why is this part of code looking like a virus?

[hananbeer]

besides anti-virus evasion, what would be the reason for this?

https://github.com/obsproject/obs-studio/blob/master/plugins/win-capture/inject-helper/inject-helper.c#L49-L54

[kkartaltepe]

Sounds like you got it.

[hananbeer]

my follow up question would be why would obs need to evade detection? any IDS should detect this regardless so it's just looking fishy
doesn't code signing help give this type of functionality more legitimacy?

[kkartaltepe]

why would obs need to evade detection?

Lets rephrase your question, why would obs need to work on users machines with anti-viruses? Because users would complain obs is broken otherwise.

doesn't code signing help give this type of functionality more legitimacy?

Code signing is a way to allow folks to eventually white list binaries, it does nothing to solve the first issue when you release software. And now that your code is signed, to change it is to invite endless suffering.