Function at 0x14001114f
Capabilities:
Create process on windows
Query environment variable
Spoof parent pid

Disassembly:
jmp 0x140011950
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x5d0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x100
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5f8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x578], rax
lea rcx, [0x1400240a3]
call fcn.1400113bb
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 8], rax
movzx eax, word [0x14001b47c]
mov word [rbp + 0x30], ax
lea rax, [rbp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 0x256
rep stosb byte [rdi], al
mov r8d, 0x12c
lea rdx, [rbp + 0x30]
lea rcx, str.WINDIR
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
lea r8, str.System32
mov edx, 0x12c
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
mov qword [rbp + 0x2a8], 0
lea r9, [rbp + 0x2a8]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop
cmp qword [rbp + 0x2a8], 0
jne 0x140011a52
lea rcx, str.Failed_to_get_buffer_size_for_thread_attribute_list_n
call fcn.140011032
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Last_error:__d_n
call fcn.140011032
nop
jmp 0x140011cd4
mov r8, qword [rbp + 0x2a8]
mov edx, 8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x2c8], rax
lea r9, [rbp + 0x2a8]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140011aca
lea rcx, str.Failed_to_initialise_thread_attribute_list_n
call fcn.140011032
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Last_error:__d_n
call fcn.140011032
nop
mov r8, qword [rbp + 0x2c8]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
jmp 0x140011cd4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, qword [rbp + 0x5b0]
mov r8d, 0x20000
xor edx, edx
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140011b40
lea rcx, str.Failed_to_update_thread_attribute_list_with_spoofed_parent_process_n
call fcn.140011032
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Last_error:__d_n
call fcn.140011032
nop
mov r8, qword [rbp + 0x2c8]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
jmp 0x140011cd4
mov dword [rbp + 0x2f0], 0x70
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x308], 0
mov dword [rbp + 0x310], 0
mov dword [rbp + 0x314], 0
mov dword [rbp + 0x318], 0
mov dword [rbp + 0x31c], 0
mov dword [rbp + 0x320], 0
mov dword [rbp + 0x324], 0
mov dword [rbp + 0x328], 0
mov dword [rbp + 0x32c], 0
xor eax, eax
mov word [rbp + 0x330], ax
xor eax, eax
mov word [rbp + 0x332], ax
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x350], 0
lea rax, [rbp + 0x380]
lea rcx, [rbp + 0x2f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x68
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp + 0x5b8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x5a8]
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140011cb2
lea rcx, str.Failed_to_create_new_process_n
call fcn.140011032
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Last_error:__d_n
call fcn.140011032
nop
mov r8, qword [rbp + 0x2c8]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
jmp 0x140011cd4
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
nop
mov r8, qword [rbp + 0x2c8]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14001af10]
call fcn.14001134d
mov rcx, qword [rbp + 0x578]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x580]
pop rdi
pop rsi
pop rbp
ret