Function at 0x401000
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xec
call sub.ntdll.dll__chkstk
push esi
cmp dword [ebp + 8], 0
jne 0x40103a
push 0x405004
push 0x405020
push 0xb
push 0x405044
call fcn.00402760
add esp, 0x10
mov byte [ebp - 6], al
movzx eax, byte [ebp - 6]
test eax, eax
je 0x40103a
int 0x2c
cmp dword [ebp + 0xc], 0
je 0x401051
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx]
test edx, edx
jne 0x401051
mov dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x401462
push str..exe
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call fcn.004017a0
movzx edx, al
test edx, edx
je 0x401462
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
push 0
push 0x18
lea eax, [ebp - 0x78]
push eax
push 0
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x4010e4
push 0x405068
push 0x405090
push 0x32
push 0x4050b4
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xb1], al
movzx ecx, byte [ebp - 0xb1]
test ecx, ecx
je 0x4010e4
int 0x2c
cmp dword [ebp - 0x98], 0
jge 0x4010f2
jmp 0x4011e8
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.00401700
lea ecx, [ebp - 0xac]
push ecx
lea edx, [ebp - 0x94]
push edx
push 0x80
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenProcess]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x401174
push 0x4050cc
push 0x4050f4
push 0x43
push 0x405118
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xb2], al
movzx ecx, byte [ebp - 0xb2]
test ecx, ecx
je 0x401174
int 0x2c
cmp dword [ebp - 0x98], 0
jge 0x40117f
jmp 0x4011e8
mov dword [ebp - 0xb0], 0x30
mov eax, dword [ebp - 0xb0]
call sub.ntdll.dll__alloca_probe_16
mov dword [ebp - 0xe4], esp
mov edx, dword [ebp - 0xe4]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0xb0]
push eax
push 0
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_InitializeProcThreadAttributeList]
push 0
push 0
push 4
lea edx, [ebp - 0xa4]
push edx
push 0x20000
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_UpdateProcThreadAttribute]
mov ecx, dword [ebp - 0x9c]
or ecx, 0x80000
mov dword [ebp - 0x9c], ecx
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
mov eax, 5
mov word [ebp - 0x20], ax
mov ecx, dword [ebp - 0x9c]
and ecx, 0x80000
je 0x401210
mov dword [ebp - 0x50], 0x48
cmp dword [ebp + 0xc], 0
je 0x4012c2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea ecx, [esi + eax + 4]
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0xbc]
shl eax, 1
call sub.ntdll.dll__alloca_probe_16
mov dword [ebp - 0xe8], esp
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.__s___s
mov edx, dword [ebp - 0xbc]
push edx
mov eax, dword [ebp - 0xa0]
push eax
call fcn.00401740
add esp, 0x14
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jge 0x4012c0
push 0x405140
push 0x405164
push 0x97
push 0x405188
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xbd], al
movzx ecx, byte [ebp - 0xbd]
test ecx, ecx
je 0x4012c0
int 0x2c
jmp 0x4012cc
mov dword [ebp - 0xa0], 0
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x9c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov byte [ebp - 5], al
mov ecx, dword fs:[0x34]
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0xa4], 0
je 0x401361
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jge 0x401357
push 0x4051a0
push 0x4051d8
push 0xad
push 0x4051fc
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xc5], al
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x401357
int 0x2c
mov dword [ebp - 0xa4], 0
xor ecx, ecx
jne 0x401303
movzx edx, byte [ebp - 5]
test edx, edx
je 0x40142c
cmp dword [ebp - 0x60], 0
je 0x4013c6
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jge 0x4013bf
push 0x405214
push 0x40524c
push 0xb0
push 0x405270
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xcd], al
movzx ecx, byte [ebp - 0xcd]
test ecx, ecx
je 0x4013bf
int 0x2c
mov dword [ebp - 0x60], 0
xor edx, edx
jne 0x401371
cmp dword [ebp - 0x5c], 0
je 0x40141f
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jge 0x401418
push str.NT_SUCCESS_SafeCloseStatus_
push 0x4052c0
push 0xb1
push 0x4052e4
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xd5], al
movzx ecx, byte [ebp - 0xd5]
test ecx, ecx
je 0x401418
int 0x2c
mov dword [ebp - 0x5c], 0
xor edx, edx
jne 0x4013ca
mov al, 1
jmp 0x40159b
cmp dword [ebp - 0x7c], 0x57
jne 0x401439
mov dword [ebp - 0x7c], 2
cmp dword [ebp - 0x7c], 0x2e4
jne 0x401444
jmp 0x401462
mov eax, dword [ebp - 0x7c]
push eax
call fcn.004034c0
push eax
push str.CreateProcess_failed:__s
call fcn.004026a0
add esp, 8
xor al, al
jmp 0x40159b
push 5
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.open
mov eax, dword [0x406654]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
ja 0x401599
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xec], ecx
cmp dword [ebp - 0xec], 0x20
ja case.0x4014af.1
mov edx, dword [ebp - 0xec]
movzx eax, byte [edx + 0x4015d4]
jmp dword [eax*4 + 0x4015a8]
mov dword [ebp - 0xdc], str.Insufficient_resources.
jmp 0x401581
mov ecx, dword [ebp - 4]
push ecx
call fcn.004034c0
mov dword [ebp - 0xdc], eax
jmp 0x401581
mov dword [ebp - 0xdc], str.Access_was_denied.
jmp 0x401581
mov dword [ebp - 0xdc], str.A_DLL_was_not_found.
jmp 0x401581
mov dword [ebp - 0xdc], str.A_sharing_violation_occurred.
jmp 0x401581
mov dword [ebp - 0xdc], str.SE_ERR_ASSOCINCOMPLETE.
jmp 0x401581
mov dword [ebp - 0xdc], str.SE_ERR_DDEBUSY.
jmp 0x401581
mov dword [ebp - 0xdc], str.SE_ERR_DDEFAIL.
jmp 0x401581
mov dword [ebp - 0xdc], str.SE_ERR_DDETIMEOUT.
jmp 0x401581
mov dword [ebp - 0xdc], str.SE_ERR_NOASSOC.
jmp 0x401581
mov edx, 1
test edx, edx
je 0x401577
push str.FALSE
push str.VklCreateProcess
push 0xfa
push str.creaproc.c
call fcn.00402760
add esp, 0x10
mov byte [ebp - 0xdd], al
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x401577
int 0x2c
mov dword [ebp - 0xdc], str.Unknown_error.
mov ecx, dword [ebp - 0xdc]
push ecx
push str.ShellExecute_failed:__s
call fcn.004026a0
add esp, 8
xor al, al
jmp 0x40159b
mov al, 1
lea esp, [ebp - 0xf0]
pop esi
mov esp, ebp
pop ebp
ret 8