Function at 0x42bf30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push edi
mov edi, ecx
push edi
push dword [edi + 0xa50]
push 0x5a8a48
push str.admin
call ebx
push edi
push dword [edi + 0xa54]
mov dword [edi + 0xa50], eax
push str.rdpmode
push str.admin
call ebx
push edi
push dword [edi + 0xa58]
mov dword [edi + 0xa54], eax
push str.noscreensaver
push str.admin
call ebx
push edi
push dword [edi + 0xa5c]
mov dword [edi + 0xa58], eax
push 0x5a8a70
push str.admin
call ebx
push edi
push dword [edi + 0x7a8]
mov dword [edi + 0xa5c], eax
push str.Secure
push str.admin
call ebx
push edi
push dword [edi + 0x7a4]
mov dword [edi + 0x7a8], eax
push str.MSLogonRequired
push str.admin
call ebx
push edi
push dword [edi + 0x7ac]
mov dword [edi + 0x7a4], eax
push str.NewMSLogon
push str.admin
call ebx
push edi
push dword [edi + 0x7b4]
mov dword [edi + 0x7ac], eax
push str.UseDSMPlugin
push str.admin
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x80
mov dword [edi + 0x7b4], eax
lea eax, [edi + 0x7b8]
push eax
push 0x579be0
push str.DSMPlugin
push str.admin
call esi
push edi
push dword [edi + 0x7b0]
push str.ReverseAuthRequired
push str.admin
call ebx
push edi
push 0x200
mov dword [edi + 0x7b0], eax
lea eax, [edi + 0x838]
push eax
push 0x579be0
push str.DSMPluginConfig
push str.admin
call esi
push edi
push dword [edi + 0xa60]
push str.AllowLoopback
push str.admin
call ebx
push edi
push dword [edi + 0xa64]
mov dword [edi + 0xa60], eax
push str.AuthRequired
push str.admin
call ebx
push edi
push dword [edi + 0xa68]
mov dword [edi + 0xa64], eax
push str.ConnectPriority
push str.admin
call ebx
push edi
push 0x96
mov dword [edi + 0xa68], eax
lea eax, [edi + 0xa6c]
push eax
push 0x579be0
push str.AuthHosts
push str.admin
call esi
push edi
push dword [edi + 0x10c]
push str.AllowShutdown
push str.admin
call ebx
push edi
push dword [edi + 0x104]
mov dword [edi + 0x10c], eax
push str.AllowProperties
push str.admin
call ebx
push edi
push dword [edi + 0x108]
mov dword [edi + 0x104], eax
push str.AllowInjection
push str.admin
call ebx
push edi
push dword [edi + 0x110]
mov dword [edi + 0x108], eax
push str.AllowEditClients
push str.admin
call ebx
push edi
push dword [edi + 0x114]
mov dword [edi + 0x110], eax
push str.FileTransferTimeout
push str.admin
call ebx
mov dword [edi + 0x114], eax
cmp eax, 0x258
jle 0x42c165
mov dword [edi + 0x114], 0x258
push edi
push dword [edi + 0x118]
push str.KeepAliveInterval
push str.admin
call ebx
push edi
push dword [edi + 0x11c]
mov dword [edi + 0x118], eax
push str.IdleInputTimeout
push str.admin
call ebx
mov dword [edi + 0x11c], eax
mov eax, dword [edi + 0x114]
dec eax
cmp dword [edi + 0x118], eax
jl 0x42c1ac
mov dword [edi + 0x118], eax
push edi
push 0x400
lea eax, [edi + 0x120]
push eax
push 0x579be0
push str.service_commandline
push str.admin
call esi
push edi
push 0x200
lea eax, [edi + 0x520]
push eax
push 0x579be0
push str.accept_reject_mesg
push str.admin
call esi
cmp dword [edi + 0x7a8], 0
mov eax, 0x5c3c10
mov ecx, 0x5c3c08
xorps xmm0, xmm0
cmovne ecx, eax
movq qword [ebp - 0xc], xmm0
xor edx, edx
call fcn.0041ccd0
lea edx, [ebp - 0xc]
mov ecx, edx
call fcn.0041cf20
mov eax, dword [ebp - 0xc]
lea esi, [edi + 0x734]
mov ecx, dword [ebp - 8]
push edi
push dword [edi + 0xb04]
mov dword [esi], eax
push str.DebugMode
push str.admin
mov dword [esi + 4], ecx
call ebx
push edi
push 0x200
mov dword [edi + 0xb04], eax
lea eax, [edi + 0xb08]
push eax
push 0x579be0
push str.path
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push dword [edi + 0xd08]
push str.DebugLevel
push str.admin
call ebx
push edi
push dword [edi + 0xd0c]
mov dword [edi + 0xd08], eax
push str.Avilog
