Function at 0x140044ca0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x40], 0xffffffff
mov dword [rbp - 0x3c], 0x4000
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, rcx
xor edx, edx
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x13]
call qword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x140044f63
mov r8d, dword [rbp - 0x3c]
lea edx, [rax + 8]
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140044f59
lea r9, [rbp - 0x3c]
mov r8, rax
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x140044f47
mov r15d, 0xe3
lea r12d, [r15 - 0x16]
xor esi, esi
cmp dword [rbp - 0x40], esi
jbe 0x140044f2a
lea rdi, [rsi + rsi*2]
shl rdi, 4
add rdi, r14
test byte [rdi + 0xc], 2
je 0x140044d75
lea rdx, [0x140076d98]
mov rcx, rdi
call fcn.140044ca0
jmp 0x140044f1f
mov rbx, qword [rdi + 0x18]
test rbx, rbx
je 0x140044f1f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x140044f1f
lea ecx, [rax - 1]
movsxd rdx, ecx
movzx r8d, word [rbx + rdx*2]
movsxd rdx, eax
add rdx, rdx
cmp r8w, 0x2e
jne 0x140044db6
cmp word [rdx + rbx], 0
je 0x140044f1f
cmp eax, 1
jle 0x140044dda
add eax, 0xfffffffe
movsxd rcx, eax
cmp word [rbx + rcx*2], 0x2e
jne 0x140044dda
cmp r8w, 0x2e
jne 0x140044dda
cmp word [rdx + rbx], 0
je 0x140044f1f
mov dword [rbp - 0x30], 0x200035
mov dword [rbp - 0x2c], 0x610096
mov dword [rbp - 0x28], 0x5f0007
mov dword [rbp - 0x24], 0x400a3
mov dword [rbp - 0x20], 0x380007
mov dword [rbp - 0x1c], 0x7d008c
mov dword [rbp - 0x18], 0x450008
mov dword [rbp - 0x14], 0x1200e8
mov dword [rbp - 0x10], 0x4f0079
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, 0x28a4
mov edx, eax
mov eax, dword [rax + rcx]
mov ebx, 0x2a90
add rbx, rcx
test al, 1
jne 0x140044e94
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x24], 1
lea rax, [rbx + 0x22]
lea rcx, [rbp - 0xe]
cmp rbx, rcx
ja 0x140044e72
lea rcx, [rbp - 0x30]
cmp rax, rcx
jb 0x140044e72
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x20], eax
jmp 0x140044e87
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x20], eax
lea rcx, [0x14006b9d0]
call fcn.140048870
nop
cmp byte [rbx + 0x24], 0
je 0x140044ef7
xor word [rbx], 0x73
xor word [rbx + 2], 0x4f
xor word [rbx + 4], r15w
xor word [rbx + 6], 0xf
xor word [rbx + 8], 0x63
xor word [rbx + 0xa], 0x7f
xor word [rbx + 0xc], r12w
xor word [rbx + 0xe], 0x61
xor word [rbx + 0x10], 0x73
xor word [rbx + 0x12], 0x4f
xor word [rbx + 0x14], r15w
xor word [rbx + 0x16], 0xf
xor word [rbx + 0x18], 0x63
xor word [rbx + 0x1a], 0x7f
xor word [rbx + 0x1c], r12w
xor word [rbx + 0x1e], 0x61
xor word [rbx + 0x20], 0x73
xor word [rbx + 0x22], 0x4f
mov byte [rbx + 0x24], 0
mov r9, qword [rdi + 0x18]
mov r8, rbx
mov edx, dword [0x140076d84]
mov ecx, dword [0x140076d88]
call fcn.140023530
lea rdx, [0x140076d98]
mov rcx, qword [rdi + 0x18]
call fcn.140044820
inc esi
cmp esi, dword [rbp - 0x40]
jb 0x140044d50
lea r9, [rbp - 0x3c]
mov r8, r14
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x140044d45
mov r8, r14
xor edx, edx
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.MPR.dll_WNetCloseEnum]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140048740
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret