Function at 0x4ddeb8
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x56c], edx
mov dword [ebp - 0x568], edx
mov dword [ebp - 0x560], edx
mov dword [ebp - 0x564], edx
mov dword [ebp - 0x558], edx
mov dword [ebp - 0x55c], edx
mov dword [ebp - 0x554], edx
mov dword [ebp - 0x550], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4de2fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54c]
xor ecx, ecx
mov edx, 0x24
call fcn.004030bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0x54c], eax
push 0x4de310
mov eax, dword [ebp - 4]
push dword [eax + 0x60]
push 0x4de31c
lea eax, [ebp - 0x550]
mov edx, 3
call fcn.00404ce0
mov eax, dword [ebp - 0x550]
lea edx, [ebp - 0x220]
mov ecx, 0x81
call fcn.00405940
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x53c], 3
mov dword [ebp - 0x534], 0xffff
mov eax, dword [0x4ea2d0]
mov al, byte [eax]
sub al, 1
jb 0x4ddf95
je 0x4ddfb2
dec al
je 0x4ddffc
jmp 0x4de053
xor eax, eax
mov dword [ebp - 0x52c], eax
xor eax, eax
mov dword [ebp - 0x530], eax
xor eax, eax
mov dword [ebp - 0x530], eax
jmp 0x4de053
lea edx, [ebp - 0x526]
mov ecx, 0x81
xor eax, eax
call fcn.00405940
mov dword [ebp - 0x52c], eax
lea edx, [ebp - 0x322]
mov ecx, 0x81
xor eax, eax
call fcn.00405940
mov dword [ebp - 0x530], eax
lea edx, [ebp - 0x424]
mov ecx, 0x81
xor eax, eax
call fcn.00405940
mov dword [ebp - 0x544], eax
jmp 0x4de053
lea edx, [ebp - 0x526]
mov eax, dword [0x4e9eac]
mov eax, dword [eax]
mov ecx, 0x81
call fcn.00405940
mov dword [ebp - 0x52c], eax
lea edx, [ebp - 0x322]
mov eax, dword [0x4ea34c]
mov eax, dword [eax]
mov ecx, 0x81
call fcn.00405940
mov dword [ebp - 0x530], eax
lea edx, [ebp - 0x424]
mov eax, dword [0x4ea560]
mov eax, dword [eax]
mov ecx, 0x81
call fcn.00405940
mov dword [ebp - 0x544], eax
push 0
lea eax, [ebp - 0x54c]
push eax
push 2
push 0
call sub.netapi32.dll_NetUseAdd
mov edi, eax
test edi, edi
jne 0x4de2d4
xor edx, edx
push ebp
push 0x4de2cd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x11e]
xor ecx, ecx
mov edx, 0x102
call fcn.004030bc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x60]
lea eax, [ebp - 0x554]
mov edx, 0x4de310
call fcn.00404c6c
mov eax, dword [ebp - 0x554]
lea edx, [ebp - 0x11e]
mov ecx, 0x81
call fcn.00405940
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x11e]
push eax
call sub.netapi32.dll_NetShareEnum
mov edi, eax
cmp dword [ebp - 8], 0
je 0x4de2af
test edi, edi
je 0x4de10b
cmp edi, 0xea
jne 0x4de2a3
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jb 0x4de29a
inc esi
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
lea ebx, [edx + eax*4]
lea edx, [ebp - 0x1c]
mov eax, dword [ebx]
call fcn.00405924
mov ebx, dword [ebx + 4]
lea edx, [ebp - 0x558]
mov eax, dword [ebp - 0x1c]
call fcn.00408d34
mov eax, dword [ebp - 0x558]
push eax
lea edx, [ebp - 0x55c]
mov eax, 0x4de32c
call fcn.00408d34
mov edx, dword [ebp - 0x55c]
pop eax
call fcn.00404d6c
jne 0x4de170
mov ebx, 1
lea edx, [ebp - 0x560]
mov eax, dword [ebp - 0x1c]
call fcn.00408d34
mov eax, dword [ebp - 0x560]
push eax
lea edx, [ebp - 0x564]
mov eax, 0x4de33c
call fcn.00408d34
mov edx, dword [ebp - 0x564]
pop eax
call fcn.00404d6c
jne 0x4de1a8
mov ebx, 1
mov eax, dword [ebp - 0x1c]
mov edx, 0x4de32c
call fcn.00404d6c
jne 0x4de1bc
mov ebx, 1
test ebx, ebx
je 0x4de1da
cmp ebx, 0x80000000
jne 0x4de290
mov eax, dword [0x4e9cbc]
cmp byte [eax], 0
je 0x4de290
mov eax, dword [0x4ea334]
cmp byte [eax], 0
je 0x4de261
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004de348
mov ebx, eax
mov al, 1
mov edx, dword [0x4ea2b0]
cmp byte [edx], 0
je 0x4de22f
mov edx, dword [0x4e9cd4]
mov dl, byte [edx]
sub dl, 1
jb 0x4de213
je 0x4de217
dec dl
je 0x4de229
jmp 0x4de22f
mov al, 1
jmp 0x4de22f
cmp ebx, 6
je 0x4de225
cmp ebx, 3
je 0x4de225
xor eax, eax
jmp 0x4de22f
mov al, 1
jmp 0x4de22f
cmp ebx, 6
sete al
test al, al
je 0x4de290
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x568]
mov eax, ebx
call fcn.004091e0
mov edx, dword [ebp - 0x568]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4de290
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x56c]
mov eax, 3
call fcn.004091e0
mov edx, dword [ebp - 0x56c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x14]
dec esi
jne 0x4de11f
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_NetApiBufferFree
cmp edi, 0xea
je 0x4de0ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de2d4
push 2
lea eax, [ebp - 0x220]
push eax
push 0
call sub.netapi32.dll_NetUseDel
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de301
lea eax, [ebp - 0x56c]
mov edx, 8
call fcn.00404984
lea eax, [ebp - 0x1c]
call fcn.00404960
ret