push str.admin
call ebx
push edi
push dword [edi + 0x790]
mov dword [edi + 0xd0c], eax
push str.FileTransferEnabled
push str.admin
call ebx
push edi
push dword [edi + 0x794]
mov dword [edi + 0x790], eax
push str.FTUserImpersonation
push str.admin
call ebx
push edi
push dword [edi + 0x798]
mov dword [edi + 0x794], eax
push str.BlankMonitorEnabled
push str.admin
call ebx
push edi
push dword [edi + 0x79c]
mov dword [edi + 0x798], eax
push str.BlankInputsOnly
push str.admin
call ebx
push edi
push dword [edi + 0x7a0]
mov dword [edi + 0x79c], eax
push str.DefaultScale
push str.admin
call ebx
push edi
push dword [edi + 0x7b4]
mov dword [edi + 0x7a0], eax
push str.UseDSMPlugin
push str.admin
call ebx
push edi
push 0x80
mov dword [edi + 0x7b4], eax
lea eax, [edi + 0x7b8]
push eax
push 0x579be0
push str.DSMPlugin
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x200
lea eax, [edi + 0x838]
push eax
push 0x579be0
push str.DSMPluginConfig
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push dword [edi + 0xa38]
push str.primary
push str.admin
call ebx
push edi
push dword [edi + 0xa3c]
mov dword [edi + 0xa38], eax
push str.secondary
push str.admin
call ebx
push edi
push dword [edi + 0x720]
mov dword [edi + 0xa3c], eax
push str.SocketConnect
push str.admin
call ebx
push edi
push dword [edi + 0x724]
mov dword [edi + 0x720], eax
push str.HTTPConnect
push str.admin
call ebx
push edi
push dword [edi + 0x728]
mov dword [edi + 0x724], eax
push str.AutoPortSelect
push str.admin
call ebx
push edi
push dword [edi + 0x72c]
mov dword [edi + 0x728], eax
push str.PortNumber
push str.admin
call ebx
push edi
mov dword [edi + 0x72c], eax
add eax, 0xffffff9c
push eax
push str.HTTPPortNumber
push str.admin
call ebx
push edi
push dword [edi + 0x758]
mov dword [edi + 0x730], eax
push str.IdleTimeout
push str.admin
call ebx
push edi
push dword [edi + 0x768]
mov dword [edi + 0x758], eax
push str.RemoveWallpaper
push str.admin
call ebx
push edi
push dword [edi + 0x76c]
mov dword [edi + 0x768], eax
push str.RemoveEffects
push str.admin
call ebx
push edi
push dword [edi + 0x770]
mov dword [edi + 0x76c], eax
push str.RemoveFontSmoothing
push str.admin
call ebx
push edi
push dword [edi + 0x744]
mov dword [edi + 0x770], eax
push str.QuerySetting
push str.admin
call ebx
push edi
push dword [edi + 0x750]
mov dword [edi + 0x744], eax
push str.QueryTimeout
push str.admin
call ebx
push edi
push dword [edi + 0x754]
mov dword [edi + 0x750], eax
push str.QueryDisableTime
push str.admin
call ebx
push edi
push dword [edi + 0x74c]
mov dword [edi + 0x754], eax
push str.QueryAccept
push str.admin
call ebx
push edi
push dword [edi + 0x75c]
mov dword [edi + 0x74c], eax
push str.MaxViewerSetting
push str.admin
call ebx
push edi
push dword [edi + 0x760]
mov dword [edi + 0x75c], eax
push str.MaxViewers
push str.admin
call ebx
push edi
push dword [edi + 0x764]
mov dword [edi + 0x760], eax
push str.Collabo
push str.admin
call ebx
push edi
push dword [edi + 0xa40]
mov dword [edi + 0x764], eax
push str.Frame
push str.admin
call ebx
push edi
push dword [edi + 0xa44]
mov dword [edi + 0xa40], eax
push str.Notification
push str.admin
call ebx
push edi
push dword [edi + 0xa48]
mov dword [edi + 0xa44], eax
push 0x5a8c98
push str.admin
call ebx
push edi
push dword [edi + 0xa4c]
mov dword [edi + 0xa48], eax
push str.NotificationSelection
push str.admin
call ebx
mov dword [edi + 0xa4c], eax
push edi
push dword [edi + 0x748]
push str.QueryIfNoLogon
push str.admin
call ebx
push edi
push 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push str.passwd
push 0x5aad00
mov dword [edi + 0x748], eax
call esi
push edi
push 8
lea eax, [edi + 0x73c]
push eax
