Function at 0x57af0e
Capabilities:
Delete file
Get hostname
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6c4e10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Remcom_EC_V2:
call fcn.005dbd3f
and dword [ebp - 0x10c], 0
mov dword [esp], str.InstallationDir
push str.SOFTWAREAdventNetDesktopCentral_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x110], 0x1000
call fcn.0057786e
add esp, 0xc
test eax, eax
jne 0x57af63
call fcn.00579b61
jmp 0x57af76
lea edi, [eax - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x57af66
mov esi, str.logs
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
call fcn.00579bd8
mov dword [esp], str._n
call fcn.0057a1d9
call fcn.0057a4a5
mov dword [0x6cada4], eax
lea eax, [ebp - 0x114]
push eax
push 2
call fcn.0057a3bb
push 0x6ccda8
mov dword [0x6ceeb8], eax
call fcn.0057a40e
call fcn.00578a74
push 0x645d0c
call fcn.00577c7d
add esp, 0x14
test eax, eax
jne 0x57b822
push 0x645d08
call fcn.00577c7d
pop ecx
test eax, eax
jne 0x57b822
push str.help
call fcn.00577c7d
pop ecx
test eax, eax
jne 0x57b822
cmp dword [0x6ceeb8], eax
je 0x57b822
mov eax, dword [0x6cada4]
test eax, eax
je 0x57b822
push eax
push str._s_:_Starting_Connection_to:
mov esi, 0x6cdda8
push esi
call fcn.005dc5c2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ebx, ebx
inc ebx
push ebx
push 0x578a6f
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str.GetComputerName____n
call fcn.0057a1d9
pop ecx
lea eax, [ebp - 0x110]
push eax
push 0x6cada8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x57b098
push str.GetComputerName___failed._Use_a_valid_name__:__n
push 0x6a9520
call fcn.005e0fae
push 0x20
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetComputerName___is_Failed_:_d_n
call fcn.0057a1d9
pop ecx
pop ecx
push 0xfffffffffffffffd
pop eax
jmp 0x57b835
push str.SetConnectionCredentials____n
call fcn.0057a1d9
push 0
call fcn.0057a51f
pop ecx
pop ecx
test eax, eax
jne 0x57b0bf
call fcn.005778ec
mov dword [ebp - 0x10c], eax
jmp 0x57b7ee
push dword [0x6cada4]
push str.Remote_Machine_Name:__s__n
call fcn.0057a1d9
push dword [0x6ceeb0]
push str.User_Name:__s__n
call fcn.0057a1d9
push dword [0x6ceeb8]
push str.lpszCommandExe:__s__n
call fcn.0057a1d9
push str.cmd_exe_n
call fcn.0057a1d9
push 0x10
push dword [0x6c446c]
push dword [0x6cada4]
call fcn.005e1dca
add esp, 0x28
test eax, eax
je 0x57b67a
push 0x10
push dword [0x6c4470]
push dword [0x6cada4]
call fcn.005e1dca
add esp, 0xc
test eax, eax
je 0x57b67a
push 2
push 0x64558c
push dword [0x6cada4]
call fcn.005e1dca
add esp, 0xc
test eax, eax
je 0x57b67a
push str.Initiating_Connection_to_Remote_Service_._._.___n
call fcn.0057a1d9
mov esi, 0x6a9520
mov dword [esp], str.Initiating_Connection_to_Remote_Service_._._.
push esi
call fcn.005e0fae
push 0x20
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push ebx
push str.ADMIN_
push dword [0x6cada4]
call fcn.0057ad88
add esp, 0x1c
test eax, eax
je 0x57b24a
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_connect_to
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6cada4]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.ADMIN__n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6cada4]
push str.Couldnt_Establish_connection_to_remote_machine__s__Admin__n
jmp 0x57b593
push ebx
push str.IPC_
push dword [0x6cada4]
call fcn.0057ad88
add esp, 0xc
test eax, eax
je 0x57b30e
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_connect_to
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6cada4]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.IPC__n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6cada4]
push str.Couldnt_Establish_connection_to_remote_machine__s__IPC___n
jmp 0x57b593
call fcn.0057a28e
call fcn.00577e5e
test eax, eax
jne 0x57b40f
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_copy
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6ceeb8]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str._to
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6cada4]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6cada4]
push str.Couldnt_copy_binary_to_remote_machine___s__n
jmp 0x57b593
push 0
push ebx
call fcn.005781ef
pop ecx
pop ecx
test eax, eax
jne 0x57b670
call fcn.00577fa3
test eax, eax
jne 0x57b4d6
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_copy_service_to
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6cada4]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6cada4]
push str.Couldnt_copy_service_to_remote___s__machine__n
jmp 0x57b593
call fcn.00578151
test eax, eax
jne 0x57b609
call fcn.0057807a
test eax, eax
jne 0x57b5a0
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_copy_service_to
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push dword [0x6cada4]
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.ADMIN_SysWOW64_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6cada4]
push str.Couldnt_copy_service_to_remote___s__machine_SysWOW64_n
call fcn.0057a1d9
add esp, 0x18
jmp 0x57b7ee
call fcn.00578151
test eax, eax
jne 0x57b609
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Couldnt_start_remote_service_n
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push str.Couldnt_Install__start_remote_service_n
call fcn.0057a1d9
jmp 0x57b7eb
push 0x3e8
push 5
call fcn.005781ef
pop ecx
pop ecx
test eax, eax
jne 0x57b670
call fcn.005778ec
push str.Failed_n_n
push esi
mov dword [ebp - 0x10c], eax
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
mov ebx, str.Couldnt_connect_to_remote_service_n
push ebx
push esi
call fcn.005e0fae
push 0x40
pop edi
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push ebx
jmp 0x57b5ff
call fcn.0057892e
jmp 0x57b0b4
push str.lpszMachineName_check__n
call fcn.0057a1d9
pop ecx
call fcn.00577a12
push 0x20
mov esi, 0x6a9520
pop edi
test eax, eax
je 0x57b6b9
push str.Local_Admin_n_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
mov ebx, str.Localhost_entered_for_Target_Machine_.._Going_to_RunAs_Command_n_n
push ebx
call fcn.0057a1d9
pop ecx
push ebx
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
mov dword [0x6cada4], 0x6446c4
call fcn.00577ef3
test eax, eax
je 0x57b79d
push str.Launching_Local_Process_..._n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005dc9c0
push dword [0x6ceeb8]
mov ebx, 0x6ceda8
push dword [0x6ceeac]
lea eax, [ebp - 0x108]
push dword [0x6ceeb0]
push ebx
push str._s__s__s__s
push eax
call fcn.005dc5c2
lea eax, [ebp - 0x108]
push eax
call fcn.00579772
add esp, 0x38
test eax, eax
jne 0x57b794
push str.Create_Local_Process_Failed._Illegal_Command
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x57b7ee
push str.Cannot_Extract_Local_Resources._Please_check_write_access_to_local_tmp_filesystem_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
add esp, 0x10
push str.Create_Process_as_User_Failed._Trying_to_run_the_process_with_the_current_user_n_n
push esi
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e2093
call fcn.005e0fae
add eax, edi
push eax
call fcn.005e12ed
push dword [0x6ceeb8]
call fcn.00579772
add esp, 0x14
push 0
push str.IPC_
push dword [0x6cada4]
call fcn.0057ad88
push 0
push str.ADMIN_
push dword [0x6cada4]
call fcn.0057ad88
add esp, 0x18
call fcn.0057a28e
mov eax, dword [ebp - 0x10c]
jmp 0x57b835
call fcn.00578b2f
push str.ShowUsage__or__Wrong_CommandLine_argument__or__Machine_Name_may_be_Null__n
call fcn.0057a1d9
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dbf5a
leave
ret