Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process - View it on GitHub