Function at 0x401050
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x7c
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push 0x48
mov dword [esp + 0x18], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 0
call fcn.00402230
xorps xmm0, xmm0
lea eax, [esp + 0x3c]
add esp, 0xc
movaps xmmword [esp + 0x20], xmm0
mov ecx, 0x48
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4010b0
mov ecx, 0x10
lea eax, [esp + 0x20]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4010c4
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0x48
push eax
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push dword [esp + 0x18]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x401125
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____HeapAlloc_Failed_With_Error:__d_n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00401323
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x40115f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____InitializeProcThreadAttributeList_Failed_With_Error:__d_n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00401323
mov esp, ebp
pop ebp
ret
push 0
push 0
push 4
lea eax, [esp + 0x28]
push eax
push 0x20000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x4011a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____UpdateProcThreadAttribute_Failed_With_Error:__d_n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00401323
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
mov dword [esp + 0x74], esi
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0x80000
push 0
push 0
push 0
push dword [esp + 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4011f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____CreateProcessA_Failed_with_Error:__d_n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00401323
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
push esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x7c]
mov eax, 1
pop esi
xor ecx, esp
call fcn.00401323
mov esp, ebp
pop ebp
ret