Function at 0x140002554
Capabilities:
Create process on windows
Enumerate process modules
Spoof parent pid

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x1220
call fcn.140005e80
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x11c0], rcx
mov ecx, 1
call dbg.SetDebugPrivilege(int)
test eax, eax
sete al
test al, al
je 0x14000259f
lea rax, str.Failed_to_enable_debug_privilege._n
mov rcx, rax
call dbg.printf(char const*, ::)
mov eax, 1
jmp 0x140002cb1
mov qword [rbp + 0x180], 0
lea rdx, [rbp + 0x18c]
lea rax, [rbp + 0x190]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
sete al
test al, al
je 0x140002600
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_enumerate_processes.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov eax, 1
jmp 0x140002cb1
mov eax, dword [rbp + 0x18c]
shr eax, 2
mov dword [rbp + 0x1198], eax
mov dword [rbp + 0x119c], 0
jmp 0x14000271d
mov eax, dword [rbp + 0x119c]
cdqe
mov eax, dword [rbp + rax*4 + 0x190]
test eax, eax
je 0x140002716
mov eax, dword [rbp + 0x119c]
cdqe
mov eax, dword [rbp + rax*4 + 0x190]
mov r8d, eax
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x1190], rax
cmp qword [rbp + 0x1190], 0
je 0x140002716
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov byte [rdx], al
add rdx, 1
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x1190]
mov r9d, 0x104
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.K32GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x140002703
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strlwr]
call rax
mov rdx, qword [rbp + 0x11c0]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140002703
mov rax, qword [rbp + 0x1190]
mov qword [rbp + 0x180], rax
lea rax, str.Found_powershell.exe_process._n
mov rcx, rax
call dbg.printf(char const*, ::)
jmp 0x14000272f
mov rax, qword [rbp + 0x1190]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
add dword [rbp + 0x119c], 1
mov eax, dword [rbp + 0x119c]
cmp eax, dword [rbp + 0x1198]
jb 0x14000261e
mov rax, qword [rbp + 0x180]
test rax, rax
jne 0x140002754
lea rax, str.powershell.exe_process_not_found._n
mov rcx, rax
call dbg.printf(char const*, ::)
mov eax, 1
jmp 0x140002cb1
mov dword [rbp + 0x17c], 0
mov dword [rbp + 0x178], 0
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessId]
call rax
mov ecx, eax
lea rax, [rbp + 0x17c]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
test eax, eax
sete al
test al, al
je 0x1400027db
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_retrieve_powershell.exe_session_ID.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rax, [rbp + 0x178]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
test eax, eax
sete al
test al, al
je 0x140002844
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_retrieve_current_process_session_ID.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov eax, dword [rbp + 0x17c]
mov edx, eax
lea rax, str.powershell.exe_Session_ID:__lu_n
mov rcx, rax
call dbg.printf(char const*, ::)
mov eax, dword [rbp + 0x178]
mov edx, eax
lea rax, str.Current_Program_Session_ID:__lu_n
mov rcx, rax
call dbg.printf(char const*, ::)
mov edx, dword [rbp + 0x17c]
mov eax, dword [rbp + 0x178]
cmp edx, eax
je 0x1400028ae
lea rax, str.Session_mismatch._Cannot_set_powershell.exe_as_parent_process._n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov qword [rbp + 0xd8], 0
lea rax, [rbp + 0x100]
mov r8d, 0x70
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0xe0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x100], 0x70
lea rax, [rbp + 0xd8]
mov r9, rax
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
test eax, eax
sete al
test al, al
je 0x140002978
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x57
setne al
test al, al
je 0x140002978
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_calculate_size_for_attribute_list.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov rbx, qword [rbp + 0xd8]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
test rax, rax
jne 0x1400029f1
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_allocate_memory_for_attribute_list.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov rax, qword [rbp + 0x168]
lea rdx, [rbp + 0xd8]
mov r9, rdx
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
test eax, eax
sete al
test al, al
je 0x140002a88
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_initialize_attribute_list.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rbx, qword [rbp + 0x168]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
mov rax, qword [rbp + 0x168]
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
test eax, eax
sete al
test al, al
je 0x140002b4d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_update_attribute_list.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rbx, qword [rbp + 0x168]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.C:Windows_notepad.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x140002c2d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.Failed_to_create_Notepad_process.
mov rdx, rax
lea rax, str._____s__Error_Code:__lu__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rbx, qword [rbp + 0x168]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002cb1
lea rax, str.Notepad_started_with_powershell.exe_as_parent._n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
mov rbx, qword [rbp + 0x168]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x1220
pop rbx
pop rdi
pop rbp
ret