Function at 0x406f70
Capabilities:
Create thread
Enumerate network shares
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459ca4
mov eax, dword fs:[0]
push eax
mov eax, 0x4050
call fcn.00409a60
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4018], edi
mov eax, dword [edi + 8]
mov dword [ebp - 0x4034], 0
mov dword [ebp - 0x404c], 2
mov dword [ebp - 0x4048], 0
mov dword [ebp - 0x4044], 1
mov dword [ebp - 0x4040], 2
mov dword [ebp - 0x403c], 0
test eax, eax
je 0x406ff7
mov eax, dword [eax]
mov dword [ebp - 0x4038], eax
jmp 0x407001
mov dword [ebp - 0x4038], 0
call fcn.00406ca0
mov dword [ebp - 0x4030], eax
lea eax, [ebp - 0x4024]
push eax
lea eax, [ebp - 0x404c]
mov dword [ebp - 0x4024], 0
push eax
push 2
push 1
push 2
call sub.MPR.dll_WNetOpenEnumW
cmp dword [0x4700b4], 0
jne 0x40726d
nop dword [eax]
lea eax, [ebp - 0x402c]
mov dword [ebp - 0x4020], 0xffffffff
push eax
lea eax, [ebp - 0x4010]
mov dword [ebp - 0x402c], 0x4000
push eax
lea eax, [ebp - 0x4020]
push eax
push dword [ebp - 0x4024]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, 0x103
je 0x40726d
cmp eax, 0xea
je 0x40708e
test eax, eax
jne 0x40726d
xor eax, eax
mov dword [ebp - 0x4014], eax
cmp dword [ebp - 0x4020], eax
jbe 0x407260
lea ebx, [ebp - 0x3ffc]
mov dword [ebp - 0x401c], ebx
nop
cmp dword [0x4700b4], 0
jne 0x40726d
cmp dword [ebx - 0xc], 2
jne 0x407244
push 0x10
call fcn.00409134
mov esi, eax
add esp, 4
mov dword [ebp - 0x4050], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4071c8
mov eax, dword [edi + 8]
test eax, eax
je 0x4070f3
mov ebx, dword [eax]
jmp 0x4070f5
xor ebx, ebx
mov eax, dword [ebp - 0x401c]
mov eax, dword [eax]
mov dword [ebp - 0x4028], eax
mov eax, dword [edi + 4]
push 0xc
mov byte [ebp - 4], 1
mov dword [esi], vtable.CEnumerateShares.0
mov dword [esi + 4], eax
call fcn.00409134
mov edi, eax
add esp, 4
mov dword [ebp - 0x4054], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x40715b
push dword [ebp - 0x4028]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x40715d
cmp dword [ebp - 0x4028], eax
jne 0x4072c9
jmp 0x40715d
xor edi, edi
mov byte [ebp - 4], 1
mov dword [esi + 8], edi
test edi, edi
je 0x4072c9
push 0xc
mov byte [ebp - 4], 3
call fcn.00409134
mov edi, eax
add esp, 4
mov dword [ebp - 0x4058], edi
mov byte [ebp - 4], 4
test edi, edi
je 0x4071af
push ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x4071b1
test ebx, ebx
jne 0x4072c9
jmp 0x4071b1
xor edi, edi
mov byte [ebp - 4], 3
mov dword [esi + 0xc], edi
test edi, edi
je 0x4072c9
mov ebx, dword [ebp - 0x401c]
jmp 0x4071ca
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lock inc dword [0x4702c4]
mov eax, dword [0x4702c8]
test eax, eax
je 0x4071e9
cmp dword [0x4702c4], eax
jge 0x407221
lea eax, [ebp - 0x405c]
push eax
push 4
push esi
push 0x407f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x407221
mov ecx, esi
call fcn.00406ef0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x407238
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
cmp eax, fcn.00407520
jne 0x407236
call fcn.00407520
jmp 0x407238
call eax
mov eax, dword [ebp - 0x4014]
mov edi, dword [ebp - 0x4018]
inc eax
add ebx, 0x20
mov dword [ebp - 0x4014], eax
mov dword [ebp - 0x401c], ebx
cmp eax, dword [ebp - 0x4020]
jb 0x4070b0
cmp dword [0x4700b4], 0
je 0x407040
push dword [ebp - 0x4024]
call sub.MPR.dll_WNetCloseEnum
or eax, 0xffffffff
lock xadd dword [0x4702c4], eax
jne 0x40729a
push 0
push 0
push 0x8000
push dword [0x4702cc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.00406ef0
test edi, edi
je 0x4072ad
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00408380
int3