Function at 0x42c930
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x5d1914]
cmp dword [edi + 0x104], 0
je 0x42d6c4
mov ecx, edi
mov byte [ebp - 0x239], 0
call fcn.00427290
test al, al
je 0x42c979
mov eax, dword [0x5d1914]
cmp dword [eax + 0xe20], 0
je 0x42c9f3
lea esi, [edi + 0xd18]
push esi
push 0x104
push edi
call fcn.0052c1a3
add esp, 0xc
mov ecx, edi
call fcn.00427290
test al, al
je 0x42d6af
lea ecx, [ebp - 0x130]
call fcn.004270f0
lea ecx, [ebp - 0x238]
call fcn.004270f0
lea ecx, [ebp - 0x130]
call fcn.004271c0
push esi
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x130]
call fcn.00428a70
test al, al
je 0x42d6af
mov byte [ebp - 0x239], 1
push dword [edi + 0x790]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x24]
add esp, 0xc
push edi
push eax
push str.FileTransferEnabled
push str.admin
call ebx
push dword [edi + 0x794]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FTUserImpersonation
push str.admin
call ebx
push dword [edi + 0x798]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankMonitorEnabled
push str.admin
call ebx
push dword [edi + 0x79c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.BlankInputsOnly
push str.admin
call ebx
push dword [edi + 0x7a0]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DefaultScale
push str.admin
call ebx
push dword [edi + 0x7b4]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.UseDSMPlugin
push str.admin
call ebx
push edi
lea eax, [edi + 0x7b8]
push eax
push str.DSMPlugin
push str.admin
call ebx
push dword [edi + 0xa38]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.primary
push str.admin
call ebx
push dword [edi + 0xa3c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.secondary
push str.admin
call ebx
push dword [edi + 0x720]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.SocketConnect
push str.admin
call ebx
push dword [edi + 0x724]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPConnect
push str.admin
call ebx
push dword [edi + 0x728]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AutoPortSelect
push str.admin
call ebx
cmp dword [edi + 0x728], 0
jne 0x42cbfd
push dword [edi + 0x72c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PortNumber
push str.admin
call ebx
push dword [edi + 0x730]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.HTTPPortNumber
push str.admin
call ebx
push dword [edi + 0x774]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.InputsEnabled
push str.admin
call ebx
push dword [edi + 0x77c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LocalInputsDisabled
push str.admin
call ebx
push dword [edi + 0x758]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleTimeout
push str.admin
call ebx
push dword [edi + 0x780]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableJapInput
push str.admin
call ebx
push dword [edi + 0x784]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableUnicodeInput
push str.admin
call ebx
push dword [edi + 0x788]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableWin8Helper
push str.admin
call ebx
push dword [edi + 0x744]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QuerySetting
push str.admin
call ebx
push dword [edi + 0x750]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryTimeout
push str.admin
call ebx
push dword [edi + 0x754]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryDisableTime
push str.admin
call ebx
push dword [edi + 0x74c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.QueryAccept
push str.admin
call ebx
push dword [edi + 0x75c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewerSetting
push str.admin
call ebx
push dword [edi + 0x760]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxViewers
push str.admin
call ebx
push dword [edi + 0x764]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Collabo
push str.admin
call ebx
push dword [edi + 0xa40]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.Frame
push str.admin
call ebx
push dword [edi + 0xa44]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Notification
push str.admin
call ebx
push dword [edi + 0xa48]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5a8c98
push str.admin
call ebx
push dword [edi + 0xa4c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.NotificationSelection
push str.admin
call ebx
push dword [edi + 0x778]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.LockSetting
push str.admin
call ebx
push dword [edi + 0x768]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveWallpaper
push str.admin
call ebx
push dword [edi + 0x76c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveEffects
push str.admin
call ebx
push dword [edi + 0x770]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.RemoveFontSmoothing
push str.admin
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
lea eax, [edi + 0x734]
push edi
push 8
push eax
push str.passwd
push 0x5aad00
call esi
push edi
push 8
lea eax, [edi + 0x73c]
push eax
push str.passwd2
push 0x5aad00
call esi
push dword [0x5c3dbc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugMode
push str.admin
call ebx
movzx eax, byte [0x5c3fc9]
push eax
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Avilog
push str.admin
call ebx
call fcn.0047c850
push edi
push eax
push str.path
push str.admin
call ebx
push dword [0x5c3dc0]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.DebugLevel
push str.admin
call ebx
push dword [edi + 0xa60]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowLoopback
push str.admin
call ebx
