Function at 0x401aa0
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x41e21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x550
push ebx
push ebp
mov ebp, dword [esp + 0x568]
push esi
mov ebx, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x134]
xor esi, esi
push str._location:
push ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x13c], al
mov byte [esp + 0x38], al
mov byte [esp + 0x260], al
call fcn.00413d30
add esp, 8
test eax, eax
jne 0x401b57
mov eax, dword [0x42852c]
lea ecx, [esp + 0x30]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x30]
mov cl, byte [esp + ecx + 0x30]
cmp cl, 0x5c
je 0x401b48
lea edx, [esp + 0x30]
push eax
push edx
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
jne 0x401b37
mov byte [eax], 0
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call fcn.004021b0
mov al, byte [ebp]
lea ecx, [esp + 0x134]
test al, al
mov dword [esp + 0x1c], ecx
je 0x401e1b
jmp 0x401b73
mov esi, dword [esp + 0x14]
cmp byte [ebp], 0x2f
jne 0x4020b0
mov edi, str._reset
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._reset
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401bb3
mov dword [ebx + 0x104], 1
mov edi, str._reset
jmp 0x401c4a
mov edi, str._runonce
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._runonce
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401be6
mov dword [ebx + 0x108], 1
mov edi, str._runonce
jmp 0x401c4a
mov edi, str._reboot
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._reboot
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401c19
mov dword [0x429008], 1
mov edi, str._reboot
jmp 0x401c4a
mov edi, str._autorun
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._autorun
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401c66
mov dword [ebx + 0x10c], 1
mov edi, str._autorun
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, ecx
cmp byte [ebp], 0x20
jne 0x401e11
inc ebp
jmp 0x401e11
mov edi, str._nar
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._nar
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401cbb
mov edi, str._nar
or ecx, 0xffffffff
mov dword [ebx + 0x318], 1
mov dword [0x422c78], 0x2000
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, ecx
cmp byte [ebp], 0x20
jne 0x401e11
inc ebp
jmp 0x401e11
mov edi, str._stf:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._stf:
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x401ed1
mov al, byte [ebp + 5]
add ebp, 5
test al, al
je 0x401d03
movsx edx, al
push edx
call fcn.00413610
add esp, 4
test eax, eax
je 0x401d03
mov al, byte [ebp + 1]
inc ebp
test al, al
jne 0x401ceb
mov al, byte [ebp]
lea ecx, [esp + 0x258]
test al, al
je 0x401d42
jmp 0x401d17
mov esi, dword [esp + 0x14]
cmp al, 0x20
jne 0x401d1f
test esi, esi
je 0x401d42
cmp al, 0x22
jne 0x401d27
test esi, esi
jne 0x401d42
test esi, esi
jne 0x401d37
cmp al, 0x22
jne 0x401d37
mov dword [esp + 0x14], 1
mov byte [ecx], al
mov al, byte [ebp + 1]
inc ecx
inc ebp
test al, al
jne 0x401d13
mov byte [ecx], 0
mov al, byte [esp + 0x259]
cmp al, 0x3a
je 0x401d81
cmp byte [esp + 0x258], 0x5c
jne 0x401d5e
cmp al, 0x5c
je 0x401d81
lea eax, [esp + 0x258]
lea ecx, [esp + 0x30]
push eax
add ebx, 0x110
push ecx
push str._s_s
push ebx
call fcn.00413640
add esp, 0x10
jmp 0x401dab
lea edi, [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x110
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push ebx
call fcn.00413bd0
add esp, 8
test eax, eax
jne 0x401e06
lea ecx, [esp + 0x20]
call fcn.0040b0f0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x568], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push 1
push str.ACME_STF
push str.SoftwareMicrosoftVisualStudio6.0Setup_
push eax
lea ecx, [esp + 0x38]
call fcn.0040b1e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x568], 0xffffffff
call fcn.0040b100
cmp byte [ebp], 0x20
jne 0x401e0d
inc ebp
mov ebx, dword [esp + 0x24]
cmp byte [ebp], 0
jne 0x401b6f
mov al, byte [esp + 0x134]
test al, al
je 0x401eb6
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
dec ecx
lea eax, [esp + ecx + 0x134]
push eax
push edx
call edi
mov esi, eax
movsx eax, byte [esi]
push eax
call fcn.00413610
add esp, 4
test eax, eax
je 0x401e82
lea ecx, [esp + 0x134]
push esi
push ecx
call edi
mov esi, eax
movsx edx, byte [esi]
push edx
call fcn.00413610
add esp, 4
test eax, eax
jne 0x401e65
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov byte [eax], 0
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x214]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x560]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x55c
ret 4
mov edi, str._location:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._location:
push ebp
call fcn.00413c20
add esp, 0xc
test eax, eax
jne 0x4020b0
mov edi, 0x4220c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._location:
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x30]
add ebp, ecx
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov al, byte [ebp]
lea ecx, [esp + 0x30]
test al, al
je 0x401f51
cmp al, 0x2f
je 0x401f51
mov byte [ecx], al
mov al, byte [ebp + 1]
inc ecx
inc ebp
test al, al
jne 0x401f42
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
push ecx
lea ecx, [esp + 0x34]
push ecx
call edi
mov esi, eax
movsx edx, byte [esi]
push edx
call fcn.00413610
add esp, 4
test eax, eax
je 0x401f8b
lea eax, [esp + 0x30]
push esi
push eax
call edi
mov esi, eax
movsx ecx, byte [esi]
push ecx
call fcn.00413610
add esp, 4
test eax, eax
jne 0x401f71
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov byte [eax], 0
mov al, byte [esp + 0x30]
cmp al, 0x5c
je 0x402094
lea edx, [esp + 0x10]
mov byte [esp + 0x10], al
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x402094
lea eax, [esp + 0x18]
lea ecx, [esp + 0x238]
push eax
push ecx
push 0
push 1
push 1
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x100
call sub.MPR.dll_WNetOpenEnumA
lea edx, [esp + 0x2c]
lea eax, [esp + 0x35c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push edx
call sub.MPR.dll_WNetEnumResourceA
test eax, eax
jne 0x40208a
mov ecx, dword [esp + 0x36c]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00413b00
add esp, 8
test eax, eax
je 0x402040
lea edx, [esp + 0x2c]
lea eax, [esp + 0x35c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push edx
call sub.MPR.dll_WNetEnumResourceA
test eax, eax
je 0x402005
jmp 0x40208a
mov ecx, dword [esp + 0x370]
lea eax, [esp + 0x32]
push eax
push ecx
lea edx, [esp + 0x464]
push 0x4220b4
push edx
call fcn.00413640
lea edi, [esp + 0x46c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push ecx
call sub.MPR.dll_WNetCloseEnum
lea edx, [esp + 0x30]
mov ecx, ebx
push edx
call fcn.004021b0
cmp byte [ebp], 0x20
jne 0x401e11
inc ebp
jmp 0x401e11
mov eax, dword [esp + 0x1c]
mov cl, byte [ebp]
mov byte [eax], cl
inc eax
mov dword [esp + 0x1c], eax
inc ebp
jmp 0x401e11