Function at 0x1000048f8
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
xor eax, eax
mov rbx, rcx
lea r8, [rsp + 0x54]
lea rdx, [0x10000d810]
lea ecx, [rax + 0xc]
or edi, 0xffffffff
mov word [rsp + 0x50], ax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x4c], ax
mov r13, rax
mov r12, rax
mov byte [rsp + 0xd0], 1
mov bpl, al
mov byte [rsp + 0xc8], al
mov r14d, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
mov r15d, eax
call fcn.100005b50
xor r11d, r11d
mov esi, r11d
cmp qword [0x100010510], r11
je 0x100004b32
lea rbx, [0x100010510]
lea ecx, [r12 + 1]
cmp esi, ecx
ja 0x100004b13
mov rcx, qword [rbx]
mov edx, 0x3a
call qword [sym.imp.msvcrt.dll_wcschr]
xor r11d, r11d
cmp rax, r11
je 0x1000049a5
mov word [rax], r11w
lea rcx, [rax + 2]
jmp 0x1000049a8
mov rcx, r11
mov rax, qword [rbx]
lea r10, [0x10000cc78]
mov rdx, rax
sub r10, rax
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x1000049cf
add rdx, 2
test r8d, r8d
jne 0x1000049b8
cmp r9d, r11d
jne 0x100004a2c
mov al, byte [rsp + 0xc8]
cmp rcx, r11
jne 0x100004a27
mov edi, 0x80000000
mov ecx, 1
cmp esi, r11d
jbe 0x1000049f8
cmp al, r11b
je 0x100004ae5
add rbx, 8
add esi, ecx
cmp qword [rbx], r11
jne 0x10000497d
cmp r12, r11
je 0x100004b2a
xor edx, edx
mov ecx, 0xdad
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
mov r13, rcx
jmp 0x1000049e5
lea r10, str._NETWORK
mov rdx, rax
sub r10, rax
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x100004a50
add rdx, 2
test r8d, r8d
jne 0x100004a39
cmp r9d, r11d
jne 0x100004a73
mov al, byte [rsp + 0xc8]
cmp rcx, r11
je 0x1000049e5
cmp word [rcx], r11w
je 0x1000049e5
mov r12, rcx
jmp 0x1000049e5
lea r9, str._CACHE
mov rcx, rax
sub r9, rax
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x100004a96
add rcx, 2
test edx, edx
jne 0x100004a80
cmp r8d, r11d
jne 0x100004aaf
mov al, byte [rsp + 0xc8]
mov ecx, 1
mov bpl, cl
jmp 0x1000049ea
lea r8, str._ALL
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x100004acd
add rax, 2
test edx, edx
jne 0x100004ab9
cmp ecx, r11d
jne 0x100004afc
mov ecx, 1
mov al, cl
mov byte [rsp + 0xc8], cl
jmp 0x1000049ea
xor edx, edx
mov ecx, 0xdb6
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
xor edx, edx
mov ecx, 0xdad
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
xor edx, edx
mov ecx, 0xdb6
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
mov rbx, qword [rsp + 0xc0]
cmp rbx, r11
jne 0x100004d01
call sub.IPHLPAPI.DLL_GetCurrentThreadCompartmentId
mov esi, 1
cmp eax, esi
je 0x100004b69
mov ecx, 0x125d
call fcn.10000572c
call fcn.1000056f8
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, r15d
mov ebx, 0x80000000
lea r9, [rsp + 0xd8]
cmp edi, ebx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r13
setne dl
xor ecx, ecx
mov dword [rsp + 0x20], edi
add edx, 0x64
call fcn.100008314
cmp eax, 0xea
jne 0x100004bbf
mov dword [rsp + 0x4c], esi
mov eax, dword [rsp + 0xd8]
cmp eax, r15d
jne 0x100004bd8
mov ecx, 0xe63
call fcn.10000572c
xor ecx, ecx
call fcn.100005934
int3
cmp eax, r15d
je 0x100004ba1
xor edx, edx
mov ecx, eax
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
