Function at 0x42ae70
Capabilities:
Create process on windows
Read .ini file
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4be6
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x338]
call fcn.004268c0
lea eax, [ebp - 0x338]
push eax
push 0
push str.rdpmode
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor cl, cl
mov dword [ebp - 0x340], eax
call fcn.0042a5c0
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
xor edi, edi
push str.GlobalSessionEventUltra
push edi
push 0x1f0003
mov dword [ebp - 0x344], 0x63
mov dword [0x55abe4], edi
mov byte [ebp - 0x339], 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x55abfc], eax
test eax, eax
je 0x42af41
nop word [eax + eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x55abfc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call ebx
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call esi
mov dword [0x55abfc], eax
test eax, eax
jne 0x42af10
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.GlobalSessionEventUltra
push 0
push 0
push 0
call esi
push str.GlobalSessionEventUltraCad
push 0
push 0
push 0
mov dword [0x55abfc], eax
call esi
push str.GlobalSessionEventUltraPreConnect
push 0
push 0
push 0
mov dword [0x55abac], eax
call esi
push str.GlobalSessionUltraPreConnect
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [0x55abf8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x55abd8], eax
test eax, eax
je 0x42afaf
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x55abe0], eax
push 0xbb8
call ebx
mov eax, dword [0x55abe0]
mov esi, 0x63
mov ecx, dword [0x55abac]
mov edx, dword [0x55ac04]
mov dword [ebp - 0x368], eax
mov eax, dword [0x55abf8]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x374], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x378], edx
jmp 0x42b016
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [eax]
mov esi, dword [ebp - 0x344]
cmp dword [0x55ad0c], 4
jne 0x42b732
push 0x3e8
push 0
test eax, eax
je 0x42b039
lea eax, [ebp - 0x22c]
push eax
push 3
jmp 0x42b042
lea eax, [ebp - 0x378]
push eax
push 2
call ecx
cmp eax, 2
ja 0x42b262
je 0x42b175
sub eax, 0
je 0x42b732
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 1
mov eax, dword [ebp - 0x340]
jne 0x42b016
push str.sas.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.SendSAS
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b093
push 0
call eax
jmp 0x42b14f
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42b0c7
lea eax, [ebp - 0x220]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x42b7d5
mov byte [eax], 0
push 0x518188
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x53e1f8
push 0x104
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [ebp - 0x118]
push str.cad.exe
push 0x104
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [ebp - 0x118]
push 1
push 0
push 0x518188
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test esi, esi
je 0x42b010
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x340]
jmp 0x42b003
push dword [0x55abfc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x368]
mov dword [ebp - 0x34c], 0x103
mov eax, dword [ecx]
mov dword [ebp - 0x344], eax
nop dword [eax]
mov eax, dword [0x55abe4]
test eax, eax
je 0x42b207
lea ecx, [ebp - 0x34c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x34c], 0x103
je 0x42b1f4
push 0x3a98
push dword [0x55abe4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x55abe4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b1e6
push eax
call esi
mov eax, dword [0x55abe8]
test eax, eax
je 0x42b1fb
push eax
call esi
jmp 0x42b1fb
push 0x3e8
call ebx
cmp dword [ebp - 0x34c], 0x103
je 0x42b1a0
or edi, 0xffffffff
xor esi, esi
nop dword [eax]
mov eax, dword [0x569b98]
mov ebx, esi
test eax, eax
je 0x42b21f
call eax
mov edi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp ebx, 0xa
jge 0x42b235
cmp edi, 0xffffffff
je 0x42b210
mov esi, dword [ebp - 0x344]
xor dl, dl
mov ecx, esi
call fcn.0042aa90
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [ebp - 0x339], 1
jmp 0x42b016
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
mov eax, dword [ebp - 0x340]
jne 0x42b016
test eax, eax
je 0x42b58b
cmp dword [0x55abe4], 0
jne 0x42b319
call fcn.0042a460
test al, al
je 0x42b2c0
mov dl, 1
xor ecx, ecx
call fcn.0042aa90
mov eax, dword [ebp - 0x340]
xor esi, esi
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x344], esi
mov byte [ebp - 0x339], 0
jmp 0x42b016
or edi, 0xffffffff
xor esi, esi
mov eax, dword [0x569b98]
mov ebx, esi
test eax, eax
je 0x42b2d4
call eax
mov edi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp ebx, 0xa
jge 0x42b2ea
cmp edi, 0xffffffff
je 0x42b2c5
xor dl, dl
mov ecx, edi
call fcn.0042aa90
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, edi
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x344], esi
mov byte [ebp - 0x339], 0
jmp 0x42b016
cmp byte [ebp - 0x339], 1
jne 0x42b4b4
xor esi, esi
push str.wtsapi32
mov dword [ebp - 0x370], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x36c], ebx
test ebx, ebx
je 0x42b359
push str.WTSEnumerateSessionsA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x370], esi
xor eax, eax
mov dword [ebp - 4], 0
push str.wtsapi32
