Function at 0x47ac60
Capabilities:
Enumerate network shares
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov rbp, rdx
mov r13, rcx
xor esi, esi
mov r15b, sil
xor edx, edx
lea r8d, [rsi + 0x30]
lea rcx, [rsp + 0x58]
call fcn.006aba40
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], 4
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x80]
mov r9, qword [rcx + 0xa0]
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, dword [r13 + 0x1b8]
call sub.MPR.dll_WNetOpenEnumW
cmp eax, esi
je 0x47ad0c
xor al, al
jmp 0x47b389
mov dword [rsp + 0x178], 0x4000
mov bl, 1
mov dil, sil
mov r12, rsi
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0x40], esi
cmp dil, sil
jne 0x47ada4
mov ecx, dword [rsp + 0x178]
call fcn.006a43c4
mov r12, rax
mov qword [rsp + 0xa8], rax
or dword [rsp + 0x40], 0xffffffff
lea r9, [rsp + 0x178]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, 0xea
jne 0x47ad8a
mov rcx, r12
call fcn.006a5088
mov edx, dword [rsp + 0x178]
add edx, edx
mov dword [rsp + 0x178], edx
jmp 0x47ad96
cmp eax, esi
jne 0x47ad93
mov dil, 1
jmp 0x47ad96
mov bl, sil
cmp bl, sil
jne 0x47ad2b
cmp dil, sil
je 0x47b371
mov r14d, esi
cmp dword [rsp + 0x40], esi
jbe 0x47b371
mov byte [rsp + 0x160], 1
lea rsi, [r12 + 0x20]
or rbx, 0xffffffffffffffff
xor r15d, r15d
lea r12d, [rbx + 0x5d]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov word [rsp + 0x50], r15w
mov rdx, qword [rsi - 8]
cmp rdx, r15
je 0x47ae11
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rdx + rcx*2 - 2]
lea rcx, [rsp + 0x50]
call fcn.00406d38
jmp 0x47ae31
mov rdx, qword [rsi]
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rdx + rcx*2 - 2]
lea rcx, [rsp + 0x50]
call fcn.00406d38
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
sub rax, rcx
sar rax, 1
je 0x47aeeb
cmp word [rcx], r12w
jne 0x47aeeb
mov r9, rbx
mov r8d, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.00421328
nop
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x47ae90
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x50]
call fcn.00406d38
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x47aee3
cmp rcx, r15
je 0x47aee3
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x47aed4
call fcn.006a4944
mov rcx, qword [rsp + 0x98]
jmp 0x47aeeb
call fcn.006a3610
mov rcx, qword [rsp + 0x98]
jmp 0x47aeeb
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
sub rax, rcx
sar rax, 1
je 0x47af7f
cmp word [rcx], r12w
jne 0x47af7f
mov r9, rbx
mov r8d, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.00421328
nop
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x47af3e
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x50]
call fcn.00406d38
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x47af7f
cmp rcx, r15
je 0x47af7f
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x47af7a
call fcn.006a4944
jmp 0x47af7f
call fcn.006a3610
mov ecx, 0xb0
call fcn.006a494c
mov rbx, rax
cmp rax, r15
je 0x47afc5
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], r15w
lea rax, [rbx + 0x50]
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], r15w
mov qword [rbx + 0xa0], r15
mov byte [rbx + 0xa8], r15b
jmp 0x47afc8
mov rbx, r15
mov edi, gethostbyname
mov rcx, rdi
call fcn.006a494c
mov qword [rbx + 0xa0], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.006aba40
mov rcx, qword [rbx + 0xa0]
lea rdx, [rsi - 0x20]
mov r8, rdi
call fcn.006a4bf0
mov rcx, qword [rsi - 0x10]
cmp rcx, r15
je 0x47b018
call fcn.006a63a4
mov rdx, rax
mov rax, qword [rbx + 0xa0]
mov qword [rax + 0x10], rdx
mov rcx, qword [rsi - 8]
cmp rcx, r15
je 0x47b034
call fcn.006a63a4
mov rdx, rax
mov rax, qword [rbx + 0xa0]
mov qword [rax + 0x18], rdx
mov rcx, qword [rsi]
cmp rcx, r15
je 0x47b04f
call fcn.006a63a4
mov rdx, rax
mov rax, qword [rbx + 0xa0]
mov qword [rax + 0x20], rdx
mov rcx, qword [rsi + 8]
cmp rcx, r15
je 0x47b06b
call fcn.006a63a4
mov rdx, rax
mov rax, qword [rbx + 0xa0]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsi - 8]
cmp rdx, r15
je 0x47b092
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rdx + rcx*2 - 2]
mov rcx, rbx
call fcn.00406d38
jmp 0x47b0b4
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x47b0b4
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, rbx
call fcn.00406d38
lea rdi, [rbx + 0x50]
lea rax, [rsp + 0x50]
cmp rax, rdi
je 0x47b0da
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, rdi
call fcn.00406d38
mov byte [rbx + 0xa8], 1
cmp dword [rsi - 0x18], 3
jne 0x47b1ae
mov edx, r12d
xor r8d, r8d
mov rcx, rdi
call fcn.00421278
cmp eax, r15d
jl 0x47b16f
inc eax
movsxd r8, eax
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.00421328
nop
cmp rax, rdi
je 0x47b12e
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
mov rcx, rdi
call fcn.00406d38
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x47b16f
cmp rcx, r15
je 0x47b16f
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x47b16a
call fcn.006a4944
jmp 0x47b16f
call fcn.006a3610
mov rdx, rbx
mov rcx, r13
call fcn.00478d80
mov edi, eax
mov rdx, rbx
mov rcx, r13
call fcn.00478c94
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9b, byte [r13 + 0x13e]
mov r8, rbx
mov rdx, rbp
mov rcx, r13
call fcn.00478e6c
jmp 0x47b30e
cmp dword [rsi - 0x18], 2
jne 0x47b27c
lea r8, [rsp + 0x170]
lea rdx, [0x00799038]
lea rcx, [rsp + 0xb0]
call fcn.004023b4
nop
mov r8, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
lea rcx, [rsp + 0xb0]
call fcn.00406b9c
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.00478d80
mov edi, eax
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.00478c94
mov byte [rsp + 0x30], r15b
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
mov rcx, r13
call fcn.00478e6c
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x47b30e
cmp rcx, r15
je 0x47b30e
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x47b272
call fcn.006a4944
jmp 0x47b30e
call fcn.006a3610
jmp 0x47b30e
mov eax, 0xffff
mov ebp, eax
mov edi, eax
lea r8, [rsp + 0x48]
mov edx, reloc.WS2_32.dll_select
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, r15d
jl 0x47b2e7
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
lea rcx, [r13 + 0x200]
call fcn.004a5890
mov ebp, eax
mov r8b, 1
mov rdx, qword [rsp + 0x48]
lea rcx, [r13 + 0x200]
call fcn.004a5890
mov edi, eax
mov rcx, qword [r13 + 0x1a8]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x28]
mov rcx, qword [r13 + 0x1a8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov byte [rsp + 0x30], r15b
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rbx
mov rbp, qword [rsp + 0x168]
mov rdx, rbp
mov rcx, r13
call fcn.00478e6c
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x47b348
cmp rcx, r15
je 0x47b348
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x47b343
call fcn.006a4944
jmp 0x47b348
call fcn.006a3610
inc r14d
add rsi, 0x30
cmp r14d, dword [rsp + 0x40]
mov rbx, 0xffffffffffffffff
jb 0x47adc9
mov r12, qword [rsp + 0xa8]
mov r15b, byte [rsp + 0x160]
mov rcx, qword [rsp + 0xa0]
call sub.MPR.dll_WNetCloseEnum
mov rcx, r12
call fcn.006a5088
mov al, r15b
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret