Function at 0x1400061a0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r14, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x78], r15d
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1400293e0]
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 8
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x60], r12
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x64], edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x48]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetShareEnum]
mov edi, eax
test eax, eax
je 0x1400062c7
cmp eax, 0xea
jne 0x140006355
mov esi, r15d
cmp dword [rsp + 0x50], r15d
jbe 0x140006355
mov rbx, qword [rsp + 0x48]
add rbx, 0x18
nop
lea rdx, str.Share_Name:
lea rcx, [rbp - 0x60]
call fcn.140013250
mov rdx, qword [rbx - 0x18]
mov rcx, rax
call fcn.140013250
mov rcx, rax
call fcn.140013420
mov rdx, qword [rbx + 0x10]
mov rcx, rax
call fcn.140013250
mov rcx, rax
lea rdx, [0x14002716c]
call fcn.140013250
lea rdx, str.__Permissions:
lea rcx, [rbp - 0x60]
call fcn.140013250
mov edx, dword [rbx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140027194]
call fcn.140013250
lea rbx, [rbx + 0x38]
inc esi
cmp esi, dword [rsp + 0x50]
jb 0x1400062e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000636a
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov qword [rsp + 0x48], r15
cmp edi, 0xea
je 0x140006280
test edi, edi
je 0x1400063c2
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
xor r8d, r8d
lea rdx, [0x140026c01]
mov rcx, r14
call fcn.140004410
nop
mov rcx, qword [rbp - 0x60]
movsxd rdx, dword [rcx + 4]
mov qword [rbp + rdx - 0x60], r12
mov rcx, qword [rbp - 0x60]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rbp + rdx - 0x64], r8d
jmp 0x140006658
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov r8d, 7
mov qword [rsp + 0x70], r8
mov word [rsp + 0x58], r15w
mov dword [rsp + 0x40], 0xc
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov rcx, r15
mov r9d, dword [rbp + 0x18]
mov eax, r9d
and al, 0x22
cmp al, 2
je 0x140006429
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
test rdx, rdx
je 0x140006429
mov rax, qword [rbp - 0x38]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x10]
cmovb rdx, qword [rbp + 0x10]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x140006461
test r9b, 4
jne 0x140006496
mov rax, qword [rbp - 0x20]
mov r10, qword [rax]
mov rdx, r15
test r10, r10
je 0x14000645d
mov rax, qword [rbp - 0x40]
mov r9, qword [rax]
mov rax, qword [rbp - 8]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, r10
sar rdx, 1
mov rcx, r9
jmp 0x140006461
mov r9, qword [rbp - 0x80]
test rcx, rcx
je 0x140006496
lea rcx, [rsp + 0x58]
cmp rdx, r8
ja 0x14000648c
mov qword [rsp + 0x68], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsp + rbx + 0x58], r15w
jmp 0x140006491
call fcn.140014020
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
mov r9, qword [rsp + 0x58]
cmp r8, 7
cmova rcx, r9
mov rax, qword [rsp + 0x68]
lea rsi, [rcx + rax*2]
lea rdi, [rsp + 0x58]
cmova rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov ebx, 0xf
mov qword [rbp - 0x68], rbx
cmp rdi, rsi
jne 0x1400064dc
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], 0
jmp 0x1400065d6
sub rsi, rdi
sar rsi, 1
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1400066a3
cmp rsi, rbx
jbe 0x140006591
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x140006541
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400224e8
mov rcx, rax
test rax, rax
je 0x14000657b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x140006595
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006563
mov rax, r15
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x140006595
cmp rcx, 0x1000
jb 0x140006582
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400066a9
jmp 0x14000651b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400224e8
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x140006595
mov rax, qword [rbp - 0x80]
lea r8, [rbp - 0x80]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400065c3
nop dword [rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x1400065b0
mov qword [rbp - 0x70], rsi
mov byte [r8 + rsi], 0
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x58]
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [r14 + 0x10], xmm1
cmp r8, 7
jbe 0x140006625
lea rdx, [r8*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14000661d
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000661d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r9
call fcn.140022240
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x60], r12
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x64], edx
lea rcx, [rbp - 0x58]
call fcn.140010c30
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov rax, r14
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140022220
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400013c0
nop
call fcn.140001320
int3