mov dword [ebp - 0x364], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x360], eax
test eax, eax
je 0x42b399
push str.WTSFreeMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x364], ecx
jmp 0x42b39b
xor ecx, ecx
mov byte [ebp - 4], 1
test esi, esi
je 0x42b487
test ecx, ecx
je 0x42b487
lea eax, [ebp - 0x350]
mov dword [ebp - 0x348], 0
push eax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x350], 0
push eax
push 1
xor ebx, ebx
push ebx
push ebx
call esi
test eax, eax
je 0x42b45a
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x354], ebx
cmp dword [ebp - 0x350], ebx
jbe 0x42b451
xor esi, esi
test ebx, ebx
jne 0x42b451
push str.Console
push dword [esi + ecx + 4]
call fcn.004dadd3
mov ecx, dword [ebp - 0x348]
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x344]
jne 0x42b41d
cmp dword [esi + ecx], eax
jmp 0x42b432
cmp dword [esi + ecx], eax
jne 0x42b439
mov eax, dword [esi + ecx + 8]
test eax, eax
je 0x42b434
cmp eax, 3
je 0x42b434
cmp eax, 2
jne 0x42b439
mov ebx, 1
mov eax, dword [ebp - 0x354]
add esi, 0xc
inc eax
mov dword [ebp - 0x354], eax
cmp eax, dword [ebp - 0x350]
jb 0x42b3f3
mov eax, dword [ebp - 0x364]
push ecx
call eax
mov eax, dword [ebp - 0x360]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x42b46d
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x36c]
test eax, eax
je 0x42b481
push eax
call esi
test ebx, ebx
je 0x42b4a2
jmp 0x42b4ae
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x42b494
push eax
call esi
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x42b4a2
push ebx
call esi
push dword [0x55abfc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], 0
push eax
push dword [0x55abe4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42b544
mov eax, dword [0x55abe4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b4e7
push eax
call esi
mov eax, dword [0x55abe8]
test eax, eax
je 0x42b4f3
push eax
call esi
lea eax, [ebp - 0x338]
mov dword [0x55abe4], 0
push eax
push 0
push str.rdpmode
push str.admin
mov dword [0x55abe8], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x3e8
mov dword [ebp - 0x340], eax
call ebx
mov esi, dword [ebp - 0x344]
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x42b016
cmp dword [ebp - 0x358], 0x103
mov esi, dword [ebp - 0x344]
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
je 0x42b016
mov eax, dword [0x55abe4]
test eax, eax
je 0x42b580
push 0x3a98
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x42b4d5
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42b4e7
mov eax, dword [0x569b98]
test eax, eax
je 0x42b598
call eax
mov edi, eax
cmp esi, edi
je 0x42b5a8
push dword [0x55abfc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp edi, 0xffffffff
je 0x42b016
mov eax, dword [0x55abe4]
mov dword [ebp - 0x35c], 0
test eax, eax
jne 0x42b5f2
xor dl, dl
mov ecx, edi
call fcn.0042aa90
mov eax, dword [ebp - 0x340]
mov esi, edi
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x344], esi
jmp 0x42b016
lea ecx, [ebp - 0x35c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42b69d
cmp dword [ebp - 0x35c], 0x103
mov eax, dword [ebp - 0x340]
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
je 0x42b016
push 0x3a98
push dword [0x55abe4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x55abe4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b647
push eax
call esi
mov eax, dword [0x55abe8]
test eax, eax
je 0x42b653
push eax
call esi
mov dword [0x55abe4], 0
xor esi, esi
mov dword [0x55abe8], 0
nop dword [eax]
cmp dword [ebp - 0x344], edi
je 0x42b681
cmp edi, 0xffffffff
jne 0x42b70e
push 0x3e8
call ebx
mov eax, dword [0x569b98]
test eax, eax
je 0x42b695
call eax
mov edi, eax
inc esi
cmp esi, 0xa
jle 0x42b670
jmp 0x42b70e
mov eax, dword [0x55abe4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b6af
push eax
call esi
mov eax, dword [0x55abe8]
test eax, eax
je 0x42b6bb
push eax
call esi
xor esi, esi
mov dword [0x55abe4], 0
mov dword [0x55abe8], 0
cmp dword [ebp - 0x344], edi
jne 0x42b70e
nop dword [eax]
push 0x3e8
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x569b98]
test eax, eax
je 0x42b6fa
call eax
mov edi, eax
inc esi
cmp ebx, 0xa
jge 0x42b708
cmp dword [ebp - 0x344], edi
je 0x42b6e0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x338]
push eax
push 0
push str.rdpmode
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x340], eax
jmp 0x42b003
mov eax, dword [0x55abfc]
test eax, eax
je 0x42b747
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x55abfc]
mov ecx, dword [0x55abe4]
test ecx, ecx
je 0x42b794
push 0x3a98
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x55abe4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b76f
push eax
call ebx
mov eax, dword [0x55abe8]
test eax, eax
je 0x42b77b
push eax
call ebx
mov eax, dword [0x55abfc]
mov dword [0x55abe4], 0
mov dword [0x55abe8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b7a1
push eax
call ebx
mov eax, dword [0x55abac]
test eax, eax
je 0x42b7ad
push eax
call ebx
mov eax, dword [0x55abf8]
test eax, eax
je 0x42b7b9
push eax
call ebx
mov eax, dword [0x55abe0]
test eax, eax
je 0x42b7c9
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x55abd8]
test eax, eax
je 0x42b7d5
push eax
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret