Function at 0x401cc0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov esi, r8d
mov r13, rdx
mov r12, rcx
mov rdx, qword [rdx]
mov r8d, dword [rdx - 0x10]
cmp r8d, 1
jl 0x4020b6
cmp esi, 1
je 0x401d2b
cmp esi, 2
je 0x401d2b
cmp esi, 3
je 0x401d2b
cmp esi, 4
je 0x401d2b
cmp esi, 5
jne 0x4020b6
lea rcx, [rdx - 0x18]
mov rdi, qword [r12 + 0x90]
sub rdi, 0x18
mov rbx, 0xffffffffffffffff
cmp rcx, rdi
je 0x401d91
cmp dword [rdi + 0x10], 0
jl 0x401d84
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x401d84
call fcn.00417a50
mov r14, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x401d76
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [r14 + 0x18]
mov qword [r12 + 0x90], rax
jmp 0x401d91
lea rcx, [r12 + 0x90]
call fcn.00417880
mov dword [r12 + 0x98], esi
xor eax, eax
mov rcx, rbx
lea rdi, [0x004586ec]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x004586ec]
lea rcx, [r12 + 0x80]
call fcn.00417880
mov rdx, qword [r13]
mov eax, dword [rdx - 0x10]
cmp eax, 2
jl 0x401fc7
cmp esi, 1
jne 0x401fc7
cmp eax, esi
jge 0x401deb
mov ecx, 0x80070057
call entry0
int3
cmp word [rdx + 2], 0x3a
jne 0x401fc7
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov ecx, edx
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x401fc7
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x4000
mov ecx, 0x4000
call fcn.00426cac
mov rbp, rax
mov ecx, dword [rsp + 0x30]
mov rdi, rax
xor eax, eax
rep stosb byte [rdi], al
lea r9, [rsp + 0x30]
mov r8, rbp
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x401fbf
mov rsi, qword [rbp + 0x10]
call fcn.00426d94
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x401fb4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
test rsi, rsi
je 0x401ecf
test rsi, 0xffffffffffff0000
jne 0x401ebb
movzx edi, si
mov ecx, edi
call fcn.00426d80
test rax, rax
je 0x401ee2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.00417570
jmp 0x401ee2
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x401ed1
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.00417880
nop
mov r8d, 2
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.00416d80
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.00436d50
test eax, eax
sete dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x401f28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x401f57
mov rdx, qword [rbp + 0x18]
test rdx, rdx
jne 0x401f3a
xor ecx, ecx
jmp 0x401f4c
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rcx, r13
call fcn.00417880
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x4000
mov rdi, rbp
xor eax, eax
mov ecx, 0x4000
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x401f93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r9, [rsp + 0x30]
mov r8, rbp
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x401e61
jmp 0x401fbf
mov ecx, 0x80004005
call entry0
int3
mov rcx, rbp
call fcn.00426ca4
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.00416d80
xor edx, edx
lea rdi, [0x004586f0]
mov rsi, qword [rax]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x401ff5
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40201b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x402095
mov rcx, qword [r13]
cmp dword [rcx - 0x10], 2
jl 0x402095
add rcx, 4
lea rdx, [0x004586f8]
call fcn.00437ec0
test rax, rax
je 0x402095
sub rax, qword [r13]
sar rax, 1
cmp eax, 0xffffffff
je 0x402095
lea r9d, [rax - 2]
mov r8d, 2
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.00416a20
nop
mov rdx, rax
lea rcx, [r12 + 0x80]
call fcn.00417730
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x402095
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4020b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x402115
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [0x004586ec]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x004586ec]
lea rcx, [r12 + 0x90]
call fcn.00417880
mov dword [r12 + 0x98], 0
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x402110
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 3
mov rbx, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
add rsp, 0xa8
ret