Function at 0x140003f20
Capabilities:
Connect network resource
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
mov rax, qword [0x140043238]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov r12, qword [rsp + 0x410]
movzx edi, r9b
mov rax, qword [rsp + 0x438]
mov r14, r8
mov rsi, qword [rsp + 0x420]
mov rbp, rdx
mov r15, qword [rsp + 0x428]
movzx r13d, cl
mov rbx, qword [rsp + 0x430]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
test r9b, r9b
je 0x140003fdc
cmp byte [rbx], 0
jne 0x140003fdc
mov edx, 0x104
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, 0x5c
lea rcx, [rsp + 0x180]
call fcn.140016260
mov r9, rsi
lea r8, [rsp + 0x180]
lea rdx, str._s_s
lea rcx, [rsp + 0x70]
mov byte [rax], 0
call fcn.140004590
jmp 0x140004071
mov r9, rsi
lea rdx, str._sADMIN__s
lea rcx, [rsp + 0x70]
call fcn.140004590
cmp byte [rbx], 0
mov byte [rsp + 0x20], 0
je 0x140004071
mov r8, r14
lea rdx, str._sIPC_
lea rcx, [rsp + 0x290]
call fcn.140004590
mov rdx, qword [rsp + 0x28]
lea rax, [rsp + 0x20]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], ecx
xor r9d, r9d
mov qword [rsp + 0x58], rcx
mov r8, rbx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 3
call sub.MPR.dll_WNetAddConnection2A
movzx ecx, byte [0x140043ff0]
test eax, eax
mov eax, 1
cmove ecx, eax
mov byte [0x140043ff0], cl
lea r8, str.BINRES
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x14000411c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rsi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [0x140030ca4]
mov r12, rax
lea rcx, [rsp + 0x70]
call fcn.140015c20
mov rbx, rax
test rax, rax
je 0x140004117
mov r8d, esi
mov r9, rax
mov edx, 1
mov rcx, r12
call fcn.140015f9c
mov rcx, rbx
call fcn.140015acc
mov al, 1
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1400069e0
mov rbx, qword [rsp + 0x3f0]
add rsp, 0x3b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, qword [rsp + 0x30]
test r13b, r13b
jne 0x14000412c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x1400040ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000414a
cmp eax, 0x52e
je 0x14000414a
cmp eax, 0x3e7
je 0x14000414a
cmp eax, 0x35
jne 0x14000415b
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.140003260
test al, al
jne 0x1400040ea
call fcn.140003100
cmp byte [rsp + 0x440], 0
je 0x140004235
test dil, dil
lea rax, str._rCouldnt_access__s:_n
lea rbx, str._rCouldnt_install__s_service:_n
mov ecx, 2
cmove r12, rbp
cmove rbx, rax
call fcn.14000d318
mov rcx, rax
mov r8, r12
mov rdx, rbx
call fcn.140004540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov ebx, eax
call fcn.1400035c0
cmp ebx, 0x43
je 0x1400041f9
cmp ebx, 0x35
je 0x1400041f9
lea eax, [rbx - 0x4cf]
cmp eax, 1
ja 0x140004235
mov ecx, 2
call fcn.14000d318
mov rcx, rax
test dil, dil
je 0x1400041f0
lea rdx, str._nMake_sure_that_file_and_print_sharing_services_are_enabled._n
call fcn.140004540
mov rcx, r14
call fcn.140003eb0
xor al, al
jmp 0x1400040ec
lea rdx, str._nMake_sure_that_file_and_print_sharing_services_are_enabled_on__s._n
jmp 0x14000422d
mov ecx, 2
call fcn.14000d318
mov rcx, rax
test dil, dil
je 0x140004226
lea rdx, str._nMake_sure_that_the_admin__share_is_enabled._n
call fcn.140004540
mov rcx, r14
call fcn.140003eb0
xor al, al
jmp 0x1400040ec
lea rdx, str._nMake_sure_that_the_default_admin__share_is_enabled_on__s._n
mov r8, rbp
call fcn.140004540
mov rcx, r14
call fcn.140003eb0
xor al, al
jmp 0x1400040ec