Function at 0x140009de0
Capabilities:
Enumerate network shares

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov esi, r8d
mov rbp, rdx
mov r12, rcx
mov rax, qword [rdx]
cmp dword [rax - 0x10], 1
jl 0x14000a11f
cmp r8d, 1
je 0x140009e38
cmp r8d, 2
je 0x140009e38
cmp r8d, 3
je 0x140009e38
cmp r8d, 4
je 0x140009e38
cmp r8d, 5
jne 0x14000a11f
add rcx, 0x90
call fcn.140004410
mov dword [r12 + 0x98], esi
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [0x14004cc40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14004cc40]
lea rcx, [r12 + 0x80]
call fcn.140003420
mov rdx, qword [rbp]
mov eax, dword [rdx - 0x10]
cmp eax, 2
jl 0x14000a033
cmp esi, 1
jne 0x14000a033
cmp eax, esi
jge 0x140009ea2
mov ecx, 0x80070057
call fcn.140001000
int3
cmp word [rdx + 2], 0x3a
jne 0x14000a033
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov ecx, edx
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x14000a033
mov dword [rsp + 0x30], 1
mov dword [rsp + 0xa8], 0x4000
mov ecx, 0x4000
call fcn.14001ea40
mov rsi, rax
mov ecx, dword [rsp + 0xa8]
mov rdi, rax
xor eax, eax
rep stosb byte [rdi], al
lea r9, [rsp + 0xa8]
mov r8, rsi
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x14000a021
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140009760
nop
mov r8d, 2
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.1400030b0
nop
xor ecx, ecx
mov rdx, qword [rsp + 0x40]
test rdx, rdx
setne cl
test ecx, ecx
je 0x14000a016
mov rcx, qword [rax]
call fcn.140030510
test eax, eax
sete dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009f86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140009fb4
mov rdx, qword [rsi + 0x18]
test rdx, rdx
jne 0x140009f98
xor ecx, ecx
jmp 0x140009fa9
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, rbp
call fcn.140003420
mov dword [rsp + 0x30], 1
mov dword [rsp + 0xa8], 0x4000
mov rdi, rsi
xor eax, eax
mov ecx, 0x4000
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009ff2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r9, [rsp + 0xa8]
mov r8, rsi
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x140009f21
jmp 0x14000a021
mov ecx, 0x80004005
call fcn.140001000
nop
mov rcx, rsi
call fcn.14001ea48
mov rcx, qword [rsp + 0x38]
call sub.MPR.dll_WNetCloseEnum
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.1400030b0
xor edx, edx
lea rdi, [0x14004bcb0]
mov rsi, qword [rax]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000a061
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a086
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14000a0ff
mov rcx, qword [rbp]
cmp dword [rcx - 0x10], 2
jl 0x14000a0ff
add rcx, 4
lea rdx, [0x14004c074]
call fcn.1400305a4
test rax, rax
je 0x14000a0ff
sub rax, qword [rbp]
sar rax, 1
cmp eax, 0xffffffff
je 0x14000a0ff
lea r9d, [rax - 2]
mov r8d, 2
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.140002f30
nop
mov rdx, rax
lea rcx, [r12 + 0x80]
call fcn.140004410
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a0ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000a11b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14000a17a
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [0x14004cc40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14004cc40]
lea rcx, [r12 + 0x90]
call fcn.140003420
mov dword [r12 + 0x98], 0
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000a175
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 3
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret