Function at 0x180004e30
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x210
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rsi, rcx
lea rcx, [0x180080488]
call fcn.1800348d0
xor r12d, r12d
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180004ec4
lea rcx, str.taskhost.exe
call fcn.1800348d0
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180004ec4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
xor edx, edx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x238], rbx
lea r8d, [rdx + 0x70]
call fcn.180055310
xor eax, eax
lea r9, [rsp + 0x58]
lea edx, [rax + 1]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x80], WSAStartup
mov dword [rsp + 0xbc], 1
mov word [rsp + 0xc0], r12w
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r9, [rsp + 0x58]
lea edx, [r8 + 1]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x50]
xor edx, edx
mov r8d, 0x20000
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov qword [rsp + 0xe8], rbp
cmp dword [0x1800a3a54], r12d
je 0x18000516f
lea rcx, [rsp + 0xf1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xf0], r12b
call fcn.180055310
lea rdi, [0x1800a44a0]
mov rcx, rdi
xor edx, edx
call fcn.180054f78
test eax, eax
jne 0x180005069
mov rcx, r12
nop dword [rax]
movzx eax, byte [rcx + rdi]
inc rcx
mov byte [rsp + rcx + 0xef], al
test al, al
jne 0x180004fd0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
mov rax, qword [str.__C_start]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
movzx eax, word [0x1800804b0]
lea rbx, [0x1800a3950]
mov word [rdi + 7], ax
movzx eax, byte [0x1800804b2]
mov byte [rdi + 9], al
xor eax, eax
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
inc rdx
mov byte [rdi + rdx - 2], al
test al, al
jne 0x180005030
xor eax, eax
lea rdi, [rsp + 0xf0]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.__exit]
mov qword [rdi - 1], rax
movzx eax, byte [0x1800804c0]
mov byte [rdi + 7], al
jmp 0x180005124
mov rax, qword [str.C:WindowsSystem32cmd.exe]
lea rcx, [rsp + 0xf0]
lea rdi, [rsp + 0xf0]
mov qword [rcx], rax
mov rax, qword [0x1800804d0]
lea rbx, [0x1800a3950]
mov qword [rcx + 8], rax
mov rax, qword [0x1800804d8]
mov qword [rcx + 0x10], rax
mov eax, dword [0x1800804e0]
mov dword [rcx + 0x18], eax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.__C_start]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
movzx eax, word [0x1800804b0]
mov word [rdi + 7], ax
movzx eax, byte [0x1800804b2]
mov byte [rdi + 9], al
xor eax, eax
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800050f0
xor eax, eax
lea rdi, [rsp + 0xf0]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.__exit]
mov qword [rdi - 1], rax
movzx eax, byte [0x1800804c0]
mov byte [rdi + 7], al
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
jmp 0x1800051ba
lea rax, [rsp + 0x60]
lea rbx, [0x1800a3950]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test edi, edi
jne 0x1800051c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800051f1
cmp dword [0x1800a3a54], r12d
je 0x1800051eb
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.1800072d0
test eax, eax
jne 0x1800051ef
mov edi, r12d
jmp 0x1800051f1
mov eax, dword [rsp + 0x70]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x238]
mov eax, edi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180050540
mov rbp, qword [rsp + 0x240]
add rsp, 0x210
pop r12
pop rdi
pop rsi
ret