Function at 0x4ec960
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x98
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], 1
mov esi, dword [eax]
mov eax, dword [eax + 8]
lea ecx, [esi + eax]
test eax, eax
mov dword [ebp - 0x24], ecx
je 0x4ec9d5
movzx ebx, byte [esi]
test bl, bl
js 0x4ec98f
inc esi
jmp 0x4ec9fa
movzx edx, byte [esi + 1]
mov eax, ebx
and eax, 0x1f
and edx, 0x3f
cmp bl, 0xdf
jbe 0x4ec9f0
movzx ecx, byte [esi + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp bl, 0xf0
jb 0x4ed1ad
movzx ebx, byte [esi + 3]
and eax, 7
shl ecx, 6
shl eax, 0x12
and ebx, 0x3f
or ebx, ecx
or ebx, eax
cmp ebx, 0x110000
jne 0x4ed1c4
xor esi, esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x54], 0
xor eax, eax
mov dword [ebp - 0x18], 0
jmp 0x4eca15
shl eax, 6
add esi, 2
or eax, edx
mov ebx, eax
mov cl, 1
mov dword [ebp - 0x18], ebx
mov eax, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x24]
mov edi, 3
add ecx, 3
mov dword [ebp - 0x20], ecx
sub ecx, esi
shr ecx, 2
test esi, esi
cmove ecx, esi
add ecx, eax
cmp ecx, 4
cmovae edi, ecx
cmp edi, 0x3fffffff
setb al
jae 0x4ed224
lea ebx, [edi + edi + 2]
test ebx, ebx
js 0x4ed224
mov byte [ebp - 0x31], al
mov eax, dword [0x56bbf8]
mov eax, dword [eax]
test eax, eax
jne 0x4eca73
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x4ed20e
mov ecx, dword [0x56bbf8]
mov dword [ecx], eax
push ebx
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x4ed20e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
inc edi
test esi, esi
mov word [eax], cx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
mov word [ebp - 0x48], ax
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], 0
je 0x4ecc8f
mov edi, 1
jmp 0x4ecaf1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov word [ecx + edi*2], ax
inc edi
mov dword [ebp - 0x28], edi
test esi, esi
lea eax, [ebp - 0x50]
cmovne esi, eax
je 0x4ecba9
cmp word [ebp - 0x10], 0
jne 0x4ecb30
mov ebx, dword [esi]
cmp ebx, dword [ebp - 0x24]
je 0x4ecba2
lea eax, [ebx + 1]
mov dword [esi], eax
movzx eax, byte [ebx]
test al, al
js 0x4ecb46
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
jne 0x4ecae0
jmp 0x4ecbd8
mov word [ebp - 0x48], 0
xor ebx, ebx
cmp edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
je 0x4ecbd8
jmp 0x4ecae0
lea ecx, [ebx + 2]
mov edx, eax
mov dword [esi], ecx
and edx, 0x1f
movzx ecx, byte [ebx + 1]
and ecx, 0x3f
cmp al, 0xdf
jbe 0x4ecc2c
mov dword [ebp - 0x18], edx
lea edx, [ebx + 3]
shl ecx, 6
mov dword [esi], edx
movzx edx, byte [ebx + 2]
and edx, 0x3f
or edx, ecx
cmp al, 0xf0
jb 0x4ecc46
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x18]
shl edx, 6
mov dword [esi], eax
movzx eax, byte [ebx + 3]
and ecx, 7
shl ecx, 0x12
and eax, 0x3f
or eax, edx
or eax, ecx
cmp eax, 0x110000
jne 0x4ecc50
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4ecd0b
lea eax, [ecx + 1]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x40], eax
movzx eax, word [ebp + ecx*2 - 0x38]
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
jne 0x4ecae0
test esi, esi
je 0x4ecbfd
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x40]
mov eax, 1
sub ecx, esi
sub eax, edx
mov dword [ebp - 0x14], edx
shr ecx, 2
add eax, ecx
mov ecx, 0xffffffff
cmovb eax, ecx
jmp 0x4ecc0f
mov ecx, dword [ebp - 0x40]
mov eax, 1
mov dword [ebp - 0x14], ecx
sub eax, ecx
mov ecx, 0xffffffff
inc eax
cmove eax, ecx
mov edx, edi
lea ecx, [ebp - 0x30]
push eax
call fcn.004ec750
add esp, 4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
jmp 0x4ecae0
shl edx, 6
xor ebx, ebx
or edx, ecx
mov eax, edx
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
jne 0x4ecae0
jmp 0x4ecbd8
mov eax, dword [ebp - 0x18]
shl eax, 0xc
or edx, eax
mov eax, edx
cmp eax, 0xffff
jbe 0x4ecb1d
add eax, 0xffff0000
mov ecx, eax
and eax, 0x3ff
shr ecx, 0xa
or eax, 0xdc00
or ecx, 0xd800
mov word [ebp - 0x48], ax
mov ebx, eax
mov dword [ebp - 0x10], ecx
cmp edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
jne 0x4ecae0
jmp 0x4ecbd8
cmp byte [ebp - 0x54], 0
mov ecx, dword [ebp - 0x14]
je 0x4ecd0b
mov ebx, ecx
lea edx, [ebp + ecx*2 - 0x38]
inc ecx
xor edi, edi
neg ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
jmp 0x4eccda
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
movzx ecx, word [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec ebx
mov word [eax + edi*2 + 2], cx
mov ecx, dword [ebp - 0x14]
lea eax, [edi + 2]
mov dword [ebp - 0x28], eax
lea eax, [ecx + edi + 1]
mov edi, esi
cmp eax, 2
je 0x4ecd0b
lea eax, [ecx + edi]
lea esi, [edi + 1]
mov dword [ebp - 0x40], eax
cmp esi, dword [ebp - 0x2c]
movzx ecx, word [edx + edi*2]
jne 0x4eccbd
mov eax, ebx
mov word [ebp - 0x10], cx
mov ecx, 0xffffffff
inc eax
cmove eax, ecx
mov edx, esi
lea ecx, [ebp - 0x30]
push eax
call fcn.004ec750
add esp, 4
jmp 0x4eccb0
movsd xmm0, qword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
movsd qword [ebp - 0x8c], xmm0
mov dword [ebp - 0x84], eax
mov esi, dword [ebp - 0x8c]
lea eax, [ebp - 0x94]
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x90]
lea edi, [ebp - 0x74]
push eax
push ecx
push edx
push 0xffffffffffffffff
push edi
push 0
push esi
call sub.netapi32.dll_NetShareEnum
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x74]
test eax, eax
mov dword [ebp - 0x98], eax
je 0x4ece9b
push ebx
call sub.netapi32.dll_NetApiBufferFree
test eax, eax
mov dword [ebp - 0x30], eax
jne 0x4ed247
lea eax, [ebp - 0x98]
mov dword [ebp - 0x50], 0x56ab30
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], 0x41b090
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
lea ebx, [ebp - 0x50]
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.004089e0
add esp, 8
mov eax, dword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x30]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x48], eax
mov eax, dword [0x56bbf8]
movsd qword [ebp - 0x64], xmm0
movsd qword [ebp - 0x50], xmm0
mov eax, dword [eax]
test eax, eax
jne 0x4ece08
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x4ed22b
mov ecx, dword [0x56bbf8]
mov dword [ecx], eax
push 0xc
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x4ed22b
mov ecx, dword [ebp - 0x5c]
mov dword [eax + 8], ecx
movsd xmm0, qword [ebp - 0x64]
movsd qword [eax], xmm0
mov byte [ebp - 0x48], 0x27
mov dword [ebp - 0x50], eax
mov eax, dword [0x56bbf8]
mov dword [ebp - 0x4c], 0x56aaa0
mov eax, dword [eax]
test eax, eax
jne 0x4ece57
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x4ed239
mov ecx, dword [0x56bbf8]
mov dword [ecx], eax
push 0xc
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x4ed239
mov ecx, dword [ebp - 0x48]
mov dword [eax + 8], ecx
movsd xmm0, qword [ebp - 0x50]
movsd qword [eax], xmm0
mov dword [edi + 8], eax
mov dword [edi + 4], 3
mov dword [edi], 0
cmp dword [ebp - 0x88], 0
je 0x4ed187
push esi
jmp 0x4ed179
mov esi, dword [ebp - 0x58]
xorps xmm0, xmm0
mov dword [ebp - 0x80], 4
mov dword [ebp - 0x14], ebx
movlps qword [ebp - 0x7c], xmm0
test esi, esi
je 0x4ecf14
lea ecx, [ebp - 0x80]
mov edx, esi
call fcn.004ec7f0
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
cmp esi, 2
lea eax, [edx + edx*2]
mov dword [ebp - 0x18], ecx
lea ecx, [ecx + eax*4]
jb 0x4ecef4
lea edi, [esi - 1]
xorps xmm0, xmm0
nop word [eax + eax]
mov dword [ecx], 2
movlps qword [ecx + 4], xmm0
add ecx, 0xc
dec edi
jne 0x4ecee0
lea edx, [esi + edx - 1]
inc edx
xorps xmm0, xmm0
mov dword [ecx], 2
movlps qword [ecx + 4], xmm0
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x78], edx
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4ecf2d
jmp 0x4ecfb2
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 4
mov eax, dword [ebx + 8]
test eax, eax
je 0x4ecfb2
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov edi, dword [ecx]
lea eax, [edi + eax*2]
mov dword [ebp - 0x10], eax
cmp edx, dword [ebp - 0x20]
jae 0x4ecf97
mov ecx, dword [ebp - 0x18]
lea eax, [edx + edx*2]
mov dword [ebp - 0x1c], edx
lea esi, [ecx + eax*4]
xor ecx, ecx
jmp 0x4ecf6a
mov eax, dword [esi]
add edi, 2
mov ecx, 1
mov word [eax + edx*2], bx
inc edx
cmp edi, dword [ebp - 0x10]
mov dword [esi + 8], edx
mov edx, dword [ebp - 0x1c]
je 0x4ecfb2
cmp edx, dword [ebp - 0x58]
je 0x4ecfb2
movzx ebx, word [edi]
test bx, bx
je 0x4ecf8b
mov edx, dword [esi + 8]
cmp edx, dword [esi + 4]
jne 0x4ecf50
mov ecx, esi
call fcn.004ec380
mov edx, dword [esi + 8]
jmp 0x4ecf50
add edi, 2
add edx, ecx
cmp edi, dword [ebp - 0x10]
jne 0x4ecf3a
jmp 0x4ecfb2
cmp edx, dword [ebp - 0x58]
je 0x4ecfb2
cmp word [edi], 0
jne 0x4ed26f
add edi, 2
xor ecx, ecx
add edx, ecx
cmp edi, dword [ebp - 0x10]
jne 0x4ecf3a
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x70], 4
movlps qword [ebp - 0x6c], xmm0
lea ecx, [edx + edx*2]
test edx, edx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], ecx
je 0x4ed0e6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
lea esi, [eax + 0xc]
jmp 0x4ed012
add edi, 0xc
add esi, 0xc
mov ebx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x24]
je 0x4ed130
mov edx, dword [esi - 0xc]
test edx, edx
je 0x4ed0e6
lea edi, [esi - 0xc]
mov ebx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ebx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x10], edx
push eax
call fcn.004ebfd0
add esp, 4
cmp dword [ebp - 0x5c], 0
je 0x4ed080
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
movsd xmm0, qword [ebp - 0x64]
cmp edx, dword [ebp - 0x6c]
mov dword [ebp - 0x28], eax
movsd qword [ebp - 0x30], xmm0
jne 0x4ed0a0
lea ecx, [ebp - 0x70]
call fcn.004ec600
mov ebx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
jmp 0x4ed0a3
cmp dword [ebp - 0x60], 0
je 0x4ed0c7
push dword [ebp - 0x64]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x4ed0c7
mov ebx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
lea eax, [edx + edx*2]
mov dword [ebp - 0x20], ebx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebx + eax*4 + 8], ecx
movsd qword [ebx + eax*4], xmm0
mov dword [ebp - 0x68], edx
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x10]
test ebx, ebx
je 0x4ed000
push eax
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x4ed000
mov edi, dword [ebp - 0x24]
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x48], esi
mov eax, edi
sub eax, esi
mul ecx
cmp edi, esi
je 0x4ed130
shr edx, 3
add esi, 4
shl edx, 2
lea edi, [edx + edx*2]
jmp 0x4ed118
add esi, 0xc
add edi, 0xfffffff4
je 0x4ed130
cmp dword [esi], 0
je 0x4ed110
push dword [esi - 4]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x4ed110
cmp dword [ebp - 0x4c], 0
je 0x4ed147
push dword [ebp - 0x18]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
push ebx
call sub.netapi32.dll_NetApiBufferFree
mov edi, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x30], eax
jne 0x4ed25b
mov eax, dword [ebp - 0x68]
movsd xmm0, qword [ebp - 0x70]
cmp dword [ebp - 0x88], 0
mov dword [edi + 8], eax
movsd qword [edi], xmm0
je 0x4ed187
push dword [ebp - 0x8c]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x4ed1a0
push dword [eax]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, edi
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
shl eax, 0xc
add esi, 3
or ecx, eax
mov ebx, ecx
cmp ebx, 0xffff
ja 0x4ed1d3
jmp 0x4ec9fa
add esi, 4
cmp ebx, 0xffff
jbe 0x4ec9fa
add ebx, 0xffff0000
mov dl, 1
mov eax, 1
mov dword [ebp - 0x14], 0
mov ecx, ebx
and ebx, 0x3ff
mov dword [ebp - 0x54], edx
or ebx, 0xdc00
shr ecx, 0xa
mov edx, ebx
or ecx, 0xd800
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
jmp 0x4eca15
movzx ecx, byte [ebp - 0x31]
xor eax, eax
mov al, cl
add eax, eax
push eax
push ebx
call fcn.004085f0
add esp, 8
jmp 0x4ed280
call fcn.004085b0
jmp 0x4ed280
push 4
push 0xc
call fcn.004085f0
add esp, 8
jmp 0x4ed280
push 4
push 0xc
call fcn.004085f0
add esp, 8
jmp 0x4ed280
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x50]
call fcn.004ebf70
jmp 0x4ed280
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x50]
call fcn.004ebf70
jmp 0x4ed280
push 0x56ab38
push dword [ebp - 0x20]
push edx
call fcn.00414b90
add esp, 0xc
ud2