push str.passwd2
push 0x5aad00
call esi
push edi
push dword [edi + 0x774]
push str.InputsEnabled
push str.admin
call ebx
push edi
push dword [edi + 0x778]
mov dword [edi + 0x774], eax
push str.LockSetting
push str.admin
call ebx
push edi
push dword [edi + 0x77c]
mov dword [edi + 0x778], eax
push str.LocalInputsDisabled
push str.admin
call ebx
push edi
push dword [edi + 0x780]
mov dword [edi + 0x77c], eax
push str.EnableJapInput
push str.admin
call ebx
push edi
push dword [edi + 0x784]
mov dword [edi + 0x780], eax
push str.EnableUnicodeInput
push str.admin
call ebx
push edi
push dword [edi + 0x788]
mov dword [edi + 0x784], eax
push str.EnableWin8Helper
push str.admin
call ebx
push edi
push dword [edi + 0x78c]
mov dword [edi + 0x788], eax
push str.clearconsole
push str.admin
call ebx
push edi
push dword [edi + 0xd14]
mov dword [edi + 0x78c], eax
push str.sendbuffer
push str.admin
call ebx
push str.VNCACCESS
lea esi, [edi + 0xe69]
mov dword [edi + 0xd14], eax
push 0x96
push esi
call fcn.0052c1a3
add esp, 0xc
push edi
push 0x96
push esi
push 0x579be0
push str.group1
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.Administrators
lea esi, [edi + 0xeff]
push 0x96
push esi
call fcn.0052c1a3
add esp, 0xc
push edi
push 0x96
push esi
push 0x579be0
push str.group2
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.VNCVIEWONLY
lea esi, [edi + 0xf95]
push 0x96
push esi
call fcn.0052c1a3
add esp, 0xc
push edi
push 0x96
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x579be0
push str.group3
push str.admin_auth
call esi
push edi
push 0xfa
lea eax, [edi + 0x1038]
push eax
push 0x579be0
push str.cloudServer
push str.admin
call esi
movzx eax, byte [edi + 0x1132]
push edi
push eax
push str.cloudEnabled
push str.admin
call ebx
push edi
push dword [edi + 0x102c]
test eax, eax
push str.locdom1
setne al
push str.admin_auth
mov byte [edi + 0x1132], al
call ebx
push edi
push dword [edi + 0x1030]
mov dword [edi + 0x102c], eax
push str.locdom2
push str.admin_auth
call ebx
push edi
push dword [edi + 0x1034]
mov dword [edi + 0x1030], eax
push str.locdom3
push str.admin_auth
call ebx
push edi
push dword [edi + 0xe30]
mov dword [edi + 0x1034], eax
push str.TurboMode
push str.poll
call ebx
push edi
push dword [edi + 0xe34]
mov dword [edi + 0xe30], eax
push str.PollUnderCursor
push str.poll
call ebx
push edi
push dword [edi + 0xe38]
mov dword [edi + 0xe34], eax
push str.PollForeground
push str.poll
call ebx
mov dword [edi + 0xe38], eax
push edi
push dword [edi + 0xe3c]
push str.PollFullScreen
push str.poll
call ebx
push edi
push dword [edi + 0xe40]
mov dword [edi + 0xe3c], eax
push str.OnlyPollConsole
push str.poll
call ebx
push edi
push dword [edi + 0xe44]
mov dword [edi + 0xe40], eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push edi
push dword [edi + 0xe48]
mov dword [edi + 0xe44], eax
push str.MaxCpu2
push str.poll
call ebx
mov dword [edi + 0xe48], eax
test eax, eax
jne 0x42c885
mov dword [edi + 0xe48], 0x64
push edi
push dword [edi + 0xe4c]
push str.MaxFPS
push str.poll
call ebx
push edi
push dword [edi + 0xe50]
mov dword [edi + 0xe4c], eax
push str.EnableDriver
push str.poll
call ebx
mov dword [edi + 0xe50], eax
test eax, eax
je 0x42c8cb
xor cl, cl
call fcn.0043a050
movzx eax, al
mov dword [edi + 0xe50], eax
push edi
push dword [edi + 0xe54]
push str.EnableHook
push str.poll
call ebx
push edi
push dword [edi + 0xe58]
mov dword [edi + 0xe54], eax
push str.EnableVirtual
push str.poll
call ebx
push edi
push dword [edi + 0xe60]
mov dword [edi + 0xe58], eax
push str.autocapt
push str.poll
call ebx
mov ecx, dword [ebp - 4]
mov dword [edi + 0xe60], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret