Function at 0x401000
Capabilities:
Accept command line arguments
Acquire debug privileges
Allocate or change rwx memory
Create thread
Enumerate process modules
Execute shellcode via indirect call
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x95c
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x958], eax
push ebx
push esi
push edi
push 0xfffffffffffffff5
mov dword [esp + 0x18], 0x4020c8
mov dword [esp + 0x1c], str.d3d10.dll
mov dword [esp + 0x20], str.d3d11.dll
mov dword [esp + 0x24], str.d3d12.dll
mov dword [esp + 0x28], str.Opengl32.dll
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x4014b4
push 0x104
lea eax, [esp + 0x75c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [esi], 0x22
mov edi, eax
jne 0x401097
lea eax, [esp + 0x758]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401097
lea esi, [edi + 2]
lea esi, [eax + esi*2]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x20
push esi
mov edi, eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
test ebx, ebx
je 0x4014b4
sub eax, esi
sar eax, 1
cmp eax, 0xa
jg 0x4014b4
sub edi, eax
cmp edi, 0xa
jg 0x4014b4
inc eax
push eax
push esi
lea eax, [esp + 0x710]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebx + 2]
push eax
lea eax, [esp + 0x734]
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_StrToIntW]
lea eax, [esp + 0x708]
push eax
call esi
mov ebx, eax
lea eax, [esp + 0x730]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x4014b4
test esi, esi
je 0x4014b4
lea eax, [esp + 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40118d
lea eax, [esp + 0x34]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401183
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push 0
push 0
push 0x10
mov dword [esp + 0x50], eax
lea eax, [esp + 0x4c]
push eax
push 0
push dword [esp + 0x3c]
mov dword [esp + 0x58], 1
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffff
jne 0x40125b
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014b4
lea eax, [esp + 0x2e0]
mov dword [esp + 0x2e0], 0x428
push eax
push ebx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x40121e
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop dword [eax]
xor esi, esi
push dword [esp + esi*4 + 0x14]
lea eax, [esp + 0x304]
push eax
call edi
test eax, eax
je 0x401216
inc esi
cmp esi, 5
jb 0x4011e2
cmp dword [esp + 0x30], 0
jne 0x40121e
lea eax, [esp + 0x2e0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x4011e0
jmp 0x40121e
mov dword [esp + 0x30], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401242
push 0
lea ecx, [esp + 0x54]
push ecx
push 4
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x958]
xor ecx, esp
call fcn.004014dd
mov esp, ebp
pop ebp
ret
push 0x5c
push 0
lea eax, [esp + 0x760]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
push str.d3d_hook_x86.dll
add eax, 2
push eax
call edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x28], eax
test eax, eax
je 0x4014b4
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x40302d], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x403051], eax
lea eax, [esp + 0x758]
push eax
lea eax, [esp + 0x7c]
mov dword [0x40301f], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
mov dword [0x40303a], ecx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], 0
call edi
push 0x40
push 0x1000
push 0x26c
mov ecx, 0x17
lea edi, [esp + 0x28c]
mov esi, 0x403008
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x34]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4014b4
push 0
push 0x26c
lea eax, [esp + 0x78]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4014b4
push 0
push 0
push edi
lea eax, [edi + 0x210]
mov edi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
push 0
push 0
push esi
call edi
mov esi, eax
test esi, esi
je 0x4014b4
push 0xffffffffffffffff
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x2c]
cmp eax, 1
je 0x401478
cmp eax, 0x10000
jb 0x401395
cmp eax, 0x10002
jbe 0x401478
push 1
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0x401
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
push 0
add eax, 8
push eax
push dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push dword [esp + 0x40]
call edi
test eax, eax
je 0x4014b4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov dword [esp + 0x34], 5
nop dword [eax]
xor esi, esi
push edi
push ebx
push 0x401
push dword [esp + 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40140d
inc esi
cmp esi, 0x32
jl 0x4013f2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [esp + 0x34], 1
jne 0x4013f0
push 0
push 0x1cff
push 0x64
push 0
push 0
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
test eax, eax
jne 0x401478
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push eax
push eax
push eax
lea eax, [esp + 0x64]
push eax
call ebx
test eax, eax
je 0x401478
cmp dword [esp + 0x58], 0x401
je 0x401470
push 1
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call ebx
test eax, eax
jne 0x401451
jmp 0x401478
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x28]
push 0x8000
push 0
push dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 0x2c], 1
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x958]
xor ecx, esp
call fcn.004014dd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x964]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004014dd
mov esp, ebp
pop ebp
ret