Function at 0x4010d0
Capabilities:
Acquire debug privileges
Create process on windows
Create thread
Inject dll
Inject thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4e8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4e4], eax
push esi
push edi
push 0x40
lea eax, [esp + 0x50]
mov dword [esp + 0x4c], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [esp + 0x2e4]
mov dword [esp + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401160
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x403168
call fcn.00401010
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4e4]
xor ecx, esp
call fcn.0040150f
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x2e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.elementclient.bin
lea eax, [esp + 0x2e4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ax, word [0x4031e4]
movups xmm0, xmmword [str.startbypatcher_console:1]
mov word [esp + 0xc0], ax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0xc000004
push 0
movups xmmword [esp + 0xa8], xmm0
push 0
movups xmm0, xmmword [0x4031c4]
push 0
lea eax, [esp + 0xb0]
movups xmmword [esp + 0xc0], xmm0
push eax
movups xmm0, xmmword [0x4031d4]
lea eax, [esp + 0x304]
push eax
movups xmmword [esp + 0xd8], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40121e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Falha_ao_criar_o_processo:__lu_n
call fcn.00401010
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4e4]
xor ecx, esp
call fcn.0040150f
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [esp + 0x20]
lea eax, [esp + 0xd8]
mov esi, dword [esp + 0x24]
push 0x104
push eax
push dword [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40142a
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.PWApi.dll
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [esp + 0x28]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40143e
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401454
lea eax, [esp + 0x30]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401469
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
push 0
push 0x10
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x50], 1
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x401480
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401497
push str.LoadLibraryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4014ae
lea ecx, [esp + 0xd8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401337
sub ecx, edx
sar ecx, 1
push 4
push 0x1000
lea eax, [ecx*2 + 2]
push eax
push 0
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4014c5
push 0
push dword [esp + 0x1c]
lea ecx, [esp + 0xe0]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4014dc
push 0
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4014f5
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4013e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test esi, esi
je 0x4013fa
push esi
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401405
push eax
call edi
push str.PROCESSO_INICIADO___OK___n
call fcn.00401010
mov ecx, dword [esp + 0x4f0]
add esp, 4
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040150f
mov esp, ebp
pop ebp
ret 0x10
push str.Falha_ao_obter_o_nome_do_m
push 0
push 0
push 0
mov edx, esi
mov ecx, edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_abrir_o_processo_remoto
push 0
push 0
push 0
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_abrir_o_token_do_processo
push 0
push 0
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_buscar_o_valor_do_privil
push 0
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_ajustar_privil
push 0
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_obter_o_handle_de_kernel32.dll
push 0
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_obter_o_endere
push 0
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_alocar_mem
push 0
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_escrever_o_caminho_da_DLL_na_mem
push dword [esp + 0x14]
push dword [esp + 0x24]
push edi
call fcn.00401050
mov ecx, dword [esp + 0xc]
mov edx, esi
push str.Falha_ao_criar_thread_remota
push dword [esp + 0x14]
push dword [esp + 0x24]
push edi
call fcn.00401050
int3