Function at 0x1016f21
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
or dword [ebp - 4], 0xffffffff
push ebx
mov bx, word [ebp + 0xc]
push edi
xor edi, edi
cmp bx, 5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
jbe 0x1016f5f
cmp bx, 0x34
je 0x1016f5f
mov dword [ebp + 8], 0x7c
jmp 0x10171e3
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1016fa1
cmp word [eax], di
je 0x1016fa1
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
movzx ecx, word [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
movzx ecx, bx
push ecx
push eax
call fcn.01017ac4
mov cx, word [ebp - 0x28]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x18]
mov word [eax], cx
mov eax, dword [ebp + 0x1c]
mov cx, word [ebp - 0x2c]
mov word [eax], cx
jmp 0x10171ae
mov eax, dword [ebp + 0x18]
mov word [eax], di
mov eax, dword [ebp + 0x1c]
push edi
mov word [eax], di
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 1
push edi
call sub.NETAPI32.dll_NetShareEnum
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10171ae
push esi
movzx esi, word [ebp + 0x14]
add esi, dword [ebp + 0x10]
push 2
pop eax
cmp bx, ax
jne 0x1016fe4
xor eax, eax
inc eax
jmp 0x1016fea
cmp bx, 4
jne 0x1016ff2
call fcn.010159de
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x34], edi
mov dword [ebp - 0x24], edi
jbe 0x10171ad
xor ebx, ebx
mov eax, dword [ebp - 8]
add eax, ebx
cmp dword [eax + 4], 1
jne 0x1017156
push dword [eax]
call sub.msvcrt.dll_wcslen
cmp eax, 0xc
pop ecx
ja 0x1017156
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [ebx + eax]
call fcn.010174b9
test eax, eax
je 0x1017197
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push 2
push dword [ebp - 4]
call fcn.01017576
test eax, eax
jne 0x101705b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1017197
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x10171a2
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x18]
push eax
push 2
push dword [ebp - 4]
call fcn.01017576
test eax, eax
je 0x1017197
mov eax, dword [ebp - 8]
movzx edi, word [ebp + 0xc]
push dword [ebx + eax]
mov ecx, dword [ebp - 0xc]
mov eax, edi
call fcn.01015e23
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x20], eax
jne 0x101712e
movzx ecx, word [ebp + 0x14]
cmp ecx, eax
jb 0x101712e
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
push dword [ebx + eax]
mov ecx, esi
mov esi, dword [ebp - 0xc]
mov eax, edi
mov dword [ebp - 0x38], edx
call fcn.010161cd
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.010161a0
mov esi, dword [ebp + 0x14]
sub esi, dword [ebp - 0x20]
add dword [ebp + 0x10], eax
cmp word [ebp + 0xc], 2
mov dword [ebp + 0x14], esi
je 0x10170fa
cmp word [ebp + 0xc], 4
je 0x10170fa
mov eax, dword [ebp + 0x18]
inc word [eax]
mov esi, dword [ebp - 0x10]
jmp 0x1017135
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
movzx eax, si
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [ebx + eax]
call fcn.0101650d
cmp eax, 0x84b
mov dword [ebp + 8], eax
jne 0x101716a
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp + 0x1c]
push dword [ebp - 0xc]
inc word [eax]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
and dword [ebp - 0xc], 0
call fcn.010173bd
or dword [ebp - 4], 0xffffffff
xor edi, edi
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add ebx, 0xc
cmp eax, dword [ebp - 0x34]
jb 0x1017000
jmp 0x10171ad
test eax, eax
jne 0x10171ab
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x1c]
push dword [ebp - 0x30]
add dword [ebp + 0x10], eax
sub esi, dword [ebp - 0x20]
mov eax, dword [ebp + 0x18]
inc word [eax]
push 1
push dword [ebp - 0x38]
mov dword [ebp + 0x14], esi
push edi
call fcn.01016a7c
jmp 0x10170f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x10171ad
mov dword [ebp + 8], 8
jmp 0x10171ad
xor edi, edi
pop esi
cmp dword [ebp - 4], 0xffffffff
je 0x10171bc
push dword [ebp - 4]
call fcn.010173bd
cmp dword [ebp - 0xc], edi
je 0x10171ca
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], edi
je 0x10171d7
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x14], edi
je 0x10171e3
mov dword [ebp + 8], 0x84b
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 0x18