push dword [edi + 0xa5c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5a8a70
push str.admin
call ebx
push dword [edi + 0x10c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowShutdown
push str.admin
call ebx
push dword [edi + 0x104]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowProperties
push str.admin
call ebx
push dword [edi + 0x108]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowInjection
push str.admin
call ebx
push dword [edi + 0x110]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.AllowEditClients
push str.admin
call ebx
push dword [edi + 0x114]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.FileTransferTimeout
push str.admin
call ebx
push dword [edi + 0x118]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.KeepAliveInterval
push str.admin
call ebx
push dword [edi + 0x11c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.IdleInputTimeout
push str.admin
call ebx
push dword [edi + 0xa50]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push 0x5a8a48
push str.admin
call ebx
push dword [edi + 0xa54]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.rdpmode
push str.admin
call ebx
push dword [edi + 0xa58]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.noscreensaver
push str.admin
call ebx
push dword [edi + 0x7a8]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.Secure
push str.admin
call ebx
push dword [edi + 0x7a4]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MSLogonRequired
push str.admin
call ebx
push dword [edi + 0x7ac]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x24]
push eax
push str.NewMSLogon
push str.admin
call ebx
push dword [edi + 0x7b0]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ReverseAuthRequired
push str.admin
call ebx
push dword [edi + 0xa68]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.ConnectPriority
push str.admin
call ebx
push edi
lea eax, [edi + 0x120]
push eax
push str.service_commandline
push str.admin
call ebx
push edi
lea eax, [edi + 0x520]
push eax
push str.accept_reject_mesg
push str.admin
call ebx
push dword [edi + 0xe30]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push dword [edi + 0xe34]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollUnderCursor
push str.poll
call ebx
push dword [edi + 0xe38]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollForeground
push str.poll
call ebx
push dword [edi + 0xe3c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.PollFullScreen
push str.poll
call ebx
push dword [edi + 0xe40]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push dword [edi + 0xe44]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push dword [edi + 0xe48]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxCpu2
push str.poll
call ebx
push dword [edi + 0xe4c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.MaxFPS
push str.poll
call ebx
push dword [edi + 0xe50]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
push dword [edi + 0xe54]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push dword [edi + 0xe58]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.EnableVirtual
push str.poll
call ebx
push dword [edi + 0xe60]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.autocapt
push str.poll
call ebx
push edi
lea eax, [edi + 0x1038]
push eax
push str.cloudServer
push str.admin
call ebx
movzx eax, byte [edi + 0x1132]
push eax
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.cloudEnabled
push str.admin
call ebx
push edi
lea eax, [edi + 0xe69]
push eax
push str.group1
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xeff]
push eax
push str.group2
push str.admin_auth
call ebx
push edi
lea eax, [edi + 0xf95]
push eax
push str.group3
push str.admin_auth
call ebx
push dword [edi + 0x102c]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom1
push str.admin_auth
call ebx
push dword [edi + 0x1030]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom2
push str.admin_auth
call ebx
push dword [edi + 0x1034]
lea eax, [ebp - 0x24]
push 0x5aacf4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x24]
push edi
push eax
push str.locdom3
push str.admin_auth
call ebx
cmp byte [ebp - 0x239], 0
je 0x42d6c4
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea eax, [ebp - 0x238]
push str.__settingshelper
push 0x104
push eax
call fcn.0052c1fd
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x5a88f0
push 0x104
push eax
call fcn.0052c1fd
add esp, 0xc
lea eax, [ebp - 0x238]
push edi
push 0x104
push eax
call fcn.0052c1fd
add esp, 0xc
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x290]
push 0x44
push 0
push eax
call fcn.00526a30
add esp, 0xc
mov dword [ebp - 0x288], str.Winsta0Default
xorps xmm0, xmm0
mov dword [ebp - 0x290], 0x44
mov eax, 5
movups xmmword [ebp - 0x14], xmm0
push 0
push str.Shell_TrayWnd
mov word [ebp - 0x260], ax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42d690
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x42d690
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42d690
lea eax, [ebp - 0x240]
push eax
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x42d674
push ecx
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42d67e
push eax
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42d688
push eax
call esi
cmp ebx, 0x522
jne 0x42d697
mov ecx, edi
call fcn.004241d0
mov ecx, edi
call fcn.004271c0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
push esi
push str.SettingsManager::save_:_file__s_not_writable__error_saving_new_settings_n
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret