Function at 0x140004970
Capabilities:
Enumerate network shares

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor r12d, r12d
mov r14, rdx
mov r15, rcx
mov qword [rbp - 0x20], r12
mov dword [rbp - 0x18], r12d
mov dword [rbp - 0x10], r12d
lea esi, [r12 + 1]
mov dword [rbp - 0x14], r12d
nop dword [rax]
lea rax, [rbp - 0x14]
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov edx, esi
mov qword [rsp + 0x28], rax
mov rcx, r15
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.NETAPI32.dll_NetShareEnum]
test eax, eax
je 0x1400049f0
cmp eax, 0xea
je 0x1400049b0
jmp 0x140004bc6
mov qword [rsp + 0xb8], rdi
mov rdi, qword [rbp - 0x20]
cmp dword [rbp - 0x18], esi
jb 0x140004bb5
mov qword [rsp + 0xb0], rbx
nop dword [rax]
mov eax, dword [rdi + 8]
test eax, 0x3fffffff
jne 0x140004b9a
cmp eax, 0xc0000000
je 0x140004b9a
mov ecx, 0x7d10
call fcn.14000d7f8
mov rbx, rax
test rax, rax
je 0x140004b9a
xor edx, edx
mov r8d, 0x7d10
mov rcx, rax
call fcn.14001b960
mov byte [rbp - 0x28], r12b
mov byte [rbp - 0x27], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x26], WSAStartup
mov byte [rbp - 0x25], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x24], WSAStartup
mov byte [rbp - 0x23], WSAStartup
mov byte [rbp - 0x22], WSAStartup
movzx eax, byte [rbp - 0x27]
movzx eax, byte [rbp - 0x28]
test al, al
jne 0x140004ad1
mov r8, r12
nop word [rax + rax]
movzx ecx, byte [rbp + r8 - 0x27]
mov eax, WSAStartup
sub eax, ecx
imul ecx, eax, 0x23
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x27], cl
inc r8
cmp r8, 6
jb 0x140004a80
lea rdx, [rbp - 0x27]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov byte [rbp - 0x30], r12b
mov byte [rbp - 0x2f], 0x23
mov byte [rbp - 0x2e], 0x27
mov byte [rbp - 0x2d], 0x27
mov byte [rbp - 0x2c], 0x27
movzx eax, byte [rbp - 0x2f]
movzx eax, byte [rbp - 0x30]
test al, al
jne 0x140004b61
mov r8, r12
nop dword [rax]
movzx ecx, byte [rbp + r8 - 0x2f]
mov eax, 0x27
sub eax, ecx
imul ecx, eax, 0x17
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x2f], cl
inc r8
cmp r8, 4
jb 0x140004b10
lea rdx, [rbp - 0x2f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbx + 0x7d00]
mov qword [rcx], r12
mov rax, qword [r14 + 8]
mov qword [rbx + 0x7d08], rax
mov rax, qword [r14 + 8]
mov qword [rax], rbx
mov qword [r14 + 8], rcx
add rdi, 0x18
inc esi
cmp esi, dword [rbp - 0x18]
jbe 0x140004a10
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140006250
add rsp, 0x70
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret