Function at 0x14004ae40
Capabilities:
Enumerate network shares
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
xor esi, esi
xor bl, bl
mov rdi, rcx
mov qword [rbp - 0x30], rsi
mov dword [rbp + 0x38], esi
mov dword [rbp - 0x34], esi
mov dword [rbp - 0x38], esi
mov byte [rbp + 0x28], sil
mov qword [rbp - 0x28], rsi
mov dword [rbp + 0x30], esi
cmp byte [rcx + 9], bl
je 0x14004b1aa
cmp dword [rcx + 0x24c], esi
jne 0x14004b1aa
lea r8, [rbp - 0x28]
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREApple_Inc.BonjourServicesSMB
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14004aecc
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.Advertise
lea rax, [rbp + 0x28]
mov dword [rbp + 0x40], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov qword [rsp + 0x68], r15
cmp byte [rbp + 0x28], sil
je 0x14004afb0
lea rcx, [rbp + 0x30]
call fcn.140067030
test eax, eax
je 0x14004afb0
lea rax, [rbp - 0x38]
mov r15d, 1
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x34]
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
mov edx, r15d
lea rax, [rbp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetShareEnum
test eax, eax
je 0x14004af39
cmp eax, 0xea
je 0x14004af39
cmp eax, 0x842
jne 0x14004afb0
mov dword [rbp + 0x30], r15d
jmp 0x14004afb5
mov eax, dword [rbp + 0x38]
mov r11, qword [rbp - 0x30]
mov r8, r11
test eax, eax
je 0x14004af9f
mov qword [rsp + 0x70], r14
mov r10d, eax
lea r14, str.print_
cmp dword [r8 + 8], esi
jne 0x14004af91
mov r9, qword [r8]
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx edx, word [r9 + rcx*2]
inc rcx
movzx eax, word [r14 + rcx*2 - 2]
sub edx, eax
jne 0x14004af88
cmp rcx, 7
jne 0x14004af70
test edx, edx
movzx ebx, bl
cmovne ebx, r15d
add r8, 0x18
sub r10, r15
jne 0x14004af56
mov r14, qword [rsp + 0x70]
mov rcx, r11
call sub.NETAPI32.dll_NetApiBufferFree
mov qword [rbp - 0x30], rsi
mov dword [rbp + 0x30], esi
jmp 0x14004afed
cmp dword [rbp + 0x30], esi
je 0x14004afed
mov rcx, qword [rdi]
lea r9, [0x14004b1c0]
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
imul eax, dword [rcx + 0x38], 0xff676980
movsxd rdx, eax
sar rdx, 0x20
mov dword [rbp - 0x1c], edx
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov rax, qword [rdi]
mov r15, qword [rsp + 0x68]
cmp byte [rax + 0x90], sil
jne 0x14004b17b
test bl, bl
je 0x14004b19b
cmp qword [0x1401aff28], rsi
jne 0x14004b162
mov rax, qword [0x1401aff10]
test rax, rax
jne 0x14004b040
lea rcx, str.dnssd.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1401aff10], rax
test rax, rax
je 0x14004b15a
cmp qword [0x1401aff18], rsi
jne 0x14004b070
lea rdx, str.DNSServiceRegister
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401aff18], rax
test rax, rax
je 0x14004b15a
mov rax, qword [0x1401aff10]
cmp qword [0x1401aff20], rsi
jne 0x14004b099
lea rdx, str.DNSServiceRefDeallocate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401aff20], rax
test rax, rax
je 0x14004b15a
cmp qword [0x1401aff30], rsi
jne 0x14004b0c2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1401aff30], rax
test rax, rax
je 0x14004b15a
cmp qword [0x1401aff38], rsi
jne 0x14004b0e7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1401aff38], rax
test rax, rax
je 0x14004b15a
cmp qword [0x1401aff40], rsi
jne 0x14004b10c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1401aff40], rax
test rax, rax
je 0x14004b15a
cmp qword [0x1401aff48], rsi
jne 0x14004b131
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1401aff48], rax
test rax, rax
je 0x14004b15a
mov qword [rsp + 0x28], rsi
lea r8, [0x14004b660]
mov r9, rdi
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x1401aff28], rax
test rax, rax
jne 0x14004b162
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004b19b
mov rcx, qword [0x1401aff30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rdi]
mov byte [rax + 0x90], 1
jmp 0x14004b19b
test bl, bl
jne 0x14004b19b
mov rcx, qword [0x1401aff38]
test rcx, rcx
je 0x14004b194
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rdi]
mov byte [rax + 0x90], sil
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14004b1aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret