On Detection, Information Security, Research, Detection Engineering.
netapi32!NetSessionEnum the call is transparently forwarded to srvcli!NetSessionEnum, so in order to continue our exploration of the function call stack we will need to load srvcli.dll into our disassembler next. srvcli!NetSessionEnum Upon decompiling srvcli!NetSessionEnum, we immediately see a