mov rcx, qword [rsp + 0x60]
mov r8d, 0x20
cmp edi, ebx
lea ebp, [r8 - 0x18]
lea r9, [0x1000053c8]
mov rdx, rax
cmove r8, rbp
call qword [sym.imp.msvcrt.dll_qsort]
mov ecx, 0x1260
cmp edi, ebx
je 0x100004c0b
mov ecx, 0x125c
call fcn.10000572c
call fcn.1000059e4
cmp edi, ebx
jne 0x100004c76
mov rbx, qword [rsp + 0x60]
mov edi, r15d
cmp dword [rsp + 0xd8], r15d
jbe 0x100004cdc
mov rdx, qword [rbx]
lea r8, [0x100011f80]
mov r9d, 0x1000
mov ecx, 0x14
call fcn.100005cc4
lea rcx, [0x100001738]
mov rdx, rax
call fcn.100005c4c
lea rcx, [0x1000018c4]
xor edx, edx
call fcn.100005c4c
add edi, esi
add rbx, rbp
cmp edi, dword [rsp + 0xd8]
jb 0x100004c2f
jmp 0x100004cdc
mov rdi, qword [rsp + 0x60]
mov ebx, r15d
cmp dword [rsp + 0xd8], r15d
jbe 0x100004cdc
mov rdx, qword [rdi]
lea r8, [0x100011f80]
mov r9d, 0x1000
mov ecx, 0x14
call fcn.100005cc4
lea rcx, [0x100001748]
mov rdx, rax
call fcn.100005c4c
mov rdx, qword [rdi + 0x18]
mov ecx, 0xffffffc8
call fcn.1000080d4
lea rcx, [0x1000018c4]
xor edx, edx
call fcn.100005c4c
add ebx, esi
add rdi, 0x20
cmp ebx, dword [rsp + 0xd8]
jb 0x100004c88
mov rcx, qword [rsp + 0x60]
call sub.netutils.dll_NetApiBufferFree
cmp word [rsp + 0x4c], r15w
je 0x100004b53
mov ecx, 0xdb9
call fcn.10000572c
jmp 0x100004b58
mov r13d, 1
cmp bpl, r13b
jne 0x100004d43
mov qword [rsp + 0x30], r11
lea rax, [rsp + 0x54]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
or r9d, 0xffffffff
mov edx, 0x1f5
mov rcx, rbx
mov qword [rsp + 0x20], rax
call sub.srvcli.dll_NetShareEnum
xor r11d, r11d
jmp 0x100004d4a
mov eax, dword [rsp + 0xc8]
cmp bpl, r11b
je 0x100004d59
cmp eax, r11d
je 0x100004d99
cmp eax, 0x35
je 0x100004d99
mov qword [rsp + 0x30], r11
lea rax, [rsp + 0x54]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
or r9d, 0xffffffff
mov edx, r13d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call sub.srvcli.dll_NetShareEnum
xor r11d, r11d
mov dil, r11b
mov byte [rsp + 0xd0], r11b
jmp 0x100004d9c
mov dil, r13b
cmp eax, 0xea
jne 0x100004dc7
mov word [rsp + 0x4c], r13w
mov eax, dword [rsp + 0xd8]
cmp eax, r11d
jne 0x100004de0
mov ecx, 0xe63
call fcn.10000572c
xor ecx, ecx
call fcn.100005934
int3
cmp eax, r11d
je 0x100004da9
xor edx, edx
mov ecx, eax
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
mov rsi, qword [rsp + 0x60]
mov ebp, r11d
cmp eax, r11d
jbe 0x1000053b0
cmp byte [rsp + 0xc8], r11b
jne 0x100004e1c
mov rcx, qword [rsi]
mov edx, 0x24
call qword [sym.imp.msvcrt.dll_wcsrchr]
xor r11d, r11d
cmp rax, r11
je 0x100004e1c
cmp word [rax + 2], r11w
je 0x100004fc0
mov rcx, qword [rsi]
call fcn.100005ab4
cmp eax, r14d
cmovg r14d, eax
mov eax, dword [rsi + 8]
and eax, 0x3fffffff
je 0x100004e68
sub eax, r13d
je 0x100004e5f
sub eax, r13d
je 0x100004e56
cmp eax, r13d
je 0x100004e4d
mov rcx, qword [0x10000d878]
jmp 0x100004e6f
mov rcx, qword [0x10000d868]
jmp 0x100004e6f
mov rcx, qword [0x10000d848]
jmp 0x100004e6f
mov rcx, qword [0x10000d858]
jmp 0x100004e6f
mov rcx, qword [0x10000d838]
call fcn.100005ab4
mov r12d, dword [rsp + 0x40]
mov rdi, qword [rsi]
cmp eax, r12d
mov ebx, eax
cmovg r12d, eax
