Function at 0x140083578
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xca8]
sub rsp, 0xd70
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0xc60], rax
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r14, qword [rbp + 0xcd0]
lea rdi, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rdi
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x3ea
mov esi, 1
mov dword [rbp + 0x1c], esi
mov dword [rbp + 0x20], 0xff
xor r15d, r15d
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x77]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.1400bec34
nop
mov dword [rsp + 0x48], r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x210]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x68], r15
lea rax, [0x1400f6248]
mov qword [rsp + 0x60], rax
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x210]
call fcn.14002d18c
mov dword [rbp - 0x78], eax
mov qword [rbp], rdi
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x3f5
mov dword [rbp + 0x1c], esi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x77]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
lea r8, str.StringCchCopy_fails_to_copy_volume_name
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140031318
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400836c2
cmp word [rbx + rax*2 - 2], 0x5c
je 0x1400837dc
mov r8d, 0x104
mov edx, r8d
lea rax, [rbp + 0x210]
cmp word [rax], r15w
je 0x1400836f7
add rax, 2
sub rdx, rsi
jne 0x1400836e8
mov rax, rdx
neg rax
sbb ecx, ecx
not ecx
and ecx, 0x80070057
test rdx, rdx
je 0x140083714
mov rax, r8
sub rax, rdx
jmp 0x140083717
mov rax, r15
test rdx, rdx
je 0x14008377f
mov rcx, r8
sub rcx, rax
lea rdx, [rbp + 0x210]
lea rdx, [rdx + rax*2]
je 0x140083763
lea r8, [rax + 0x7ffffefa]
add r8, rcx
lea rax, [0x1401035b0]
sub rax, rdx
test r8, r8
je 0x140083763
movzx r9d, word [rax + rdx]
test r9w, r9w
je 0x140083763
mov word [rdx], r9w
add rdx, 2
sub r8, rsi
sub rcx, rsi
jne 0x140083743
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r15w
neg rcx
sbb ecx, ecx
not ecx
and ecx, 0x8007007a
mov dword [rbp - 0x78], ecx
mov qword [rbp], rdi
lea rbx, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rbx
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x3fc
mov dword [rbp + 0x1c], esi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
lea r8, str.StringCchCat_fails_to_concat_backslash
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140031318
jmp 0x1400837e3
lea rbx, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xea
je 0x140083891
mov qword [rbp], rdi
mov qword [rbp + 8], rbx
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x404
mov edi, 6
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x72]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14008386d
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x210]
lea r8, str.GetVolumePathNamesForVolumeName__s__failed_with_0x_08lx
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140009fb0
jmp 0x140083dd7
mov ebx, dword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400313a4
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400838dc
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x140159b90]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
mov edi, 6
mov ebx, 0x80070000
test eax, eax
jne 0x14008399c
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x411
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x72]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14008396e
movzx eax, ax
or eax, ebx
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x210]
lea r8, str.GetVolumePathNamesForVolumeName__s__failed_with_0x_08lx
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140009fb0
lea rcx, [rsp + 0x60]
call fcn.1400313a4
mov rsi, r15
jmp 0x1400839a1
mov qword [rsp + 0x68], r15
mov qword [r14], rsi
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x70], r15d
mov esi, 0x208
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x420]
call sub.msvcrt.dll_memset
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x630]
call sub.msvcrt.dll_memset
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xa50]
call sub.msvcrt.dll_memset
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x840]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x140083aa3
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x427
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140083a7f
movzx eax, ax
or eax, ebx
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x20], rcx
lea r9, str.GetVolumeNameForVolumeMountPoint__s_
mov r8d, eax
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.1400c2a9c
int3
mov qword [rsp + 0x58], r15
lea rax, [0x1400f63f8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.140083514
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x58]
mov edx, 0x1f6
xor ecx, ecx
call qword [sym.imp.srvcli.dll_NetShareEnum]
nop dword [rax + rax]
mov esi, eax
xor edx, edx
test eax, eax
je 0x140083b60
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x438
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
mov r9d, esi
lea r8, str.NetShareEnum_failed_with__d
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140009fb0
jmp 0x140083dbe
mov r15, qword [rsp + 0x58]
mov r14d, edx
cmp dword [rsp + 0x4c], edx
jbe 0x140083dbb
mov eax, r14d
lea rcx, [rax + rax*8]
lea rsi, [r15 + rcx*8]
cmp dword [rsi + 8], edx
jne 0x140083dad
mov r8d, 0x104
lea rdx, [rbp + 0x420]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140083c2c
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x443
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140083c0b
movzx eax, ax
or eax, ebx
mov r9, qword [rsi + 0x28]
lea r8, str.GetVolumePathName__s__failed_with_0x_08lx
mov dword [rsp + 0x20], eax
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140009fb0
jmp 0x140083dab
mov r8d, 0x104
lea rdx, [rbp + 0x630]
lea rcx, [rbp + 0x420]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x140083cc3
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x44f
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140083cb0
movzx eax, ax
or eax, ebx
lea r9, [rbp + 0x420]
lea r8, str.GetVolumeNameForVolumeMountPoint__s__fails_with_0x_08lx
jmp 0x140083c16
mov r8d, 0x104
lea rdx, [rbp + 0xa50]
lea rcx, [rbp + 0x630]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x140083d5a
lea rax, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rbp], rax
lea rax, str.CVssHardwareProviderWrapper::CollectSharesAndMountPointsOnVolume
mov qword [rbp + 8], rax
lea rax, str.CORHDELC
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x453
mov dword [rbp + 0x1c], edi
mov dword [rbp + 0x20], 0xff
mov dword [rbp + 0xa0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140083d47
movzx eax, ax
or eax, ebx
lea r9, [rbp + 0x630]
lea r8, str.GetVolumeNameForVolumeMountPoint__s__fail_with_0x_08lx
jmp 0x140083c16
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0xa50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jne 0x140083dad
mov qword [rbp], rsi
lea r8, [rbp + 0x420]
mov edx, 0x104
lea rcx, [rbp + 8]
call fcn.14002d18c
test eax, eax
js 0x140083e30
lea rdx, [rbp]
mov rcx, r13
call fcn.140080f50
test eax, eax
je 0x140083e16
xor edx, edx
inc r14d
cmp r14d, dword [rsp + 0x4c]
jb 0x140083b72
xor r15d, r15d
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov qword [r12], rax
lea rcx, [rsp + 0x50]
call fcn.140080c5c
nop
lea rcx, [rsp + 0x60]
call fcn.14002e4c8
nop
lea rcx, [rbp - 0x80]
call fcn.140009990
mov rcx, qword [rbp + 0xc60]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0xdb0]
add rsp, 0xd70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x140159b90]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], eax
lea rdx, [0x140159b90]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3