Function at 0x10006aa0
Capabilities:
Acquire debug privileges
Check os version
Create thread
Encode data using xor
Get token membership
Query or enumerate registry value
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x944
mov eax, dword [0x1009e090]
xor eax, esp
mov dword [esp + 0x940], eax
sub dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x10006ec7
call sym.D3DX.dll_DirectDrawImage
cmp dword [0x100a56ac], 0xb7
jne 0x10006ae0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x40]
call fcn.100010f0
push 0x104
lea eax, [esp + 0x444]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x440]
or ebx, 0xffffffff
push 0x1009631c
push eax
call fcn.1005b450
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10006b23
or ebx, 0xffffffff
jmp 0x10006b7e
push eax
push 0x400
lea eax, [esp + 0x550]
push 1
push eax
call fcn.1005b748
mov edi, eax
lea esi, [esp + 0x558]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x10006b67
nop word [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [esp + ecx*4 + 0x40]
sub edx, 1
jne 0x10006b50
mov eax, dword [esp + 0x10]
cmp edi, 0x400
je 0x10006b23
push eax
call fcn.1005b4de
add esp, 4
not ebx
cmp dword [0x100a4d8c], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0xa24cfa], ebx
jne 0x10006cb5
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x10006cb5
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006cb5
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.MoveImages
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10006bfd
mov dword [0x100a4d48], 1
jmp 0x10006cb5
xor edi, edi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x50]
mov dword [esp + 0x50], edi
push eax
mov word [esp + 0x58], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10006c4d
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10006c55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006c6c
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esp + 0x10], 0
test edi, edi
jne 0x10006ee3
cmp dword [esp + 0x14], edi
je 0x10006ca4
cmp dword [0x100a4d48], edi
jne 0x10006c8e
push edi
push edi
push edi
push 0x100023c0
push edi
push edi
call esi
cmp dword [0x100a4d4c], 0
jne 0x10006cb5
push 0
push 0
push 0
push 0x10002440
jmp 0x10006caf
push 0
push 0
push 0
push 0x10002740
push 0
push 0
call esi
cmp dword [0x100a4db4], 1
jne 0x10006ccf
push 0
push 0
push 0
push 0x100068f0
push 0
push 0
call esi
cmp dword [0x100a4d78], 1
jne 0x10006ce9
push 0
push 0
push 0
push 0x100086c0
push 0
push 0
call esi
cmp dword [0x100a4d9c], 1
jne 0x10006d03
push 0
push 0
push 0
push 0x10008080
push 0
push 0
call esi
cmp dword [0x100a4d7c], 1
jne 0x10006d1d
push 0
push 0
push 0
push 0x10005790
push 0
push 0
call esi
cmp dword [0x100a4da8], 1
jne 0x10006d37
push 0
push 0
push 0
push 0x100072f0
push 0
push 0
call esi
cmp dword [0x100a4da0], 1
jne 0x10006d51
push 0
push 0
push 0
push 0x10006510
push 0
push 0
call esi
cmp dword [0x100a4da4], 1
jne 0x10006d6b
push 0
push 0
push 0
push 0x10001590
push 0
push 0
call esi
cmp dword [0x100a4dac], 1
jne 0x10006d85
push 0
push 0
push 0
push 0x10001290
push 0
push 0
call esi
cmp dword [0x100a4d88], 1
jne 0x10006e1a
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006e1a
lea eax, [esp + 0x28]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10006e1a
mov eax, dword [esp + 0x28]
push 0
push 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x34]
push 0x10
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10006e1a
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006e1a
push 0
push 0
push 0
push 0x10007450
push 0
push 0
call esi
cmp dword [0x100a4d94], 1
jne 0x10006e34
push 0
push 0
push 0
push 0x10008360
push 0
push 0
call esi
cmp dword [0x100a4d84], 1
jne 0x10006e4e
push 0
push 0
push 0
push 0x10008200
push 0
push 0
call esi
cmp dword [0x100a4db8], 1
jne 0x10006e68
push 0
push 0
push 0
push 0x10008620
push 0
push 0
call esi
cmp dword [0x100a4db0], 1
jne 0x10006e82
push 0
push 0
push 0
push 0x10001630
push 0
push 0
call esi
cmp dword [0x100a4d90], 1
jne 0x10006e9c
push 0
push 0
push 0
push 0x10006570
push 0
push 0
call esi
cmp dword [0x100a4d80], 1
jne 0x10006ec7
push 0
push 0
push 0
push 0x10008810
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008b20
push 0
push 0
call esi
mov ecx, dword [esp + 0x94c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10040099
mov esp, ebp
pop ebp
ret 0xc
push 0x1009bf60
lea eax, [esp + 0x24]
mov dword [esp + 0x24], edi
push eax
call fcn.1005871d
int3