Function at 0x4339a3
Capabilities:
Create process on windows
Resume thread
Spoof parent pid

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004339a3
xor esi, esi
xor edi, edi
mov ecx, 0xa6
push esi
dec ecx
jne 0x4339bf
mov edx, 0x1862978
call fcn.0045d0ba
mov eax, 0x80000104
call fcn.00454915
call fcn.004340bc
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, edi
test eax, eax
je 0x433a25
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0xf01ff
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x208]
push ebx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_InitializeProcThreadAttributeList]
fldcw word [ebp - 0x10]
mov eax, 0x48
mov dword [ebp - 0x204], eax
push dword [ebp - 0x208]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
fldcw word [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x433e05
lea ebx, [ebp - 0x208]
push ebx
push 0
push 1
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.DLL_InitializeProcThreadAttributeList]
fldcw word [ebp - 0x10]
test eax, eax
je 0x433dcd
mov edx, 0x1865e20
call fcn.0045d0ba
mov eax, 0x80000104
call fcn.00454915
call fcn.004340bc
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
test eax, eax
je 0x433da0
push 0
push 0
push 4
lea ebx, [ebp - 0x1ac]
push ebx
push 0x20000
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.DLL_UpdateProcThreadAttribute]
fldcw word [ebp - 0x10]
test eax, eax
je 0x433d83
mov ebx, dword [ebp + 8]
push ebx
call fcn.00433e58
push 0
lea ebx, [ebp - 0x1bc]
push ebx
lea ebx, [ebp - 0x204]
push ebx
mov edx, 0x1865e34
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
push 0
fild dword [0x186cdbc]
fild dword [0x186d66c]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CreateProcessAsUserA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
test eax, eax
je 0x433d66
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
fldcw word [ebp - 0x10]
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
push dword [ebp - 0x1bc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x20c], 1
jmp 0x433e1d
mov edx, 0x1865e9c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
jmp 0x433d9b
mov edx, 0x1865ec0
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
jmp 0x433db8
mov edx, 0x1865eec
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
lea ebx, [ebp - 0x1c0]
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteProcThreadAttributeList]
fldcw word [ebp - 0x10]
jmp 0x433de5
mov edx, 0x1865f10
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
push dword [ebp - 0x1c0]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
fldcw word [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
fldcw word [ebp - 0x10]
jmp 0x433e1d
mov edx, 0x1865f44
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov eax, esi
test eax, eax
je 0x433e2f
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4