Function at 0x5cd8ac1f
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x5cd942c4]
xor eax, esp
mov dword [esp + 0x458], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
test eax, eax
jne 0x5cd8ac53
mov eax, 0x80004003
jmp 0x5cd8afb9
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push edx
push 1
mov esi, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], ecx
mov ebx, ecx
mov edi, ecx
call dword [sym.imp.MPR.dll_WNetOpenEnumA]
test eax, eax
je 0x5cd8ac8e
jg 0x5cd8ac80
mov esi, eax
jmp 0x5cd8af70
movzx esi, ax
or esi, 0x80070000
jmp 0x5cd8af70
xor eax, eax
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 1
push 0xc
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
je 0x5cd8af70
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 0x4000
push eax
mov dword [esp + 0x18], eax
call fcn.5cd873b0
mov dword [esp + 0x14], eax
pop ecx
test eax, eax
jne 0x5cd8ace1
mov esi, 0x8007000e
jmp 0x5cd8af70
cmp byte [0x5cd94618], 0
lea ecx, [esp + 0x14]
mov edi, dword [esp + 0x14]
push ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 1
push eax
push dword [esp + 0x28]
je 0x5cd8ad0d
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
jmp 0x5cd8ad13
call dword [sym.imp.MPR.dll_WNetEnumResourceA]
mov esi, eax
cmp edi, dword [esp + 0x14]
jae 0x5cd8ad42
mov eax, dword [esp + 0x10]
push eax
call fcn.5cd873d9
push dword [esp + 0x18]
call fcn.5cd873b0
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
jne 0x5cd8ace1
mov esi, 0x8007000e
jmp 0x5cd8af6a
test esi, esi
jne 0x5cd8af32
mov eax, dword [esp + 0x20]
xor edi, edi
cmp dword [esp + 0xc], eax
jl 0x5cd8ad7c
add eax, 0x64
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov esi, eax
test esi, esi
js 0x5cd8af15
cmp byte [0x5cd94618], 0
mov ebx, edi
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0x10]
je 0x5cd8aded
test edx, edx
je 0x5cd8adc0
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5cd8ad99
sub ecx, edi
sar ecx, 1
push 0
pop edi
mov ebx, edi
je 0x5cd8adc0
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
test ebx, ebx
je 0x5cd8acd7
mov edx, dword [esi + 0x14]
test edx, edx
je 0x5cd8ae8c
mov ecx, edx
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x5cd8add2
sub ecx, esi
sar ecx, 1
je 0x5cd8ae8c
push edx
jmp 0x5cd8ae7c
test edx, edx
je 0x5cd8ae38
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5cd8adf6
push 0
sub ecx, edi
pop edi
mov ebx, edi
je 0x5cd8ae38
push 0x104
lea eax, [esp + 0x54]
push eax
push 0xffffffffffffffff
push edx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x5cd8af00
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
test ebx, ebx
je 0x5cd8acd7
mov edx, dword [esi + 0x14]
test edx, edx
je 0x5cd8ae8c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5cd8ae44
sub ecx, esi
push 0
pop ecx
mov edi, ecx
je 0x5cd8ae8c
push 0x104
lea eax, [esp + 0x25c]
push eax
push 0xffffffffffffffff
push edx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x5cd8af19
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
je 0x5cd8acd7
push 8
pop eax
mov word [esp + 0x30], ax
mov word [esp + 0x40], ax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x3c], ebx
push eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x50], edi
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov esi, eax
test esi, esi
js 0x5cd8af70
inc dword [esp + 0xc]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov esi, eax
test esi, esi
js 0x5cd8af70
inc dword [esp + 0xc]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x10]
jmp 0x5cd8ace1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x5cd8af15
movzx esi, si
or esi, 0x80070000
mov ebx, edi
jmp 0x5cd8af70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x5cd8af2e
movzx esi, si
or esi, 0x80070000
xor eax, eax
jmp 0x5cd8af6e
cmp esi, 0x103
je 0x5cd8af49
test esi, esi
jle 0x5cd8af6a
movzx esi, si
or esi, 0x80070000
jmp 0x5cd8af6a
xor eax, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov esi, eax
xor eax, eax
mov ebx, eax
mov edi, eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5cd8af8d
push eax
call fcn.5cd873d9
pop ecx
cmp dword [esp + 0x1c], 0
je 0x5cd8afb7
push dword [esp + 0x1c]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
test eax, eax
je 0x5cd8afb7
test esi, esi
js 0x5cd8afb7
test eax, eax
jg 0x5cd8afae
mov esi, eax
jmp 0x5cd8afb7
movzx esi, ax
or esi, 0x80070000
mov eax, esi
mov ecx, dword [esp + 0x464]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5cd87900
mov esp, ebp
pop ebp
ret 4