Function at 0x469f00
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x590
mov eax, dword [0x4cacfc]
xor eax, esp
mov dword [esp + 0x58c], eax
push ebx
xor ebx, ebx
push ebp
push esi
mov eax, 0x104
mov esi, ecx
mov ebp, 1
push 0x4a604c
mov dword [esp + 0x40], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
call fcn.00470070
mov eax, dword [esi + 0xb40]
lea ecx, [eax + 0x550]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
add esp, 4
call edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x3c]
push eax
push 0x1f6
push ebx
call sub.NETAPI32.dll_NetShareEnum
test eax, eax
jne 0x46a3c4
mov dword [esp + 0x24], ebp
cmp dword [esp + 0x14], ebp
jb 0x46a3ba
push edi
mov edi, dword [esp + 0x30]
add edi, 0x24
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je 0x46a0a8
lea edx, [esp + 0x44]
push edx
mov edx, dword [edi]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x46a0a8
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor esi, esi
cmp cx, word [eax + 4]
jae 0x46a0a8
nop
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x46a096
push 0x208
lea eax, [esp + 0x190]
push ebx
push eax
call fcn.00487630
push 0x208
lea ecx, [esp + 0x3a4]
push ebx
push ecx
call fcn.00487630
add esp, 0x18
mov eax, 0x104
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x39c]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x19c]
push eax
add ecx, 8
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x46a096
lea edx, [esp + 0x18c]
push edx
push 0x4a605c
call fcn.00487536
add esp, 8
test eax, eax
je 0x46a0e0
mov eax, dword [esp + 0x20]
movzx ecx, word [eax + 4]
add esi, ebp
cmp esi, ecx
jl 0x46a000
mov esi, dword [esp + 0x14]
push 0x40
lea eax, [esp + 0xd0]
push ebx
push eax
call fcn.00487630
mov al, byte [esp + 0x1f]
add esp, 0xc
cmp al, bl
jne 0x46a12c
cmp esi, 0x1f01ff
jne 0x46a0f3
push 0x4a6070
push 0x20
lea ecx, [esp + 0xd4]
push ecx
jmp 0x46a13f
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 4]
mov dword [esp + 0x14], esi
mov dl, byte [eax]
mov byte [esp + 0x13], dl
jmp 0x46a0ac
cmp esi, 0x1301bf
jne 0x46a102
push 0x4a607c
jmp 0x46a135
cmp esi, 0x1201bf
jne 0x46a11b
push 0x4a6084
push 0x20
lea eax, [esp + 0xd4]
push eax
jmp 0x46a13f
push 0x4a608c
push 0x20
lea ecx, [esp + 0xd4]
push ecx
jmp 0x46a13f
cmp al, 1
jne 0x46a147
push 0x4a6090
push 0x20
lea edx, [esp + 0xd4]
push edx
call fcn.004679c0
add esp, 0xc
push 0x40
lea eax, [esp + 0x50]
push ebx
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1f], bl
call fcn.00487630
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x1f]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x4a609c
push eax
call fcn.00479b20
add esp, 0x1c
test eax, eax
je 0x46a22d
cmp byte [esp + 0x13], bl
jne 0x46a21f
mov eax, dword [esp + 0x14]
cmp eax, 0x1f01ff
jne 0x46a19e
push 0x4a60b0
jmp 0x46a232
cmp eax, 0x1301bf
jne 0x46a1b6
push 0x4a60bc
push 0x20
lea edx, [esp + 0x54]
push edx
jmp 0x46a239
cmp eax, 0x1201bf
jne 0x46a1cb
push 0x4a60c4
push 0x20
lea eax, [esp + 0x54]
push eax
jmp 0x46a239
cmp eax, 0x1200a9
jne 0x46a1d9
push 0x4a60cc
jmp 0x46a232
cmp eax, 0x12019f
jne 0x46a1ee
push 0x4a60d4
push 0x20
lea edx, [esp + 0x54]
push edx
jmp 0x46a239
cmp eax, 0x120089
jne 0x46a203
push 0x4a60e4
push 0x20
lea eax, [esp + 0x54]
push eax
jmp 0x46a239
cmp eax, 0x100116
jne 0x46a211
push 0x4a60ec
jmp 0x46a232
push 0x4a60f4
push 0x20
lea edx, [esp + 0x54]
push edx
jmp 0x46a239
push 0x4a6100
push 0x20
lea eax, [esp + 0x54]
push eax
jmp 0x46a239
push 0x4a610c
push 0x20
lea ecx, [esp + 0x54]
push ecx
call fcn.004679c0
add esp, 0xc
push 0x40
lea edx, [esp + 0x90]
push ebx
push edx
call fcn.00487630
mov eax, dword [edi - 0x20]
add esp, 0xc
cmp eax, 0x40000000
ja 0x46a2ad
je 0x46a2a6
cmp eax, 3
ja case.default.0x46a265
jmp dword [eax*4 + 0x46a3dc]
push 0x4a6110
push 0x40
lea eax, [esp + 0x94]
push eax
jmp 0x46a2ec
push 0x4a611c
jmp 0x46a2e2
push 0x4a6128
push 0x40
lea edx, [esp + 0x94]
push edx
jmp 0x46a2ec
push 0x4a6134
push 0x40
lea eax, [esp + 0x94]
push eax
jmp 0x46a2ec
push 0x4a614c
jmp 0x46a2e2
cmp eax, 0x80000000
je 0x46a2dd
cmp eax, reloc.WS2_32.dll_closesocket
je 0x46a2cc
push 0x4a6170
push 0x40
lea edx, [esp + 0x94]
push edx
jmp 0x46a2ec
push 0x4a6164
push 0x40
lea eax, [esp + 0x94]
push eax
jmp 0x46a2ec
push 0x4a6158
push 0x40
lea ecx, [esp + 0x94]
push ecx
call fcn.004679c0
add esp, 0xc
push 0x40
lea edx, [esp + 0x150]
push ebx
push edx
call fcn.00487630
mov eax, dword [edi - 0x10]
push eax
push 0x4a617c
lea ecx, [esp + 0x160]
push 0x40
push ecx
call fcn.004679c0
push 0x40
lea edx, [esp + 0x12c]
push ebx
push edx
call fcn.00487630
mov eax, dword [edi - 0x14]
add esp, 0x28
cmp eax, 0xffffffff
jne 0x46a350
push 0x4a6184
lea eax, [esp + 0x110]
push 0x40
push eax
call fcn.004679c0
add esp, 0xc
jmp 0x46a368
push eax
push 0x4a618c
lea ecx, [esp + 0x114]
push 0x40
push ecx
call fcn.004679c0
add esp, 0x10
mov edx, dword [edi - 0x1c]
push edx
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x98]
push edx
mov edx, dword [edi - 0xc]
lea eax, [esp + 0x5c]
push eax
mov eax, dword [edi - 0x24]
lea ecx, [esp + 0xe0]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
call fcn.00466b60
mov eax, dword [esp + 0x28]
add eax, ebp
add edi, 0x28
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x18]
jbe 0x469fb4
pop edi
mov ecx, dword [esp + 0x2c]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 0x598]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00486dc0
add esp, 0x590
ret