Function at 0x42c380
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5d60c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x5e44e8]
cmp dword [edi + 0x104], 0
je 0x42d13e
mov ecx, edi
mov byte [ebp - 0x239], 0
call fcn.00426df0
test al, al
je 0x42c3c9
mov eax, dword [0x5e44e8]
cmp dword [eax + 0xe20], 0
je 0x42c443
lea esi, [edi + 0xd18]
push esi
push 0x104
push edi
call fcn.0053193e
add esp, 0xc
mov ecx, edi
call fcn.00426df0
test al, al
je 0x42d129
lea ecx, [ebp - 0x130]
call fcn.00426c50
lea ecx, [ebp - 0x238]
call fcn.00426c50
lea ecx, [ebp - 0x130]
call fcn.00426d20
push esi
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0053193e
add esp, 0xc
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x130]
call fcn.00428590
test al, al
je 0x42d129
mov byte [ebp - 0x239], 1
push dword [edi + 0x790]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x24]
add esp, 0xc
push edi
push eax
push str.FileTransferEnabled
push str.admin
call ebx
push dword [edi + 0x794]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FTUserImpersonation
push str.admin
call ebx
push dword [edi + 0x798]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankMonitorEnabled
push str.admin
call ebx
push dword [edi + 0x79c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankInputsOnly
push str.admin
call ebx
push dword [edi + 0x7a0]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DefaultScale
push str.admin
call ebx
push dword [edi + 0x7b4]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseDSMPlugin
push str.admin
call ebx
push edi
lea eax, [edi + 0x7b8]
push eax
push str.DSMPlugin
push str.admin
call ebx
push dword [edi + 0xa38]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.primary
push str.admin
call ebx
push dword [edi + 0xa3c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.secondary
push str.admin
call ebx
push dword [edi + 0x720]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.SocketConnect
push str.admin
call ebx
push dword [edi + 0x724]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPConnect
push str.admin
call ebx
push dword [edi + 0x728]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AutoPortSelect
push str.admin
call ebx
cmp dword [edi + 0x728], 0
jne 0x42c64d
push dword [edi + 0x72c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PortNumber
push str.admin
call ebx
push dword [edi + 0x730]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPPortNumber
push str.admin
call ebx
push dword [edi + 0x774]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.InputsEnabled
push str.admin
call ebx
push dword [edi + 0x77c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LocalInputsDisabled
push str.admin
call ebx
push dword [edi + 0x758]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleTimeout
push str.admin
call ebx
push dword [edi + 0x780]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableJapInput
push str.admin
call ebx
push dword [edi + 0x784]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableUnicodeInput
push str.admin
call ebx
push dword [edi + 0x788]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableWin8Helper
push str.admin
call ebx
push dword [edi + 0x744]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QuerySetting
push str.admin
call ebx
push dword [edi + 0x750]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryTimeout
push str.admin
call ebx
push dword [edi + 0x754]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryDisableTime
push str.admin
call ebx
push dword [edi + 0x74c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryAccept
push str.admin
call ebx
push dword [edi + 0x75c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewerSetting
push str.admin
call ebx
push dword [edi + 0x760]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewers
push str.admin
call ebx
push dword [edi + 0x764]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Collabo
push str.admin
call ebx
push dword [edi + 0xa40]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.Frame
push str.admin
call ebx
push dword [edi + 0xa44]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Notification
push str.admin
call ebx
push dword [edi + 0xa48]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5c03f0
push str.admin
call ebx
push dword [edi + 0xa4c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NotificationSelection
push str.admin
call ebx
push dword [edi + 0x778]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LockSetting
push str.admin
call ebx
push dword [edi + 0x768]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveWallpaper
push str.admin
call ebx
push dword [edi + 0x76c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveEffects
push str.admin
call ebx
push dword [edi + 0x770]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveFontSmoothing
push str.admin
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
lea eax, [edi + 0x734]
push edi
push 8
push eax
push str.passwd
push str.UltraVNC
call esi
push edi
push 8
lea eax, [edi + 0x73c]
push eax
push str.passwd2
push str.UltraVNC
call esi
push dword [0x5d6e04]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugMode
push str.admin
call ebx
movzx eax, byte [0x5d7011]
push eax
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Avilog
push str.admin
call ebx
call fcn.00476420
push edi
push eax
push str.path
push str.admin
call ebx
push dword [0x5d6e08]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugLevel
push str.admin
call ebx
push dword [edi + 0xa60]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowLoopback
push str.admin
call ebx
mov eax, dword [0x5e44e8]
push dword [eax + 0xe64]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseIpv6
push str.admin
call ebx
push dword [edi + 0xa5c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5c01c8
push str.admin
call ebx
push dword [edi + 0x10c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowShutdown
push str.admin
call ebx
push dword [edi + 0x104]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowProperties
push str.admin
call ebx
push dword [edi + 0x108]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowInjection
push str.admin
call ebx
push dword [edi + 0x110]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowEditClients
push str.admin
call ebx
push dword [edi + 0x114]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FileTransferTimeout
push str.admin
call ebx
push dword [edi + 0x118]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.KeepAliveInterval
push str.admin
call ebx
push dword [edi + 0x11c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleInputTimeout
push str.admin
call ebx
push dword [edi + 0xa50]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5c01a0
push str.admin
call ebx
push dword [edi + 0xa54]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.rdpmode
push str.admin
call ebx
push dword [edi + 0xa58]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.noscreensaver
push str.admin
call ebx
push dword [edi + 0x7a8]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Secure
push str.admin
call ebx
push dword [edi + 0x7a4]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.MSLogonRequired
push str.admin
call ebx
push dword [edi + 0x7ac]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NewMSLogon
push str.admin
call ebx
push dword [edi + 0x7b0]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ReverseAuthRequired
push str.admin
call ebx
push dword [edi + 0xa68]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ConnectPriority
push str.admin
call ebx
push edi
lea eax, [edi + 0x120]
push eax
push str.service_commandline
push str.admin
call ebx
push edi
lea eax, [edi + 0x520]
push eax
push str.accept_reject_mesg
push str.admin
call ebx
push dword [edi + 0xe30]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push dword [edi + 0xe34]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollUnderCursor
push str.poll
call ebx
push dword [edi + 0xe38]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollForeground
push str.poll
call ebx
push dword [edi + 0xe3c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollFullScreen
push str.poll
call ebx
push dword [edi + 0xe40]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push dword [edi + 0xe44]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push dword [edi + 0xe48]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxCpu2
push str.poll
call ebx
push dword [edi + 0xe4c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxFPS
push str.poll
call ebx
push dword [edi + 0xe50]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
push dword [edi + 0xe54]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push dword [edi + 0xe58]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableVirtual
push str.poll
call ebx
push dword [edi + 0xe60]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.autocapt
push str.poll
call ebx
push edi
lea eax, [edi + 0x1038]
push eax
push str.cloudServer
push str.admin
call ebx
movzx eax, byte [edi + 0x1132]
push eax
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.cloudEnabled
push str.admin
call ebx
push edi
lea eax, [edi + 0xe69]
push eax
push str.group1
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xeff]
push eax
push str.group2
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xf95]
push eax
push str.group3
push str.admin_auth
call ebx
push dword [edi + 0x102c]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom1
push str.admin_auth
call ebx
push dword [edi + 0x1030]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom2
push str.admin_auth
call ebx
push dword [edi + 0x1034]
lea eax, [ebp - 0x24]
push 0x5c258c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom3
push str.admin_auth
call ebx
cmp byte [ebp - 0x239], 0
je 0x42d13e
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0053193e
add esp, 0xc
lea eax, [ebp - 0x238]
push str.__settingshelper
push 0x104
push eax
call fcn.00531998
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x5c0044
push 0x104
push eax
call fcn.00531998
add esp, 0xc
lea eax, [ebp - 0x238]
push edi
push 0x104
push eax
call fcn.00531998
add esp, 0xc
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x290]
push 0x44
push 0
push eax
call fcn.0052d9b0
add esp, 0xc
mov dword [ebp - 0x288], str.Winsta0Default
xorps xmm0, xmm0
mov dword [ebp - 0x290], 0x44
mov eax, 5
movups xmmword [ebp - 0x14], xmm0
push 0
push str.Shell_TrayWnd
mov word [ebp - 0x260], ax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42d10a
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x42d10a
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42d10a
lea eax, [ebp - 0x240]
push eax
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x42d0ee
push ecx
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42d0f8
push eax
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42d102
push eax
call esi
cmp ebx, 0x522
jne 0x42d111
mov ecx, edi
call fcn.00423a80
mov ecx, edi
call fcn.00426d20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052b789
mov esp, ebp
pop ebp
ret
push esi
push str.SettingsManager::save_:_file__s_not_writable__error_saving_new_settings_n
push 0
push 0x5d6df8
call fcn.0041d510
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b789
mov esp, ebp
pop ebp
ret