Function at 0x1002dc9
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edi
call fcn.01002b05
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
mov eax, dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, 0x100ba00
je 0x1002e32
cmp word [ebx], 0x5c
jne 0x1002e18
cmp word [ebx + 2], 0x5c
jne 0x1002e18
lea ecx, [ebx + 4]
push ecx
jmp 0x1002e19
push ebx
push esi
call eax
pop ecx
pop ecx
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, edi
pop ecx
pop ecx
je 0x1002e39
mov word [eax], di
jmp 0x1002e39
mov word [0x100ba00], di
xor esi, esi
push esi
push 0x202
mov edi, 0x100c018
push edi
call fcn.010018c0
cmp dword [ebp + 8], esi
je 0x1002e7e
push dword [ebp + 8]
call fcn.010054df
test eax, eax
je 0x1002e64
mov dword [ebp - 0x28], 1
push esi
push dword [ebp + 8]
call fcn.010029e3
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x1002e7e
push 0xf50
call fcn.01004bff
cmp dword [ebp - 8], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
je 0x1002ee9
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push 0
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
mov esi, 0xe84
je 0x1002eae
push esi
call fcn.01004bff
cmp dword [ebp - 0x14], 0x4000
jne 0x1002ec0
mov dword [ebp - 0x48], 1
jmp 0x1002ee1
cmp dword [ebp - 0x14], 0x4010
jne 0x1002ed2
mov dword [ebp - 0x48], 2
jmp 0x1002ee1
cmp dword [ebp - 0x14], 0x4020
je 0x1002ec9
push esi
call fcn.01004bff
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
jmp 0x1002ef3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0x1001274
test ebx, ebx
je 0x1002efa
mov dword [ebp - 0x38], ebx
and dword [ebp - 0x18], 0
cmp dword [0x100b3c0], 0
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
je 0x1003027
mov esi, 0x100b3c0
push str._PERSISTENT
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._PERSISTENT
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x1002f85
push dword [esi]
mov dword [ebp - 0x24], 1
call fcn.01005b90
mov ebx, eax
test ebx, ebx
jne 0x1002f54
push 0xdb1
call fcn.01004bff
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.01005af6
test eax, eax
je 0x1002f6e
push dword [esi]
push 0xf70
call fcn.01004b1f
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
xor eax, eax
cmp dword [ebp - 0x2c], 1
sete al
mov dword [ebp - 0x10], eax
jmp 0x100300a
push str._USER
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._USER
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x1002fc1
push dword [esi]
call fcn.01005b90
mov esi, eax
test esi, esi
jne 0x1002fbc
push 0xdb1
call fcn.01004bff
mov dword [ebp - 4], esi
jmp 0x100300a
push str._SMARTCARD
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1002fd9
mov dword [ebp - 0x1c], 1
jmp 0x100300a
push str._SAVECRED
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1002ff1
mov dword [ebp - 0xc], 1
jmp 0x100300a
push str._DELETE
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100300a
push 0xdb6
call fcn.01004bff
inc dword [ebp - 0x18]
movzx esi, word [ebp - 0x18]
lea esi, [esi*4 + 0x100b3c0]
cmp dword [esi], 0
jne 0x1002f16
cmp dword [ebp - 0x24], 0
jne 0x100303f
lea eax, [ebp - 0x10]
push eax
call fcn.0100267c
test ax, ax
je 0x100303f
push 0xe5f
call fcn.01004ba6
xor esi, esi
cmp dword [ebp - 4], esi
je 0x1003055
cmp dword [ebp - 0xc], esi
je 0x1003055
push 0xdb6
call fcn.01004bff
cmp dword [ebp - 0x1c], esi
je 0x1003103
cmp dword [ebp - 0xc], esi
je 0x100306d
push 0xdb6
call fcn.01004bff
cmp dword [ebp - 4], 0
mov esi, 0x100bc10
je 0x1003086
push dword [ebp - 4]
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x100308e
and word [0x100bc10], 0
cmp dword [ebp + 0x10], 0
je 0x10030c8
push 0x10013d4
push dword [ebp + 0x10]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x10030c8
push dword [ebp + 0x10]
call fcn.010057d3
test ax, ax
je 0x10030ba
movzx eax, ax
push eax
call fcn.01004bff
push dword [ebp + 0x10]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x10030d0
and word [0x100c018], 0
push 0x102
xor ebx, ebx
push ebx
push 0x100
push edi
push 0x201
push esi
push ebx
push ebx
push 0x100ba00
call dword [sym.imp.credui.dll_CredUICmdLinePromptForCredentialsW]
cmp eax, ebx
je 0x10030fb
push eax
call fcn.01004bff
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edi
jmp 0x1003165
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1003165
cmp dword [ebp - 0xc], 0
je 0x100311a
push 0xdb6
call fcn.01004bff
push 0x10013d4
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100314e
mov eax, dword [ebp + 0xc]
push 0
push 1
push 0x1105
push 0
push 0x100
mov esi, edi
push edi
mov dword [ebp + 0x10], esi
mov dword [0x100b9c0], eax
call fcn.01004c3c
push edi
jmp 0x100314f
push esi
call fcn.010057d3
test ax, ax
je 0x1003162
movzx eax, ax
push eax
call fcn.01004bff
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 8]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x10], ebx
je 0x100317f
push dword [ebp + 0xc]
push edi
call fcn.01002844
test eax, eax
je 0x100317f
inc esi
cmp dword [ebp + 0x10], ebx
jne 0x100319a
cmp dword [ebp - 0x1c], ebx
jne 0x100319a
or esi, 0x808
cmp dword [ebp - 0xc], ebx
je 0x100319a
or esi, 0x1000
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
sub eax, ebx
je 0x100322c
sub eax, 5
je 0x10031c9
sub eax, 0x3e
je 0x100320e
sub eax, 0x12
je 0x10031cf
dec eax
je 0x10031c9
sub eax, 0x4d8
jne 0x1003224
push esi
call fcn.010026fc
push dword [ebp + 8]
call fcn.010054a3
test eax, eax
jne 0x10031e2
push 0x55
call fcn.01004bff
inc word [edi]
push edi
push 0x10013d4
call fcn.010029e3
mov edi, eax
cmp edi, ebx
jne 0x1003200
push 0xf50
call fcn.01004bff
mov dword [ebp - 0x3c], edi
cmp esi, 0x55
je 0x100316a
jmp 0x1003281
push dword [ebp + 0xc]
call fcn.01002649
test eax, eax
je 0x1003224
push 0xe9f
call fcn.01004bff
push esi
call fcn.010026fc
jmp 0x1003203
cmp dword [ebp - 0x24], ebx
je 0x1003243
push dword [ebp - 0x10]
call fcn.010026c9
cmp eax, ebx
je 0x1003243
push eax
call fcn.01004bff
cmp dword [ebp + 0x18], ebx
je 0x1003273
push dword [ebp + 8]
call fcn.010054a3
test eax, eax
je 0x100326e
mov eax, dword [ebp + 0xc]
push 2
push 0xf4f
mov dword [0x100b9c0], edi
mov dword [0x100b9c4], eax
call fcn.01004bba
call fcn.01004b93
cmp dword [ebp - 0x28], ebx
je 0x1003281
movzx eax, word [edi]
push eax
call fcn.01001c1e
pop edi
pop esi
pop ebx
leave
ret 0x14