Function at 0x1000a3e88
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe20
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0xe10], rax
mov qword [rsp + 0x120], r9
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov rsi, qword [rsp + 0xe80]
lea r13, [0x10001e120]
mov qword [rsp + 0x50], r13
lea r14, [0x10001ed50]
mov qword [rsp + 0x58], r14
lea r15, [0x10001e100]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3f4
mov r12d, 1
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
xor ebp, ebp
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [r11 - 0xd65], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e7c38
nop
mov dword [rsp + 0x48], ebp
mov word [rsp + 0x3c0], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3c2]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x118], rbp
lea rax, [0x1000391a8]
mov qword [rsp + 0x110], rax
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
mov edi, ebp
lea rax, [rsp + 0x3c0]
mov r8, rbx
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a3fcd
movzx eax, word [rcx + r8]
cmp ax, bp
je 0x1000a3fcd
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x1000a3fab
cmp rdx, rbp
jne 0x1000a3fdb
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
mov dword [rsp + 0x138], edi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3ff
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ede0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052600
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp word [rbx + rcx*2 - 2], 0x5c
je 0x1000a40ed
lea r8, [0x1000021a0]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1000524c4
mov dword [rsp + 0x138], eax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x406
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ee30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052600
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1000a41b4
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x40e
mov r14d, 6
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001ee80]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0x130]
call fcn.1000e7d24
jmp 0x1000a492f
mov edx, dword [rsp + 0x48]
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x118], rax
cmp rax, rbp
jne 0x1000a41ef
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov r14d, 6
mov r15d, 0x80070000
cmp eax, ebp
jne 0x1000a42c4
mov qword [rsp + 0x50], r13
lea rbx, [0x10001ed50]
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x41b
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001ee80]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x118], rbp
mov qword [rsi], rbp
jmp 0x1000a42d6
mov qword [rsp + 0x118], rbp
mov qword [rsi], rdi
lea rbx, [0x10001ed50]
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0xf8], ebp
mov word [rsp + 0x5d0], bp
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x5d2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x7e0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x7e2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x9f0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x9f2]
call sub.msvcrt.dll_memset
mov word [rsp + 0xc00], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc02]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a43ff
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x431
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, r15d
cmp eax, ebp
cmovle r8d, eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [0x10001eef0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9a68
int3
lea rax, [0x100022760]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x108]
mov edx, 0x1f6
xor ecx, ecx
call sub.NETAPI32.dll_NetShareEnum
mov edi, eax
cmp eax, ebp
je 0x1000a44cc
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x442
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10001ef40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
mov rbx, qword [rsp + 0x108]
jmp 0x1000a4900
mov rbx, qword [rsp + 0x108]
mov r13d, ebp
cmp dword [rsp + 0x4c], ebp
jbe 0x1000a4900
lea r12, [rbx + 0x28]
mov esi, 1
cmp dword [r12 - 0x20], ebp
jne 0x1000a489f
mov edi, 0x104
mov r8d, edi
lea rdx, [rsp + 0x5d0]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, ebp
jne 0x1000a45af
lea rax, [0x10001e120]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ed50]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x44d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov r9, qword [r12]
lea r8, [0x10001ef80]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
jmp 0x1000a489f
mov r8d, edi
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a466c
lea rax, [0x10001e120]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ed50]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x459
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x5d0]
lea r8, [0x10001efe0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
jmp 0x1000a489f
mov r8d, edi
lea rdx, [rsp + 0x9f0]
lea rcx, [rsp + 0x7e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4729
lea rax, [0x10001e120]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ed50]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e100]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x45d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x7e0]
lea r8, [0x10001f050]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
jmp 0x1000a489f
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x9f0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x1000a489f
mov eax, r13d
lea rcx, [rax + rax*8]
lea rax, [rbx + rcx*8]
mov qword [rsp + 0x1b0], rax
mov rdx, rdi
lea rcx, [rsp + 0x1b8]
mov edi, ebp
lea r8, [rsp + 0x5d0]
lea rax, [rsp + 0x1b8]
sub r8, rax
mov r9d, 1
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a47a2
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a47a2
mov word [rcx], ax
add rcx, 2
sub rdx, r9
jne 0x1000a4780
cmp rdx, rbp
jne 0x1000a47b0
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a48e2
mov r8, qword [rsp + 0x40]
movsxd rdi, dword [r8 + 8]
lea ebp, [rdi + 1]
test ebp, ebp
jle 0x1000a48c8
cmp edi, dword [r8 + 0xc]
jne 0x1000a4828
cmp edi, 0x3fffffff
jg 0x1000a48c8
movabs rcx, 0x3e0f83e0f83e0f
cmp rdi, rcx
ja 0x1000a48c8
lea esi, [rdi + rdi]
cmp dword [r8 + 0xc], 0
cmove esi, r9d
movsxd rdx, esi
imul rdx, rdx, 0x210
mov rcx, qword [r8]
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x1000a48c8
mov r8, qword [rsp + 0x40]
mov dword [r8 + 0xc], esi
mov qword [r8], rax
mov dword [r8 + 8], ebp
mov rcx, rdi
imul rcx, rcx, 0x210
add rcx, qword [r8]
je 0x1000a489a
mov rax, qword [rsp + 0x1b0]
mov qword [rcx], rax
mov edx, 0x104
add rcx, 8
xor ebp, ebp
mov edi, ebp
lea r8, [rsp + 0x1b8]
sub r8, rcx
lea esi, [rbp + 1]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4883
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a4883
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000a4861
cmp rdx, rbp
jne 0x1000a4891
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a48b2
jmp 0x1000a489f
xor ebp, ebp
lea esi, [rbp + 1]
add r13d, esi
add r12, 0x48
cmp r13d, dword [rsp + 0x4c]
jae 0x1000a48f8
jmp 0x1000a44ea
mov dword [rsp + 0x40], edi
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], edi
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov rbx, qword [rsp + 0x108]
mov rax, qword [rsp + 0x120]
mov qword [rax], rbx
mov qword [rsp + 0x108], rbp
lea rax, [0x10000d450]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x130]
call fcn.1000e7d24
mov rcx, qword [rsp + 0xe10]
xor rcx, rsp
call fcn.1001303c0
mov rbx, qword [rsp + 0xe60]
add rsp, 0xe20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret