Function at 0x1000a43fc
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe20
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0xe10], rax
mov qword [rsp + 0x120], r9
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov rsi, qword [rsp + 0xe80]
lea r13, [0x10001e260]
mov qword [rsp + 0x50], r13
lea r14, [0x10001ee90]
mov qword [rsp + 0x58], r14
lea r15, [0x10001e240]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3f4
mov r12d, 1
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
xor ebp, ebp
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [r11 - 0xd65], r12b
xor edx, edx
lea r8d, [r12 + 0x77]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e842c
nop
mov dword [rsp + 0x48], ebp
mov word [rsp + 0x3c0], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3c2]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x118], rbp
lea rax, [0x100039468]
mov qword [rsp + 0x110], rax
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
mov edi, ebp
lea rax, [rsp + 0x3c0]
mov r8, rbx
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4541
movzx eax, word [rcx + r8]
cmp ax, bp
je 0x1000a4541
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x1000a451f
cmp rdx, rbp
jne 0x1000a454f
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
mov dword [rsp + 0x138], edi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x3ff
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ef20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052900
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp word [rbx + rcx*2 - 2], 0x5c
je 0x1000a4661
lea r8, [0x1000021a0]
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1000527c4
mov dword [rsp + 0x138], eax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x406
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, [0x10001ef70]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.100052900
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1000a4728
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 0x40e
mov r14d, 6
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001efc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
nop
lea rcx, [rsp + 0x130]
call fcn.1000e8518
jmp 0x1000a4ea3
mov edx, dword [rsp + 0x48]
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x118], rax
cmp rax, rbp
jne 0x1000a4763
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov r14d, 6
mov r15d, 0x80070000
cmp eax, ebp
jne 0x1000a4838
mov qword [rsp + 0x50], r13
lea rbx, [0x10001ee90]
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x41b
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [r14 + 0x72]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x3c0]
lea r8, [0x10001efc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x118], rbp
mov qword [rsi], rbp
jmp 0x1000a484a
mov qword [rsp + 0x118], rbp
mov qword [rsi], rdi
lea rbx, [0x10001ee90]
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0xf8], ebp
mov word [rsp + 0x5d0], bp
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x5d2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x7e0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x7e2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x9f0], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x9f2]
call sub.msvcrt.dll_memset
mov word [rsp + 0xc00], bp
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc02]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4973
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x431
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, r15d
cmp eax, ebp
cmovle r8d, eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [0x10001f030]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000ea25c
int3
lea rax, [0x1000228a0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x108]
mov edx, 0x1f6
xor ecx, ecx
call sub.NETAPI32.dll_NetShareEnum
mov edi, eax
cmp eax, ebp
je 0x1000a4a40
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x442
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], r12b
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10001f080]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
mov rbx, qword [rsp + 0x108]
jmp 0x1000a4e74
mov rbx, qword [rsp + 0x108]
mov r13d, ebp
cmp dword [rsp + 0x4c], ebp
jbe 0x1000a4e74
lea r12, [rbx + 0x28]
mov esi, 1
cmp dword [r12 - 0x20], ebp
jne 0x1000a4e13
mov edi, 0x104
mov r8d, edi
lea rdx, [rsp + 0x5d0]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, ebp
jne 0x1000a4b23
lea rax, [0x10001e260]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ee90]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x44d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov r9, qword [r12]
lea r8, [0x10001f0c0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
jmp 0x1000a4e13
mov r8d, edi
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4be0
lea rax, [0x10001e260]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ee90]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x459
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x5d0]
lea r8, [0x10001f120]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
jmp 0x1000a4e13
mov r8d, edi
lea rdx, [rsp + 0x9f0]
lea rcx, [rsp + 0x7e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, ebp
jne 0x1000a4c9d
lea rax, [0x10001e260]
mov qword [rsp + 0x50], rax
lea rax, [0x10001ee90]
mov qword [rsp + 0x58], rax
lea rax, [0x10001e240]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x45d
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xff
mov word [rsp + 0xf0], bp
mov byte [rsp + 0xf2], bpl
mov byte [rsp + 0xf3], sil
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r15d
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x7e0]
lea r8, [0x10001f190]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
jmp 0x1000a4e13
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x9f0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x1000a4e13
mov eax, r13d
lea rcx, [rax + rax*8]
lea rax, [rbx + rcx*8]
mov qword [rsp + 0x1b0], rax
mov rdx, rdi
lea rcx, [rsp + 0x1b8]
mov edi, ebp
lea r8, [rsp + 0x5d0]
lea rax, [rsp + 0x1b8]
sub r8, rax
mov r9d, 1
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4d16
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a4d16
mov word [rcx], ax
add rcx, 2
sub rdx, r9
jne 0x1000a4cf4
cmp rdx, rbp
jne 0x1000a4d24
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a4e56
mov r8, qword [rsp + 0x40]
movsxd rdi, dword [r8 + 8]
lea ebp, [rdi + 1]
test ebp, ebp
jle 0x1000a4e3c
cmp edi, dword [r8 + 0xc]
jne 0x1000a4d9c
cmp edi, 0x3fffffff
jg 0x1000a4e3c
movabs rcx, 0x3e0f83e0f83e0f
cmp rdi, rcx
ja 0x1000a4e3c
lea esi, [rdi + rdi]
cmp dword [r8 + 0xc], 0
cmove esi, r9d
movsxd rdx, esi
imul rdx, rdx, 0x210
mov rcx, qword [r8]
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x1000a4e3c
mov r8, qword [rsp + 0x40]
mov dword [r8 + 0xc], esi
mov qword [r8], rax
mov dword [r8 + 8], ebp
mov rcx, rdi
imul rcx, rcx, 0x210
add rcx, qword [r8]
je 0x1000a4e0e
mov rax, qword [rsp + 0x1b0]
mov qword [rcx], rax
mov edx, 0x104
add rcx, 8
xor ebp, ebp
mov edi, ebp
lea r8, [rsp + 0x1b8]
sub r8, rcx
lea esi, [rbp + 1]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a4df7
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a4df7
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000a4dd5
cmp rdx, rbp
jne 0x1000a4e05
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
cmp edi, ebp
jl 0x1000a4e26
jmp 0x1000a4e13
xor ebp, ebp
lea esi, [rbp + 1]
add r13d, esi
add r12, 0x48
cmp r13d, dword [rsp + 0x4c]
jae 0x1000a4e6c
jmp 0x1000a4a5e
mov dword [rsp + 0x40], edi
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rsp + 0x40], edi
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov rbx, qword [rsp + 0x108]
mov rax, qword [rsp + 0x120]
mov qword [rax], rbx
mov qword [rsp + 0x108], rbp
lea rax, [0x1000228b8]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x130]
call fcn.1000e8518
mov rcx, qword [rsp + 0xe10]
xor rcx, rsp
call fcn.100130df0
mov rbx, qword [rsp + 0xe60]
add rsp, 0xe20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret