Function at 0x4e3850
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x655e83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x4c]
push ecx
push edi
mov eax, 2
push edi
push eax
mov dword [ebp - 0x10], 0x4000
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call sub.MPR.dll_WNetOpenEnumW
cmp eax, edi
jne 0x4e3aa7
mov edx, dword [ebp - 0x10]
push ebx
push esi
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 0x28], esi
mov edi, edi
mov eax, dword [ebp - 0x10]
push eax
push edi
push esi
call fcn.006100a0
mov eax, dword [ebp - 0x24]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push esi
lea edx, [ebp - 0x18]
push edx
push eax
call sub.MPR.dll_WNetEnumResourceW
cmp eax, edi
jne 0x4e3a95
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x18], edi
jbe 0x4e38d0
add esi, 0x14
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx]
push 0xc
add edi, 4
call fcn.00611c8b
mov esi, eax
add esp, 4
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 4], eax
cmp esi, eax
je 0x4e394b
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
jne 0x4e394d
test edi, edi
je 0x4e394d
push 0x8007000e
call fcn.0060f000
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], esi
test esi, esi
je 0x4e3941
mov dword [ebp - 4], 1
mov eax, dword [ebx + 4]
lea edx, [ebp + 8]
cmp edx, eax
jae 0x4e39cd
mov edx, dword [ebx]
lea ecx, [ebp + 8]
cmp edx, ecx
ja 0x4e39cd
mov edi, ecx
mov ecx, dword [ebx + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x4e39c6
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4e3a8b
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4e39c6
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4e39b3
xor ecx, ecx
jmp 0x4e39b5
add ecx, edx
cmp ecx, eax
jae 0x4e39bb
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.004e34c0
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebx]
lea eax, [edx + edi*4]
jmp 0x4e3a16
mov ecx, dword [ebx + 8]
cmp eax, ecx
jne 0x4e3a13
mov edx, dword [ebx]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4e3a8b
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4e3a13
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x4e3a03
xor ecx, ecx
jmp 0x4e3a05
add ecx, edx
cmp ecx, eax
jae 0x4e3a0b
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.004e34c0
lea eax, [ebp + 8]
mov ecx, dword [ebx + 4]
push eax
push ecx
lea edx, [ebx + 0xc]
push edx
call fcn.004dd920
add dword [ebx + 4], 4
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4e3a66
mov eax, dword [esi]
test eax, eax
je 0x4e3a4d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x4e3a5d
push eax
call fcn.00611a0b
add esp, 4
push esi
call fcn.0060faf6
add esp, 4
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], 0x20
inc eax
mov dword [ebp + 8], 0
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x18]
jb 0x4e3906
mov esi, dword [ebp - 0x28]
xor edi, edi
jmp 0x4e38d0
push str.vector_T__too_long
call fcn.005fb5fb
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x24]
push ecx
call sub.MPR.dll_WNetCloseEnum
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret