Function at 0x4010d9
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
jne 0x40110b
push str.Path___NULL
push str.VklCreateProcess
push 0xb
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x40110b
int 0x2c
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40111a
cmp word [eax], bx
jne 0x40111a
mov dword [ebp + 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4013a7
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
call fcn.00401058
test al, al
je 0x4013a7
push ebx
push 0x18
pop esi
push esi
lea eax, [ebp - 0xa0]
push eax
push ebx
push 0xffffffffffffffff
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov edi, 0x80000
cmp eax, ebx
jge 0x40118a
push str.NT_SUCCESS_Status_
push str.VklCreateProcess
push 0x32
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x401209
int 0x2c
jmp 0x401209
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x80
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, ebx
jge 0x4011d1
push str.NT_SUCCESS_Status_
push str.VklCreateProcess
push 0x43
jmp 0x401171
push 0x30
pop eax
mov dword [ebp - 0x10], eax
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x10]
push eax
push ebx
push 1
push dword [ebp - 0x44]
call dword [sym.imp.kernel32.dll_InitializeProcThreadAttributeList]
push ebx
push ebx
push 4
lea eax, [ebp - 8]
push eax
push 0x20000
push ebx
push dword [ebp - 0x44]
call dword [sym.imp.kernel32.dll_UpdateProcThreadAttribute]
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
push 5
pop eax
mov word [ebp - 0x58], ax
test dword [ebp - 0xc], edi
je 0x40122c
mov dword [ebp - 0x88], 0x48
cmp dword [ebp + 0xc], ebx
je 0x4012a8
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401237
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
cmp si, bx
jne 0x40124e
sub eax, edx
sar eax, 1
lea esi, [eax + ecx + 4]
lea eax, [esi + esi]
call sub.ntdll.dll__alloca_probe_16
mov edi, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__s___s
push esi
push edi
call section..text
add esp, 0x14
test eax, eax
jns 0x4012aa
push 0x4031ac
push str.VklCreateProcess
push 0x97
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x4012aa
int 0x2c
jmp 0x4012aa
xor edi, edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov edi, dword fs:[0x34]
mov byte [ebp - 1], al
mov esi, str.NT_SUCCESS_SafeCloseStatus_
cmp dword [ebp - 8], ebx
je 0x401309
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x401306
push esi
push str.VklCreateProcess
push 0xad
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x401306
int 0x2c
mov dword [ebp - 8], ebx
cmp byte [ebp - 1], bl
je 0x401380
cmp dword [ebp - 0x28], ebx
je 0x401341
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x40133e
push esi
push str.VklCreateProcess
push 0xb0
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x40133e
int 0x2c
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x24], ebx
je 0x401371
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x401371
push esi
push str.VklCreateProcess
push 0xb1
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x401371
int 0x2c
mov al, 1
lea esp, [ebp - 0xb0]
pop edi
pop esi
pop ebx
leave
ret 8
cmp edi, 0x57
jne 0x401388
push 2
pop edi
cmp edi, 0x2e4
je 0x4013a7
push edi
call fcn.00401ffe
push eax
push str.CreateProcess_failed:__s
call fcn.00401cf8
pop ecx
pop ecx
xor al, al
jmp 0x401373
push 5
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.open
push dword [0x4052c4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x401371
cmp eax, 0x1b
ja 0x401413
je 0x40140c
cmp eax, ebx
je 0x401405
cmp eax, 1
jbe 0x401424
cmp eax, 3
jbe 0x4013fd
cmp eax, 5
je 0x4013f6
cmp eax, 8
je 0x401405
cmp eax, 0xb
je 0x4013fd
cmp eax, 0x1a
jne 0x401424
mov eax, str.A_sharing_violation_occurred.
jmp 0x40146e
mov eax, str.Access_was_denied.
jmp 0x40146e
push eax
call fcn.00401ffe
jmp 0x40146e
mov eax, str.Insufficient_resources.
jmp 0x40146e
mov eax, str.SE_ERR_ASSOCINCOMPLETE.
jmp 0x40146e
sub eax, 0x1c
je 0x401469
dec eax
je 0x401462
dec eax
je 0x40145b
dec eax
je 0x401454
dec eax
je 0x40144d
push str.FALSE
push str.VklCreateProcess
push 0xfa
push str.creaproc.c
call fcn.00401d0d
add esp, 0x10
test al, al
je 0x401446
int 0x2c
mov eax, str.Unknown_error.
jmp 0x40146e
mov eax, str.A_DLL_was_not_found.
jmp 0x40146e
mov eax, str.SE_ERR_NOASSOC.
jmp 0x40146e
mov eax, str.SE_ERR_DDEBUSY.
jmp 0x40146e
mov eax, str.SE_ERR_DDEFAIL.
jmp 0x40146e
mov eax, str.SE_ERR_DDETIMEOUT.
push eax
push str.ShellExecute_failed:__s
jmp 0x40139c