Function at 0x42e95d
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x4d78
call fcn.00421710
sub esp, eax
mov eax, dword [esp + eax]
lea ebx, [esp + 0x2c]
mov dword [esp], str.Request_to_set_firewall_entries..._r_n
mov esi, eax
call dbg.logEvent
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str._TEMP__rmwfirewall.download
call sym._ExpandEnvironmentStringsA_12
mov edx, ebx
sub esp, 0xc
mov eax, esi
call dbg.downloadIpsetFiles
test eax, eax
je 0x42ec0a
lea esi, [esp + 0x130]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP__rmwfirewall.rules
mov dword [esp + 4], esi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
mov dword [esp + 4], 0x4316d3
mov dword [esp], ebx
call sym._fopen
test eax, eax
mov dword [esp + 0x18], eax
je 0x42ec0a
mov dword [esp + 4], 0x4313ab
mov dword [esp], esi
call sym._fopen
test eax, eax
mov dword [esp + 0x14], eax
jne 0x42ea16
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym._fclose
jmp 0x42ec0a
lea edi, [esp + 0x338]
mov ecx, 0x128e
xor eax, eax
lea ebp, [esp + 0x234]
xor esi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x104
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym._fgets
test eax, eax
je 0x42eb8e
xor eax, eax
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 8
cmp eax, 0xc
ja 0x42eb85
cmp byte [esp + 0x234], 0x23
je 0x42eb85
mov dword [esp + 4], 0x2e
mov dword [esp], ebp
call sym._strchr
test eax, eax
je 0x42eb85
mov dword [esp + 4], 0x20
mov dword [esp], ebp
call sym._strchr
test eax, eax
jne 0x42eb85
mov dword [esp + 4], 0xd
mov dword [esp], ebp
call sym._strchr
mov dword [esp + 4], 0xa
mov ebx, eax
mov dword [esp], ebp
call sym._strchr
test ebx, ebx
jne 0x42ead0
test eax, eax
je 0x42eaec
test ebx, ebx
je 0x42eae2
test eax, eax
je 0x42eadc
cmp ebx, eax
jae 0x42eae2
mov eax, ebx
sub eax, ebp
jmp 0x42eae4
sub eax, ebp
mov byte [esp + eax + 0x234], 0
or ebx, 0xffffffff
lea edi, [esp + 0x338]
xor eax, eax
mov ecx, ebx
mov edx, 0x4a37
repne scasb al, byte es:[edi]
lea edi, [esp + 0x338]
mov dword [esp + 4], 0x4382b1
mov dword [esp + 0x1c], edx
lea eax, [ecx + edx + 2]
mov dword [esp + 8], eax
lea eax, [esp + 0x338]
mov dword [esp], eax
call sym._strncat
xor eax, eax
mov ecx, ebx
mov edx, dword [esp + 0x1c]
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebp
lea edi, [esp + 0x338]
lea eax, [edx + ecx + 2]
mov dword [esp + 8], eax
lea eax, [esp + 0x338]
mov dword [esp], eax
call sym._strncat
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
dec ebx
cmp ebx, 0x1f40
jbe 0x42eb85
mov eax, dword [esp + 0x14]
inc esi
lea ecx, [esp + 0x339]
mov edx, esi
call dbg.addFirewallRuleToScript
mov byte [esp + 0x338], 0
cmp esi, 0x13
jle 0x42ea2f
cmp byte [esp + 0x338], 0
je 0x42ebab
mov eax, dword [esp + 0x14]
inc esi
lea ecx, [esp + 0x339]
mov edx, esi
call dbg.addFirewallRuleToScript
lea ebx, [esp + 0x234]
inc esi
cmp esi, 0x14
jg 0x42ebe6
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.advfirewall_firewall_delete_rule_name_Remotely_IP_Block__d__r_n
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call sym.___mingw_snprintf
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
jmp 0x42ebb2
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym._fclose
lea eax, [esp + 0x130]
call dbg.runNetShScript
add esp, 0x4d7c
pop ebx
pop esi
pop edi
pop ebp
ret