Function at 0x402ce0
Capabilities:
Get session user name
Print debug messages

Disassembly:
sub esp, 0x6b0
push ebx
push ebp
push esi
push edi
call fcn.004041d0
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ebx, 1
test dword [eax + 4], 0x10000000
je 0x402db8
mov eax, dword [0x41d274]
test eax, eax
jne 0x402db8
push 0
push str.Manager_Installed
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x402db2
push eax
push str.NotSetNetPolicies
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x402db2
lea ecx, [esp + 0x14]
lea edx, [esp + 0x5bc]
push ecx
push edx
mov dword [esp + 0x1c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x402db8
lea eax, [esp + 0x5bc]
push str.SYSTEM
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402db8
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push str.NC_EnableAdminProhibits
push str.SoftwarePoliciesMicrosoftWindowsNetwork_Connections
push reloc.WS2_32.dll_accept
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0
call sub.REDCOMM.dll_Ordinal_142
lea edx, [esp + 0x10]
push 4
push edx
push 4
push str.NC_LanConnect
push str.SoftwarePoliciesMicrosoftWindowsNetwork_Connections
push reloc.WS2_32.dll_accept
call sub.REDCOMM.dll_Ordinal_142
mov dword [0x41d274], ebx
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, dword [eax + 0x2c]
push ecx
call sub.REDCOMM.dll_Ordinal_37
cmp eax, ebx
je 0x402e0f
push ebx
push ebx
call sub.RSCLASS.dll_Ordinal_103
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [edx + 0x2c]
push eax
call sub.REDCOMM.dll_Ordinal_37
cmp eax, ebx
je 0x402e0f
mov eax, dword [0x41d278]
cmp eax, 0xa
jge 0x402e0f
mov ecx, eax
push str.Red_Spider:_Cant_gotten_the_local_ip_address.
inc ecx
mov dword [0x41d278], ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6b0
ret
mov ecx, 0x168
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov word [esp + 0x1e], ax
mov dword [esp + 0x20], 0x5a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x6cc]
test eax, eax
je 0x402e4b
or byte [esp + 0x28], 8
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
je 0x402e5e
or byte [esp + 0x28], 0x40
mov eax, dword [0x41c214]
test eax, eax
je 0x402e6b
or byte [esp + 0x28], bl
mov eax, dword [0x41d17c]
mov cl, 2
test eax, eax
mov eax, dword [0x41d25c]
je 0x402e83
test eax, eax
jne 0x402e83
or byte [esp + 0x28], cl
mov edx, dword [0x41d270]
test edx, edx
jle 0x402ea6
test eax, eax
jne 0x402ea6
mov dl, byte [esp + 0x28]
mov eax, dword [0x41d270]
or dl, cl
dec eax
mov byte [esp + 0x28], dl
mov dword [0x41d270], eax
mov eax, dword [0x41d250]
test eax, eax
je 0x402eb4
or byte [esp + 0x28], 4
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x402ec5
or byte [esp + 0x28], 0x80
mov ecx, dword [0x41d1a0]
test ecx, ecx
je 0x402eea
mov ecx, dword [0x41ceb4]
cmp ecx, 0xffffffff
mov cl, byte [esp + 0x28]
jne 0x402ee3
or cl, 0x10
jmp 0x402ee6
or cl, 0x20
mov byte [esp + 0x28], cl
add eax, 0xc42
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov edx, ecx
lea edi, [esp + 0x2a]
lea esi, [eax + 0xc42]
mov ebp, dword [esp + 0x6c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 0xc08]
mov esi, dword [esp + 0x6d0]
mov dword [esp + 0x48], ecx
mov edx, dword [eax + 0xc0c]
mov eax, dword [0x41ceb4]
mov ecx, dword [esp + 0x28]
lea edi, [esi + 4]
mov dword [esp + 0x4c], edx
push 0x10
mov dword [esp + 0x48], eax
mov eax, dword [esi]
push edi
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
mov dword [esp + 0x64], 0x488
call sub.REDCOMM.dll_Ordinal_34
test eax, eax
jne 0x402f8d
call sub.REDCOMM.dll_Ordinal_143
cmp eax, 0x2741
jne 0x402f80
push ebx
push ebx
call sub.RSCLASS.dll_Ordinal_103
push 0
call sub.REDCOMM.dll_Ordinal_144
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6b0
ret
mov eax, dword [esp + 0x6cc]
test eax, eax
jne 0x402fb7
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x20]
mov eax, dword [esi]
push ebx
push ebp
push 0x10
push edi
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
call sub.REDCOMM.dll_Ordinal_34
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x6b0
ret