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
mov dword [rsp + 0x40], r12d
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
mov r13, qword [rsp + 0xc0]
mov rdx, rcx
mov rcx, r8
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea edi, [rdx + rcx + 1]
lea rdx, [rsp + 0x58]
lea ecx, [rdi + rdi]
call sub.netutils.dll_NetApiBufferAllocate
test eax, eax
jne 0x10000539c
mov rcx, qword [rsp + 0x58]
movsxd rdi, edi
mov r8, r13
mov rdx, rdi
call fcn.100008aee
mov rcx, qword [rsp + 0x58]
lea r8, [0x100001758]
mov rdx, rdi
call fcn.100008ae2
mov r8, qword [rsi]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
call fcn.100008ae2
mov rcx, qword [rsp + 0x58]
lea rdx, [0x100015fc0]
mov r8d, 0x7ff
call fcn.1000053dc
test eax, eax
jne 0x100004f39
lea rcx, [0x100015fc0]
call fcn.100005ab4
mov ebx, eax
mov eax, dword [rsp + 0x48]
cmp ebx, eax
cmovg eax, ebx
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x58]
call sub.netutils.dll_NetApiBufferFree
mov dil, byte [rsp + 0xd0]
xor r11d, r11d
lea r13d, [r11 + 1]
mov qword [rsp + 0x58], r11
cmp dil, r13b
jne 0x100004fa9
mov eax, dword [rsi + 0x18]
and eax, 0x2030
je 0x100004fa0
cmp eax, 0x10
je 0x100004f97
cmp eax, 0x20
je 0x100004f8e
cmp eax, 0x30
je 0x100004f85
cmp eax, 0x2000
jne 0x100004fb7
mov rcx, qword [0x10000d8b8]
jmp 0x100004fad
mov rcx, qword [0x10000d8c8]
jmp 0x100004fad
mov rcx, qword [0x10000d8a8]
jmp 0x100004fad
mov rcx, qword [0x10000d898]
jmp 0x100004fad
mov rcx, qword [0x10000d888]
jmp 0x100004fad
mov rcx, qword [rsi + 0x10]
call fcn.100005ab4
xor r11d, r11d
mov ebx, eax
cmp ebx, r15d
cmovg r15d, ebx
jmp 0x100004fc5
mov r12d, dword [rsp + 0x40]
lea rax, [rsi + 0x20]
add rsi, 0x18
add ebp, r13d
cmp dil, r11b
cmovne rsi, rax
cmp ebp, dword [rsp + 0xd8]
jb 0x100004df1
cmp r14d, r11d
je 0x1000053b0
mov edx, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x60]
mov al, dil
neg al
lea r9, [0x1000053c8]
sbb r8, r8
and r8, 8
add r8, 0x18
call qword [sym.imp.msvcrt.dll_qsort]
mov rbx, qword [rsp + 0xc0]
mov ecx, 0x1119
mov rdx, rbx
call fcn.100005760
lea r8, [rsp + 0x40]
mov edx, 0x65
mov rcx, rbx
call sub.srvcli.dll_NetServerGetInfo
xor ebx, ebx
cmp eax, ebx
je 0x10000504d
mov rdi, qword [rsp + 0xc8]
jmp 0x10000506b
mov rdx, qword [rsp + 0x40]
mov r8d, 0x24
mov rcx, rdx
add rdx, 8
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x40]
mov eax, ebx
cmp eax, ebx
je 0x10000507f
lea rcx, [0x1000018c4]
xor edx, edx
call fcn.100005c4c
jmp 0x100005097
mov rdx, qword [rdi + 0x18]
lea rcx, [0x100001760]
call fcn.100005c4c
mov rcx, rdi
call sub.netutils.dll_NetApiBufferFree
mov edi, 2
mov edx, 0x1288
mov ecx, r14d
mov r8d, edi
call fcn.10000817c
mov r8d, edi
mov edx, 0x1289
mov ecx, r12d
mov r14d, eax
call fcn.10000817c
mov ecx, dword [rsp + 0x48]
mov r8d, edi
mov edx, 0x128a
mov r13d, eax
call fcn.10000817c
mov r8d, edi
mov edx, 0x128b
mov ecx, r15d
mov r12d, eax
call fcn.10000817c
lea rcx, [0x1000018c4]
xor edx, edx
mov ebp, eax
call fcn.100005c4c
cmp r14d, 0xffffffff
je 0x10000538a
cmp r13d, 0xffffffff
je 0x10000538a
cmp r12d, 0xffffffff
je 0x10000538a
cmp ebp, 0xffffffff
je 0x10000538a
lea rcx, [0x1000018c4]
xor edx, edx
call fcn.100005c4c
call fcn.1000059e4
mov rbx, qword [rsp + 0x60]
xor r15d, r15d
mov esi, r15d
cmp dword [rsp + 0xd8], r15d
jbe 0x10000534d
mov r15, qword [rsp + 0xc0]
mov dil, byte [rsp + 0xd0]
xor ecx, ecx
cmp byte [rsp + 0xc8], cl
jne 0x100005183
mov rcx, qword [rbx]
mov edx, 0x24
call qword [sym.imp.msvcrt.dll_wcsrchr]
xor ecx, ecx
cmp rax, rcx
je 0x100005183
cmp word [rax + 2], cx
je 0x100005327
mov rdx, qword [rbx]
mov ecx, r14d
call fcn.1000080d4
mov edx, dword [rbx + 8]
xor eax, eax
and edx, 0x3fffffff
cmp edx, eax
je 0x1000051d2
mov eax, 1
sub edx, eax
je 0x1000051c9
sub edx, eax
je 0x1000051c0
cmp edx, eax
je 0x1000051b7
mov rdx, qword [0x10000d878]
jmp 0x1000051d9
mov rdx, qword [0x10000d868]
jmp 0x1000051d9
mov rdx, qword [0x10000d848]
jmp 0x1000051d9
mov rdx, qword [0x10000d858]
jmp 0x1000051d9
mov rdx, qword [0x10000d838]
mov ecx, r13d
call fcn.1000080d4
mov rdi, qword [rbx]
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r15
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
lea edi, [rdx + rcx + 1]
lea rdx, [rsp + 0x58]
lea ecx, [rdi + rdi]
call sub.netutils.dll_NetApiBufferAllocate
xor ecx, ecx
cmp eax, ecx
jne 0x100005376
mov rcx, qword [rsp + 0x58]
movsxd rdi, edi
mov r8, r15
mov rdx, rdi
call fcn.100008aee
mov rcx, qword [rsp + 0x58]
lea r8, [0x100001758]
mov rdx, rdi
call fcn.100008ae2
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
call fcn.100008ae2
mov rcx, qword [rsp + 0x58]
lea rdx, [0x100015fc0]
mov r8d, 0x7ff
call fcn.1000053dc
xor edi, edi
cmp eax, edi
je 0x10000527c
mov dword [rsp + 0x50], 1
jmp 0x10000528b
lea rdx, [0x100015fc0]
mov ecx, r12d
call fcn.1000080d4
mov rcx, qword [rsp + 0x58]
call sub.netutils.dll_NetApiBufferFree
cmp byte [rsp + 0xd0], 1
mov qword [rsp + 0x58], rdi
jne 0x100005304
mov ecx, dword [rbx + 0x18]
mov rax, rdi
and ecx, 0x2030
je 0x1000052ed
cmp ecx, 0x10
je 0x1000052e4
cmp ecx, 0x20
je 0x1000052db
cmp ecx, 0x30
je 0x1000052d2
cmp ecx, 0x2000
jne 0x1000052f4
mov rax, qword [0x10000d8b8]
jmp 0x1000052f4
mov rax, qword [0x10000d8c8]
jmp 0x1000052f4
mov rax, qword [0x10000d8a8]
jmp 0x1000052f4
mov rax, qword [0x10000d898]
jmp 0x1000052f4
mov rax, qword [0x10000d888]
lea rdx, [0x100001508]
cmp rax, rdi
cmovne rdx, rax
jmp 0x100005308
mov rdx, qword [rbx + 0x10]
mov ecx, ebp
call fcn.1000080d4
lea rcx, [0x1000018c4]
xor edx, edx
call fcn.100005c4c
mov dil, byte [rsp + 0xd0]
xor ecx, ecx
lea rax, [rbx + 0x20]
add rbx, 0x18
inc esi
cmp dil, cl
cmovne rbx, rax
cmp esi, dword [rsp + 0xd8]
jb 0x10000515b
mov rbx, qword [rsp + 0x60]
xor r15d, r15d
mov rcx, rbx
call sub.netutils.dll_NetApiBufferFree
cmp word [rsp + 0x50], r15w
je 0x100004ce6
mov ecx, 0xdb0
call fcn.10000572c
mov ecx, 1
call fcn.100005934
int3
xor edx, edx
mov ecx, eax
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
xor edx, edx
lea ecx, [rdx + 0x57]
call fcn.100005818
mov ecx, edi
call fcn.100005934
int3
xor edx, edx
mov ecx, eax
call fcn.100005818
mov ecx, 2
call fcn.100005934
int3
mov ecx, 0xe63
call fcn.10000572c
xor ecx, ecx
call fcn.100005934
int3