Function at 0x42b9e0
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x5be08c]
cmp dword [edi + 0x104], 0
je 0x42c79e
mov ecx, edi
mov byte [ebp - 0x239], 0
call fcn.004263f0
test al, al
je 0x42ba29
mov eax, dword [0x5be08c]
cmp dword [eax + 0xe20], 0
je 0x42baa3
lea esi, [edi + 0xd18]
push esi
push 0x104
push edi
call fcn.0051f3ce
add esp, 0xc
mov ecx, edi
call fcn.004263f0
test al, al
je 0x42c789
lea ecx, [ebp - 0x130]
call fcn.00426250
lea ecx, [ebp - 0x238]
call fcn.00426250
lea ecx, [ebp - 0x130]
call fcn.00426320
push esi
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x130]
call fcn.00427b90
test al, al
je 0x42c789
mov byte [ebp - 0x239], 1
push dword [edi + 0x790]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x24]
add esp, 0xc
push edi
push eax
push str.FileTransferEnabled
push str.admin
call ebx
push dword [edi + 0x794]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FTUserImpersonation
push str.admin
call ebx
push dword [edi + 0x798]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankMonitorEnabled
push str.admin
call ebx
push dword [edi + 0x79c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankInputsOnly
push str.admin
call ebx
push dword [edi + 0x7a0]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DefaultScale
push str.admin
call ebx
push dword [edi + 0x7b4]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseDSMPlugin
push str.admin
call ebx
push edi
lea eax, [edi + 0x7b8]
push eax
push str.DSMPlugin
push str.admin
call ebx
push dword [edi + 0xa38]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.primary
push str.admin
call ebx
push dword [edi + 0xa3c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.secondary
push str.admin
call ebx
push dword [edi + 0x720]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.SocketConnect
push str.admin
call ebx
push dword [edi + 0x724]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPConnect
push str.admin
call ebx
push dword [edi + 0x728]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AutoPortSelect
push str.admin
call ebx
cmp dword [edi + 0x728], 0
jne 0x42bcad
push dword [edi + 0x72c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PortNumber
push str.admin
call ebx
push dword [edi + 0x730]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPPortNumber
push str.admin
call ebx
push dword [edi + 0x774]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.InputsEnabled
push str.admin
call ebx
push dword [edi + 0x77c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LocalInputsDisabled
push str.admin
call ebx
push dword [edi + 0x758]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleTimeout
push str.admin
call ebx
push dword [edi + 0x780]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableJapInput
push str.admin
call ebx
push dword [edi + 0x784]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableUnicodeInput
push str.admin
call ebx
push dword [edi + 0x788]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableWin8Helper
push str.admin
call ebx
push dword [edi + 0x744]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QuerySetting
push str.admin
call ebx
push dword [edi + 0x750]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryTimeout
push str.admin
call ebx
push dword [edi + 0x754]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryDisableTime
push str.admin
call ebx
push dword [edi + 0x74c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryAccept
push str.admin
call ebx
push dword [edi + 0x75c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewerSetting
push str.admin
call ebx
push dword [edi + 0x760]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewers
push str.admin
call ebx
push dword [edi + 0x764]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Collabo
push str.admin
call ebx
push dword [edi + 0xa40]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.Frame
push str.admin
call ebx
push dword [edi + 0xa44]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Notification
push str.admin
call ebx
push dword [edi + 0xa48]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598ea0
push str.admin
call ebx
push dword [edi + 0xa4c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NotificationSelection
push str.admin
call ebx
push dword [edi + 0x778]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LockSetting
push str.admin
call ebx
push dword [edi + 0x768]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveWallpaper
push str.admin
call ebx
push dword [edi + 0x76c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveEffects
push str.admin
call ebx
push dword [edi + 0x770]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveFontSmoothing
push str.admin
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
lea eax, [edi + 0x734]
push edi
push 8
push eax
push str.passwd
push 0x59af10
call esi
push edi
push 8
lea eax, [edi + 0x73c]
push eax
push str.passwd2
push 0x59af10
call esi
push dword [0x5b0d54]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugMode
push str.admin
call ebx
movzx eax, byte [0x5b0f61]
push eax
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Avilog
push str.admin
call ebx
call fcn.00474da0
push edi
push eax
push str.path
push str.admin
call ebx
push dword [0x5b0d58]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugLevel
push str.admin
call ebx
push dword [edi + 0xa60]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowLoopback
push str.admin
call ebx
mov eax, dword [0x5be08c]
