Function at 0x14000a0f0
Capabilities:
Enumerate network shares
Query or enumerate registry value

Disassembly:
push r12
sub rsp, 0x90
xor r12d, r12d
mov dword [rsp + 0xb0], r12d
cmp word [rcx], r12w
jne 0x14000a120
lea rcx, str.No_share_name_specified._n_n
call fcn.14000adf8
add rsp, 0x90
pop r12
ret
movzx eax, word [rcx]
mov qword [rsp + 0x88], rbx
cmp ax, word [0x140028838]
jne 0x14000a382
movzx eax, word [rcx + 2]
cmp ax, word [0x14002883a]
jne 0x14000a382
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
nop word [rax + rax]
lea rax, [rsp + 0xb0]
lea r8, [rsp + 0x48]
or r9d, 0xffffffff
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, 0x1f6
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x14000a1d0
cmp eax, 0xea
je 0x14000a1d0
lea rcx, str.Error_enumerating_shares:_n
call fcn.14000adf8
mov ecx, r15d
call fcn.140005190
jmp 0x14000a347
mov r14d, r12d
cmp dword [rsp + 0xa8], r12d
jbe 0x14000a33d
mov rbx, qword [rsp + 0x48]
add rbx, 0x40
nop word [rax + rax]
mov eax, dword [rbx - 0x38]
mov rbp, qword [rbx - 0x40]
shr eax, 0x1f
test al, 1
je 0x14000a30e
lea rax, [rsp + 0x50]
lea rdx, str.SystemCurrentControlSetServicesLanmanserverDefaultSecurity
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0xa0], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14000a2ed
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
lea rdx, str.SrvsvcShareAdminConnect
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x14000a2de
mov ecx, eax
call fcn.14000ac7c
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xb8]
mov rsi, rax
lea rax, [rsp + 0xa0]
lea rdx, str.SrvsvcShareAdminConnect
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14000a2d6
mov rcx, rsi
call fcn.14000a550
lea rdx, [0x140045110]
xor r9d, r9d
mov r8, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r12
call fcn.140004240
mov rcx, rsi
call fcn.14000ac3c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14000a328
cmp byte [0x140058b13], r12b
jne 0x14000a328
lea rcx, str.__Error_getting_security_for__s:_n
mov rdx, rbp
call fcn.14000adf8
mov ecx, edi
call fcn.140005190
jmp 0x14000a328
mov r8, qword [rbx]
lea rdx, [0x140045110]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x20], r12
call fcn.140004240
inc r14d
add rbx, 0x48
cmp r14d, dword [rsp + 0xa8]
jb 0x14000a1f0
mov rcx, qword [rsp + 0x48]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x14000a170
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x90
pop r12
ret
mov rdx, rcx
lea r9, [rsp + 0x48]
mov r8d, 0x1f6
xor ecx, ecx
call sub.NETAPI32.dll_NetShareGetInfo
mov ebx, eax
test eax, eax
jne 0x14000a3c9
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rcx, qword [rcx]
call fcn.14000a3f0
mov rcx, qword [rsp + 0x48]
call sub.NETAPI32.dll_NetApiBufferFree
mov rbx, qword [rsp + 0x88]
add rsp, 0x90
pop r12
ret
lea rcx, str.Error_querying_share:_n
call fcn.14000adf8
mov ecx, ebx
call fcn.140005190
mov rbx, qword [rsp + 0x88]
add rsp, 0x90
pop r12
ret