Function at 0x42b8d0
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x5bdff0]
cmp dword [edi + 0x104], 0
je 0x42c664
mov ecx, edi
mov byte [ebp - 0x239], 0
call fcn.00426300
test al, al
je 0x42b919
mov eax, dword [0x5bdff0]
cmp dword [eax + 0xe20], 0
je 0x42b993
lea esi, [edi + 0xd18]
push esi
push 0x104
push edi
call fcn.0051e70e
add esp, 0xc
mov ecx, edi
call fcn.00426300
test al, al
je 0x42c64f
lea ecx, [ebp - 0x130]
call fcn.00426160
lea ecx, [ebp - 0x238]
call fcn.00426160
lea ecx, [ebp - 0x130]
call fcn.00426230
push esi
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0051e70e
add esp, 0xc
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x130]
call fcn.00427ae0
test al, al
je 0x42c64f
mov byte [ebp - 0x239], 1
push dword [edi + 0x790]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x24]
add esp, 0xc
push edi
push eax
push str.FileTransferEnabled
push str.admin
call ebx
push dword [edi + 0x794]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FTUserImpersonation
push str.admin
call ebx
push dword [edi + 0x798]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankMonitorEnabled
push str.admin
call ebx
push dword [edi + 0x79c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankInputsOnly
push str.admin
call ebx
push dword [edi + 0x7a0]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DefaultScale
push str.admin
call ebx
push dword [edi + 0x7b4]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseDSMPlugin
push str.admin
call ebx
push edi
lea eax, [edi + 0x7b8]
push eax
push str.DSMPlugin
push str.admin
call ebx
push dword [edi + 0xa38]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.primary
push str.admin
call ebx
push dword [edi + 0xa3c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.secondary
push str.admin
call ebx
push dword [edi + 0x720]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.SocketConnect
push str.admin
call ebx
push dword [edi + 0x724]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPConnect
push str.admin
call ebx
push dword [edi + 0x728]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AutoPortSelect
push str.admin
call ebx
cmp dword [edi + 0x728], 0
jne 0x42bb9d
push dword [edi + 0x72c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PortNumber
push str.admin
call ebx
push dword [edi + 0x730]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPPortNumber
push str.admin
call ebx
push dword [edi + 0x774]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.InputsEnabled
push str.admin
call ebx
push dword [edi + 0x77c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LocalInputsDisabled
push str.admin
call ebx
push dword [edi + 0x758]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleTimeout
push str.admin
call ebx
push dword [edi + 0x780]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableJapInput
push str.admin
call ebx
push dword [edi + 0x784]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableUnicodeInput
push str.admin
call ebx
push dword [edi + 0x788]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableWin8Helper
push str.admin
call ebx
push dword [edi + 0x744]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QuerySetting
push str.admin
call ebx
push dword [edi + 0x750]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryTimeout
push str.admin
call ebx
push dword [edi + 0x754]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryDisableTime
push str.admin
call ebx
push dword [edi + 0x74c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryAccept
push str.admin
call ebx
push dword [edi + 0x75c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewerSetting
push str.admin
call ebx
push dword [edi + 0x760]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewers
push str.admin
call ebx
push dword [edi + 0x764]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Collabo
push str.admin
call ebx
push dword [edi + 0xa40]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.Frame
push str.admin
call ebx
push dword [edi + 0xa44]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Notification
push str.admin
call ebx
push dword [edi + 0xa48]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598e38
push str.admin
call ebx
push dword [edi + 0xa4c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NotificationSelection
push str.admin
call ebx
push dword [edi + 0x778]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LockSetting
push str.admin
call ebx
push dword [edi + 0x768]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveWallpaper
push str.admin
call ebx
push dword [edi + 0x76c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveEffects
push str.admin
call ebx
push dword [edi + 0x770]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveFontSmoothing
push str.admin
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
lea eax, [edi + 0x734]
push edi
push 8
push eax
push str.passwd
push 0x59aea0
call esi
push edi
push 8
lea eax, [edi + 0x73c]
push eax
push str.passwd2
push 0x59aea0
call esi
push dword [0x5b0d54]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugMode
push str.admin
call ebx
movzx eax, byte [0x5b0f61]
push eax
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Avilog
push str.admin
call ebx
call fcn.00475400
push edi
push eax
push str.path
push str.admin
call ebx
push dword [0x5b0d58]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugLevel
push str.admin
call ebx
push dword [edi + 0xa60]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowLoopback
push str.admin
call ebx
push dword [edi + 0xa5c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598c10
push str.admin
call ebx
push dword [edi + 0x10c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowShutdown
push str.admin
call ebx
push dword [edi + 0x104]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowProperties
push str.admin
call ebx
push dword [edi + 0x108]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowInjection
push str.admin
call ebx
push dword [edi + 0x110]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowEditClients
push str.admin
call ebx
push dword [edi + 0x114]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FileTransferTimeout
push str.admin
call ebx
push dword [edi + 0x118]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.KeepAliveInterval
push str.admin
call ebx
push dword [edi + 0x11c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleInputTimeout
push str.admin
call ebx
push dword [edi + 0xa50]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598be8
push str.admin
call ebx
push dword [edi + 0xa54]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.rdpmode
push str.admin
call ebx
push dword [edi + 0xa58]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.noscreensaver
push str.admin
call ebx
push dword [edi + 0x7a8]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Secure
push str.admin
call ebx
push dword [edi + 0x7a4]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MSLogonRequired
push str.admin
call ebx
push dword [edi + 0x7ac]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.NewMSLogon
push str.admin
call ebx
push dword [edi + 0x7b0]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ReverseAuthRequired
push str.admin
call ebx
push dword [edi + 0xa68]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ConnectPriority
push str.admin
call ebx
push edi
lea eax, [edi + 0x120]
push eax
push str.service_commandline
push str.admin
call ebx
push edi
lea eax, [edi + 0x520]
push eax
push str.accept_reject_mesg
push str.admin
call ebx
push dword [edi + 0xe30]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push dword [edi + 0xe34]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollUnderCursor
push str.poll
call ebx
push dword [edi + 0xe38]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollForeground
push str.poll
call ebx
push dword [edi + 0xe3c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollFullScreen
push str.poll
call ebx
push dword [edi + 0xe40]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push dword [edi + 0xe44]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push dword [edi + 0xe48]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxCpu2
push str.poll
call ebx
push dword [edi + 0xe4c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxFPS
push str.poll
call ebx
push dword [edi + 0xe50]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
push dword [edi + 0xe54]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push dword [edi + 0xe58]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableVirtual
push str.poll
call ebx
push dword [edi + 0xe60]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.autocapt
push str.poll
call ebx
push edi
lea eax, [edi + 0x1038]
push eax
push str.cloudServer
push str.admin
call ebx
movzx eax, byte [edi + 0x1132]
push eax
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.cloudEnabled
push str.admin
call ebx
push edi
lea eax, [edi + 0xe69]
push eax
push str.group1
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xeff]
push eax
push str.group2
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xf95]
push eax
push str.group3
push str.admin_auth
call ebx
push dword [edi + 0x102c]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom1
push str.admin_auth
call ebx
push dword [edi + 0x1030]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom2
push str.admin_auth
call ebx
push dword [edi + 0x1034]
lea eax, [ebp - 0x24]
push 0x59ae94
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom3
push str.admin_auth
call ebx
cmp byte [ebp - 0x239], 0
je 0x42c664
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0051e70e
add esp, 0xc
lea eax, [ebp - 0x238]
push str.__settingshelper
push 0x104
push eax
call fcn.0051e768
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x598a90
push 0x104
push eax
call fcn.0051e768
add esp, 0xc
lea eax, [ebp - 0x238]
push edi
push 0x104
push eax
call fcn.0051e768
add esp, 0xc
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x290]
push 0x44
push 0
push eax
call fcn.0051a780
add esp, 0xc
mov dword [ebp - 0x288], str.Winsta0Default
xorps xmm0, xmm0
mov dword [ebp - 0x290], 0x44
mov eax, 5
movups xmmword [ebp - 0x14], xmm0
push 0
push str.Shell_TrayWnd
mov word [ebp - 0x260], ax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42c630
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x42c630
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42c630
lea eax, [ebp - 0x240]
push eax
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x42c614
push ecx
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42c61e
push eax
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42c628
push eax
call esi
cmp ebx, 0x522
jne 0x42c637
mov ecx, edi
call fcn.004231f0
mov ecx, edi
call fcn.00426230
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret
push esi
push str.SettingsManager::save_:_file__s_not_writable__error_saving_new_settings_n
push 0
push 0x5b0d48
call fcn.0041ccb0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00518799
mov esp, ebp
pop ebp
ret