Function at 0x1000a4230
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe20
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0xe10], rax
mov qword [rsp + 0x120], r9
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov rsi, qword [rsp + 0xe80]
lea r13, [0x10001e270]
mov qword [rsp + 0x50], r13
lea r14, [0x10001eea0]
mov qword [rsp + 0x58], r14
lea r15, [0x10001e250]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3f4
mov r12d, 1
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
xor ebp, ebp
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [r11 - 0xd65], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8000
nop
mov dword [rsp + 0x48], ebp
mov word [rsp + 0x3c0], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3c2]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x118], rbp
lea rax, [0x10000d460]
mov qword [rsp + 0x110], rax
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
mov edi, ebp
lea rax, [rsp + 0x3c0]
mov r8, rbx
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4375
movzx eax, word [rcx + r8]
cmp ax, bp
je 0x1000a4375
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x1000a4353
cmp rdx, rbp
jne 0x1000a4383
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
mov dword [rsp + 0x138], edi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3ff
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ef30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052760
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp word [rbx + rcx*2 - 2], 0x5c
je 0x1000a4495
lea r8, [0x1000021a0]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.100052624
mov dword [rsp + 0x138], eax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x406
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ef80]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052760
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1000a455c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x40e
mov r14d, 6
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001efd0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
nop
lea rcx, [rsp + 0x130]
call fcn.1000e80ec
jmp 0x1000a4cd7
mov edx, dword [rsp + 0x48]
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x118], rax
cmp rax, rbp
jne 0x1000a4597
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov r14d, 6
mov r15d, 0x80070000
cmp eax, ebp
jne 0x1000a466c
mov qword [rsp + 0x50], r13
lea rbx, [0x10001eea0]
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x41b
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001efd0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x118], rbp
mov qword [rsi], rbp
jmp 0x1000a467e
mov qword [rsp + 0x118], rbp
mov qword [rsi], rdi
lea rbx, [0x10001eea0]
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0xf8], ebp
mov word [rsp + 0x5d0], bp
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x5d2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x7e0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x7e2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x9f0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x9f2]
call sub.msvcrt.dll_memset
mov word [rsp + 0xc00], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc02]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a47a7
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x431
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, r15d
cmp eax, ebp
cmovle r8d, eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [0x10001f040]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9e30
int3
lea rax, [0x1000228b0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x108]
mov edx, 0x1f6
xor ecx, ecx
call sub.NETAPI32.dll_NetShareEnum
mov edi, eax
cmp eax, ebp
je 0x1000a4874
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x442
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10001f090]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
mov rbx, qword [rsp + 0x108]
jmp 0x1000a4ca8
mov rbx, qword [rsp + 0x108]
mov r13d, ebp
cmp dword [rsp + 0x4c], ebp
jbe 0x1000a4ca8
lea r12, [rbx + 0x28]
mov esi, 1
cmp dword [r12 - 0x20], ebp
jne 0x1000a4c47
mov edi, 0x104
mov r8d, edi
lea rdx, [rsp + 0x5d0]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, ebp
jne 0x1000a4957
lea rax, [0x10001e270]
mov qword [rsp + 0x50], rax
lea rax, [0x10001eea0]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x44d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov r9, qword [r12]
lea r8, [0x10001f0d0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
jmp 0x1000a4c47
mov r8d, edi
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4a14
lea rax, [0x10001e270]
mov qword [rsp + 0x50], rax
lea rax, [0x10001eea0]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x459
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x5d0]
lea r8, [0x10001f130]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
jmp 0x1000a4c47
mov r8d, edi
lea rdx, [rsp + 0x9f0]
lea rcx, [rsp + 0x7e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4ad1
lea rax, [0x10001e270]
mov qword [rsp + 0x50], rax
lea rax, [0x10001eea0]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e250]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x45d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x7e0]
lea r8, [0x10001f1a0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
jmp 0x1000a4c47
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x9f0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x1000a4c47
mov eax, r13d
lea rcx, [rax + rax*8]
lea rax, [rbx + rcx*8]
mov qword [rsp + 0x1b0], rax
mov rdx, rdi
lea rcx, [rsp + 0x1b8]
mov edi, ebp
lea r8, [rsp + 0x5d0]
lea rax, [rsp + 0x1b8]
sub r8, rax
mov r9d, 1
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4b4a
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a4b4a
mov word [rcx], ax
add rcx, 2
sub rdx, r9
jne 0x1000a4b28
cmp rdx, rbp
jne 0x1000a4b58
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a4c8a
mov r8, qword [rsp + 0x40]
movsxd rdi, dword [r8 + 8]
lea ebp, [rdi + 1]
test ebp, ebp
jle 0x1000a4c70
cmp edi, dword [r8 + 0xc]
jne 0x1000a4bd0
cmp edi, 0x3fffffff
jg 0x1000a4c70
movabs rcx, 0x3e0f83e0f83e0f
cmp rdi, rcx
ja 0x1000a4c70
lea esi, [rdi + rdi]
cmp dword [r8 + 0xc], 0
cmove esi, r9d
movsxd rdx, esi
imul rdx, rdx, 0x210
mov rcx, qword [r8]
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x1000a4c70
mov r8, qword [rsp + 0x40]
mov dword [r8 + 0xc], esi
mov qword [r8], rax
mov dword [r8 + 8], ebp
mov rcx, rdi
imul rcx, rcx, 0x210
add rcx, qword [r8]
je 0x1000a4c42
mov rax, qword [rsp + 0x1b0]
mov qword [rcx], rax
mov edx, 0x104
add rcx, 8
xor ebp, ebp
mov edi, ebp
lea r8, [rsp + 0x1b8]
sub r8, rcx
lea esi, [rbp + 1]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4c2b
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a4c2b
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000a4c09
cmp rdx, rbp
jne 0x1000a4c39
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a4c5a
jmp 0x1000a4c47
xor ebp, ebp
lea esi, [rbp + 1]
add r13d, esi
add r12, 0x48
cmp r13d, dword [rsp + 0x4c]
jae 0x1000a4ca0
jmp 0x1000a4892
mov dword [rsp + 0x40], edi
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], edi
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov rbx, qword [rsp + 0x108]
mov rax, qword [rsp + 0x120]
mov qword [rax], rbx
mov qword [rsp + 0x108], rbp
lea rax, [0x10003a7e0]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x130]
call fcn.1000e80ec
mov rcx, qword [rsp + 0xe10]
xor rcx, rsp
call fcn.100130830
mov rbx, qword [rsp + 0xe60]
add rsp, 0xe20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret