ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x5bda24431197edc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x766aed8a40422560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x8890f53101c98cc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x7d1c7220295477b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xd91d1abf4dc98a4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x5f87f116dcca9344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x6724fc6dbaad28cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
lea rdx, [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa xmm2, xmmword [rbp + 0xa0]
mov rcx, rbx
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x128], rax
vpxor xmm2, xmm2, xmmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmmword [rbp + 0xa0], xmm2
vzeroupper
call fcn.140007aa0
xor al, al
jmp 0x14003e04a
xor r8d, r8d
lea r9, [rbp + 8]
mov rcx, rax
lea edx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x14003dd93
call fcn.140004040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaa9b545aec3dfd5e
mov qword [rbp], rax
movabs rax, 0xdee953bd753c27a7
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
mov qword [rbp], rax
movabs rax, 0x338e472c63c788bd
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
mov qword [rbp], rax
movabs rax, 0x41e99cb24234012
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xfbf9b95475bceea0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x19791e49483257c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xad7474d66da6fe6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x2ba7946cb5a6f22d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xe568819db8d4da5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xf1f90eec995f8574
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x9bb16909ac6e853b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xc1579126b17680e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x8ac60615be6fb805
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xb78532d4015549ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x5bda24431197edc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x766aed8a40422560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x8890f53101c98cc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x7d1c7220295477b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xd91d1abf4dc98a4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x5f87f116dcca9344
mov qword [rbp], rax
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp]
movabs rcx, 0x829062ccfc2bf016
mov qword [rbp + 0x98], rax
movabs rax, 0x6724fc6dbaad28cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rcx
mov rcx, rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xe9de1b7be94ea94f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xc15791429456bdc8
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqu ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0xe0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqu ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x100], ymm1
mov qword [rbp + 0xb8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x120], ymm1
vzeroupper
call fcn.140007aa0
mov rcx, qword [rdi + 0x68]
call fcn.14013c958
xor al, al
mov qword [rdi + 0x68], rsi
jmp 0x14003e04a
mov rcx, qword [rdi + 0x68]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 0x20007
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14003df99
call fcn.140004040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaa9b545aec3dfd5e
mov qword [rbp], rax
movabs rax, 0xc5d557a0603139bb
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
movabs rax, 0x3fbb413179c38ea8
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], rax
movabs rax, 0x21f8fe332365121
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xf1f39c5d6eb9acac
mov qword [rbp], rax
lea rdx, [rbp + 0x60]
mov rax, qword [rbp]
mov rcx, rbx
mov qword [rbp + 0x80], rax
movabs rax, 0x5178174c40351192
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xe43d68d03fbbcf6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x5f87f116dcaeb664
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x8ac60615be6fb805
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xb78532d4015549ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x5bda24431197edc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x766aed8a40422560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x8890f53101c98cc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x7d1c7220295477b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xd91d1abf4dc98a4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x5f87f116dcca9344
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0x118], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.140007aa0
xor al, al
jmp 0x14003e04a
cmp qword [rbp + 0x20], rsi
je 0x14003e048
mov rcx, qword [rdi + 0x68]
lea r9, [rbp + 0x20]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14003e048
call fcn.140004040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaa9b545aec3dfd5e
mov qword [rbp], rax
movabs rax, 0xc5d557a0603139bb
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
movabs rax, 0x3fbb413179c38ea8
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], rax
movabs rax, 0x21f8fe332365121
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xfcfe904360b9acac
jmp 0x14003de37
mov al, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1401339b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret