Function at 0x4096e0
Capabilities:
Create thread
Enumerate network shares
Get disk size
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1174
call fcn.00430120
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1030]
mov byte [ebp - 0x115d], dl
push eax
push ecx
push 0x13
push 0
push 2
mov dword [ebp - 0x1010], 0xffffffff
mov dword [ebp - 0x1014], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x409c64
mov esi, dword [ebp - 0x1014]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1168], eax
test eax, eax
je 0x409c58
lea ecx, [ebp - 0x1014]
push ecx
push eax
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1030]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x409c4b
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x1010], 0
mov dword [ebp - 0x116c], 0
jbe 0x409c1d
mov ebx, dword [ebp - 0x1168]
add ebx, 0x14
test byte [ebx - 8], 2
je 0x4097be
mov dl, byte [ebp - 0x115d]
lea ecx, [ebx - 0x14]
call fcn.004096e0
jmp 0x409c01
push 0x104
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword [ebx]
cmp word [eax], 0x5c
jne 0x4097e7
lea ecx, [eax + 2]
push ecx
push 0x455f38
jmp 0x4097ed
push eax
push 0x455f50
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
push esi
call eax
add esp, 0xc
mov dword [ebp - 0x101c], 0
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x1018], 0
push eax
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x101c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x1018]
mul dword [ebp - 0x100c]
push 0
push dword [ebp - 0x101c]
push edx
push eax
call fcn.0042fd60
push 0
push 0x40000000
push edx
push eax
call fcn.00447b60
push edx
push eax
push str._d_GB
push dword [ebp - 0x1164]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
push 0x1004
push dword [0x47ea94]
call edi
mov dword [ebp - 0x1170], eax
mov dword [ebp - 0x1068], eax
lea eax, [ebp - 0x106c]
push eax
push 0
push 0x104d
push dword [0x47ea94]
mov dword [ebp - 0x106c], 1
mov dword [ebp - 0x1054], 0x80
mov dword [ebp - 0x1058], esi
mov dword [ebp - 0x1064], 0
call edi
cmp eax, 0xffffffff
je 0x409920
lea eax, [ebp - 0x10a8]
mov dword [ebp - 0x10a0], 0
push eax
push dword [ebp - 0x1170]
mov dword [ebp - 0x1094], esi
push 0x1074
push dword [0x47ea94]
call edi
cmp byte [ebp - 0x115d], 0
je 0x409945
mov dword [ebp - 0x10dc], 1
lea eax, [ebp - 0x10e4]
mov dword [ebp - 0x10d0], str.Network_Dir_Downgrade
jmp 0x40995f
mov dword [ebp - 0x1118], 1
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x110c], str.Network_Dir
push eax
push dword [0x4802b0]
push 0x1074
push dword [0x47ea94]
call edi
mov eax, dword [ebp - 0x1164]
mov dword [ebp - 0x1058], eax
lea eax, [ebp - 0x106c]
push eax
push dword [0x4802b0]
mov dword [ebp - 0x1064], 2
push 0x1074
push dword [0x47ea94]
call edi
lea eax, [ebp - 0x115c]
mov dword [ebp - 0x1154], 3
push eax
push dword [0x4802b0]
mov dword [ebp - 0x1148], 0x455fb0
push 0x1074
push dword [0x47ea94]
call edi
lea eax, [ebp - 0x106c]
mov dword [ebp - 0x1064], 4
push eax
push dword [0x4802b0]
mov dword [ebp - 0x1058], 0x455fb4
push 0x1074
push dword [0x47ea94]
call edi
mov eax, dword [ebp - 0x1164]
test eax, eax
je 0x409a19
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x20
call fcn.0042f609
mov edi, eax
mov ecx, esi
xorps xmm0, xmm0
add esp, 4
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea edx, [ecx + 2]
mov dword [edi + 0x14], 7
mov word [edi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409a43
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00403630
mov byte [edi + 0x18], 1
mov eax, dword [ebp - 0x100c]
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x1008]
mov byte [edi + 0x19], 0
push dword [ebp - 0x100c]
push esi
push str.Found_drive:__s__sector:__ld
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x463
push dword [0x4806e8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x4802b0]
lea eax, [eax*4 + 0x47feb0]
push eax
push 4
push edi
push fcn.004080f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [ebp - 0x115d], 0
mov ecx, dword [0x4802b0]
lea edi, [ecx*4 + 0x4802b8]
mov dword [edi], eax
je 0x409b6d
lea eax, [ebp - 0x102c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x409b6d
lea eax, [ebp - 0x1024]
push eax
push 4
lea eax, [ebp - 0x1028]
push eax
push 0x12
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x409b61
cmp dword [ebp - 0x1028], 2
jne 0x409b61
lea eax, [ebp - 0x1024]
push eax
push 4
lea eax, [ebp - 0x1028]
push eax
push 0x13
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x409b61
push dword [ebp - 0x1028]
push edi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
push dword [ebp - 0x1028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x102c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4802b0]
push dword [eax*4 + 0x4802b8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x104
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x47faac]
push esi
push 0x455ff8
push eax
mov dword [ecx*4 + 0x47fab0], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x4802b0]
add esp, 0xc
inc dword [0x47faac]
mov ecx, edx
shl ecx, 4
mov eax, dword [edx*4 + 0x47feb0]
inc edx
mov dword [0x4802b0], edx
mov dword [ecx + 0x47ea98], eax
mov dword [ecx + 0x47ea9c], 0
test esi, esi
je 0x409bf5
push esi
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
jmp 0x409bfb
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x116c]
add ebx, 0x20
inc eax
mov dword [ebp - 0x116c], eax
cmp eax, dword [ebp - 0x1010]
jb 0x4097a5
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x1168]
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1030]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x409785
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x1168]
push 0
call ebx
push eax
call esi
push dword [ebp - 0x1030]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f19a
mov esp, ebp
pop ebp
ret