push dword [eax + 0xe64]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseIpv6
push str.admin
call ebx
push dword [edi + 0xa5c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598c78
push str.admin
call ebx
push dword [edi + 0x10c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowShutdown
push str.admin
call ebx
push dword [edi + 0x104]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowProperties
push str.admin
call ebx
push dword [edi + 0x108]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowInjection
push str.admin
call ebx
push dword [edi + 0x110]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowEditClients
push str.admin
call ebx
push dword [edi + 0x114]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FileTransferTimeout
push str.admin
call ebx
push dword [edi + 0x118]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.KeepAliveInterval
push str.admin
call ebx
push dword [edi + 0x11c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleInputTimeout
push str.admin
call ebx
push dword [edi + 0xa50]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x598c50
push str.admin
call ebx
push dword [edi + 0xa54]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.rdpmode
push str.admin
call ebx
push dword [edi + 0xa58]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.noscreensaver
push str.admin
call ebx
push dword [edi + 0x7a8]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Secure
push str.admin
call ebx
push dword [edi + 0x7a4]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.MSLogonRequired
push str.admin
call ebx
push dword [edi + 0x7ac]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NewMSLogon
push str.admin
call ebx
push dword [edi + 0x7b0]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ReverseAuthRequired
push str.admin
call ebx
push dword [edi + 0xa68]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ConnectPriority
push str.admin
call ebx
push edi
lea eax, [edi + 0x120]
push eax
push str.service_commandline
push str.admin
call ebx
push edi
lea eax, [edi + 0x520]
push eax
push str.accept_reject_mesg
push str.admin
call ebx
push dword [edi + 0xe30]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push dword [edi + 0xe34]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollUnderCursor
push str.poll
call ebx
push dword [edi + 0xe38]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollForeground
push str.poll
call ebx
push dword [edi + 0xe3c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollFullScreen
push str.poll
call ebx
push dword [edi + 0xe40]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push dword [edi + 0xe44]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push dword [edi + 0xe48]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxCpu2
push str.poll
call ebx
push dword [edi + 0xe4c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxFPS
push str.poll
call ebx
push dword [edi + 0xe50]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
push dword [edi + 0xe54]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push dword [edi + 0xe58]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableVirtual
push str.poll
call ebx
push dword [edi + 0xe60]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.autocapt
push str.poll
call ebx
push edi
lea eax, [edi + 0x1038]
push eax
push str.cloudServer
push str.admin
call ebx
movzx eax, byte [edi + 0x1132]
push eax
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.cloudEnabled
push str.admin
call ebx
push edi
lea eax, [edi + 0xe69]
push eax
push str.group1
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xeff]
push eax
push str.group2
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xf95]
push eax
push str.group3
push str.admin_auth
call ebx
push dword [edi + 0x102c]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom1
push str.admin_auth
call ebx
push dword [edi + 0x1030]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom2
push str.admin_auth
call ebx
push dword [edi + 0x1034]
lea eax, [ebp - 0x24]
push 0x59af04
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom3
push str.admin_auth
call ebx
cmp byte [ebp - 0x239], 0
je 0x42c79e
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea eax, [ebp - 0x238]
push str.__settingshelper
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x598af4
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
lea eax, [ebp - 0x238]
push edi
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x290]
push 0x44
push 0
push eax
call fcn.0051b450
add esp, 0xc
mov dword [ebp - 0x288], str.Winsta0Default
xorps xmm0, xmm0
mov dword [ebp - 0x290], 0x44
mov eax, 5
movups xmmword [ebp - 0x14], xmm0
push 0
push str.Shell_TrayWnd
mov word [ebp - 0x260], ax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42c76a
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x42c76a
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42c76a
lea eax, [ebp - 0x240]
push eax
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x42c74e
push ecx
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42c758
push eax
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42c762
push eax
call esi
cmp ebx, 0x522
jne 0x42c771
mov ecx, edi
call fcn.004232e0
mov ecx, edi
call fcn.00426320
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
push esi
push str.SettingsManager::save_:_file__s_not_writable__error_saving_new_settings_n
push 0
push 0x5b0d48
call fcn.0041cc90
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00519459
mov esp, ebp
pop ebp
ret