Function at 0x410bd0
Capabilities:
Enumerate network shares
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cabd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x4000
push eax
push ecx
push 0
push 0
push 2
mov esi, edx
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
je 0x410c33
xor eax, eax
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [esp + 0x24], ebx
push dword [esp + 0x10]
push 0
push ebx
call fcn.0042b420
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x410ea3
mov dword [esp + 0x20], eax
cmp dword [esp + 0x14], eax
jbe 0x410c45
add ebx, 0x10
mov dword [esp + 0x1c], ebx
xor eax, eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], eax
mov word [esp + 0x58], ax
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], eax
mov word [esp + 0x70], ax
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], eax
mov word [esp + 0x88], ax
mov dword [esp + 0xac], eax
mov eax, dword [ebx - 0x10]
mov edx, dword [ebx]
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 0xc]
mov dword [esp + 0x34], eax
mov eax, dword [ebx - 8]
mov dword [esp + 0x38], eax
mov eax, dword [ebx - 4]
mov dword [esp + 0x3c], eax
test edx, edx
je 0x410d2d
cmp word [edx], 0
jne 0x410d0e
xor ecx, ecx
jmp 0x410d22
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410d13
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x48]
call fcn.00415c10
mov edx, dword [ebx + 4]
test edx, edx
je 0x410d5d
cmp word [edx], 0
jne 0x410d3e
xor ecx, ecx
jmp 0x410d52
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410d43
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x60]
call fcn.00415c10
mov edx, dword [ebx + 8]
test edx, edx
je 0x410d8d
cmp word [edx], 0
jne 0x410d6e
xor ecx, ecx
jmp 0x410d82
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410d73
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x78]
call fcn.00415c10
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x410dc0
cmp word [edx], 0
jne 0x410d9e
xor eax, eax
jmp 0x410db2
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410da3
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x90]
call fcn.00415c10
mov edi, dword [esi + 4]
lea eax, [esp + 0x30]
cmp eax, edi
jae 0x410e1f
mov eax, dword [esi]
lea ecx, [esp + 0x30]
cmp eax, ecx
ja 0x410e1f
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp edi, dword [esi + 8]
jne 0x410df7
push ecx
mov ecx, esi
call fcn.004150c0
mov ecx, dword [esi + 4]
imul eax, ebx, 0x70
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
add eax, dword [esi]
mov byte [esp + 0xac], 1
test ecx, ecx
je 0x410e19
push eax
call fcn.00418fd0
mov ebx, dword [esp + 0x1c]
jmp 0x410e4d
cmp edi, dword [esi + 8]
jne 0x410e2c
push ecx
mov ecx, esi
call fcn.004150c0
mov ecx, dword [esi + 4]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov byte [esp + 0xac], 2
test ecx, ecx
je 0x410e4d
lea eax, [esp + 0x30]
push eax
call fcn.00418fd0
mov byte [esp + 0xac], 0
add dword [esi + 4], 0x70
test dword [ebx - 4], 2
je 0x410e6c
mov edx, esi
lea ecx, [ebx - 0x10]
call fcn.00410bd0
lea ecx, [esp + 0x30]
mov dword [esp + 0xac], 0xffffffff
call fcn.00410f20
mov ecx, dword [esp + 0x20]
add ebx, 0x20
inc ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
cmp ecx, dword [esp + 0x14]
jb 0x410c82
mov ebx, dword [esp + 0x24]
jmp 0x410c45
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [esp + 0xa4]
neg eax
pop edi
sbb eax, eax
mov dword fs:[0], ecx
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret