Function at 0x1400072d0
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Enumerate process modules
Get process image filename
Query environment variable
Spoof parent pid

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x4278
call fcn.1400217c0
sub rsp, rax
mov rbp, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov rax, qword [0x140051088]
xor rax, rsp
mov qword [rsp + 0x4270], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], 1
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0x80]
xor edi, edi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140007930
mov rcx, qword [rsp + 0x68]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14000792e
mov rcx, qword [rsp + 0x68]
xor edi, edi
lea rdx, [rsp + 0x5c]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x140007930
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x80]
xor edi, edi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140007930
mov rcx, qword [rsp + 0x70]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14000792e
xor edi, edi
lea rcx, [rsp + 0x270]
mov r8d, 0x4000
xor edx, edx
call fcn.140022fe0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x150], 0
mov rcx, qword [rsi + 0x58]
lea rdx, str.session
call fcn.140020a00
test rax, rax
je 0x1400074bd
lea rdx, str.process_parent
mov rcx, rax
call fcn.140020a00
mov rdi, rax
test rax, rax
je 0x14000777b
lea rcx, [rsp + 0x270]
lea r8, [rsp + 0x158]
mov edx, 0x4000
call sub.KERNEL32.dll_K32EnumProcesses
xor r14d, r14d
test eax, eax
je 0x140007781
mov rax, qword [rsp + 0x158]
cmp rax, 4
jb 0x140007781
mov qword [rsp + 0x50], rbp
mov r14, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rsp + 0x160]
xor ebp, ebp
jmp 0x14000754e
mov rcx, rsi
call r15
mov qword [rsp + 0x150], 0
mov rax, qword [rsp + 0x158]
add rbp, 1
mov rcx, rax
shr rcx, 2
cmp rbp, rcx
jae 0x140007771
mov r8d, dword [rsp + rbp*4 + 0x270]
test r8d, r8d
je 0x14000753a
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov ecx, 0x4d0
xor edx, edx
call r14
mov rsi, rax
mov qword [rsp + 0x150], rax
test rax, rax
je 0x140007520
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call fcn.140022fe0
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x104
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
test eax, eax
je 0x140007520
mov rdx, qword [rdi + 0x20]
mov rcx, rbx
call fcn.1400231f0
test rax, rax
je 0x140007520
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x14c]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140007956
mov ecx, dword [rsp + rbp*4 + 0x270]
lea rdx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140007956
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x14c]
jne 0x140007969
mov qword [rsp + 0x140], 0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov rbp, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea r9, [rsp + 0x140]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call rbp
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x138], 0
mov rdi, qword [rsp + 0x78]
call rbx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x138]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call rbp
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], 0
lea r9, [rsp + 0x130]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140007979
mov edx, 1
call fcn.14002c370
test rax, rax
je 0x140007979
mov rdi, rax
lea r9, [rsp + 0x130]
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
mov rbp, qword [rsp + 0x50]
je 0x14000797e
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x150]
mov r8d, 0x20000
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140007988
mov qword [rsp + 0x128], rdi
mov r14, qword [rsp + 0x150]
jmp 0x140007781
mov rbp, qword [rsp + 0x50]
xor r14d, r14d
jmp 0x140007781
mov r14d, 1
mov dword [rsp + 0xc0], 0x70
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x110], rax
or dword [rsp + 0xfc], 0x101
mov word [rsp + 0x100], 0
test r13, r13
je 0x14000780b
xor edi, edi
mov rcx, r13
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
mov ecx, eax
mov edx, 1
call fcn.14002c370
test rax, rax
je 0x140007930
mov rsi, rax
mov rcx, r13
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test r12, r12
jne 0x140007816
xor r13d, r13d
jmp 0x140007853
xor esi, esi
test r12, r12
je 0x14000792e
xor r13d, r13d
mov rcx, r12
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
mov ecx, eax
mov edx, 1
call fcn.14002c370
test rax, rax
je 0x140007914
mov rdi, rax
mov rcx, r12
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r13, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x8080000
mov dword [rsp + 0x20], 1
mov rcx, rsi
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x1400078c5
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x128]
call fcn.14002c850
mov rcx, rsi
call fcn.14002c850
mov rcx, r13
call fcn.14002c850
test ebx, ebx
je 0x140007914
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [rbp + 8], rax
mov eax, dword [rsp + 0xb0]
mov dword [rbp], eax
mov dil, 1
test r14, r14
je 0x140007930
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007930
test rsi, rsi
je 0x140007921
mov rcx, rsi
call fcn.14002c850
test r13, r13
je 0x14000792e
mov rcx, r13
call fcn.14002c850
xor edi, edi
mov rcx, qword [rsp + 0x4270]
xor rcx, rsp
call fcn.140021820
mov eax, edi
add rsp, 0x4278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007776
mov r14d, 1
mov rbp, qword [rsp + 0x50]
jmp 0x140007781
mov rbp, qword [rsp + 0x50]
test rsi, rsi
jne 0x14000795b
jmp 0x140007776
mov rsi, qword [rsp + 0x150]
jmp 0x14000797e