Function at 0x1002fdb
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
call fcn.01002caf
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov eax, dword [sym.imp.msvcrt.dll_wcsncpy]
mov esi, 0x100c0d8
je 0x1003051
cmp word [edi], 0x5c
jne 0x1003031
cmp word [edi + 2], 0x5c
jne 0x1003031
push 0x104
lea ecx, [edi + 4]
push ecx
jmp 0x1003037
push 0x104
push edi
push esi
call eax
add esp, 0xc
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, ebx
pop ecx
pop ecx
je 0x1003058
mov word [eax], bx
jmp 0x1003058
mov word [0x100c0d8], bx
xor esi, esi
push esi
push 0x202
mov ebx, 0x100be28
push ebx
call fcn.01001935
cmp dword [ebp + 8], esi
je 0x100309d
push dword [ebp + 8]
call fcn.01005c6c
test eax, eax
je 0x1003083
mov dword [ebp - 0x28], 1
push esi
push dword [ebp + 8]
call fcn.01002b6e
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x100309d
push 0xf50
call fcn.0100529c
cmp dword [ebp - 8], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
je 0x1003108
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push 0
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
mov esi, 0xe84
je 0x10030cd
push esi
call fcn.0100529c
cmp dword [ebp - 0x14], 0x4000
jne 0x10030df
mov dword [ebp - 0x48], 1
jmp 0x1003100
cmp dword [ebp - 0x14], 0x4010
jne 0x10030f1
mov dword [ebp - 0x48], 2
jmp 0x1003100
cmp dword [ebp - 0x14], 0x4020
je 0x10030e8
push esi
call fcn.0100529c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
jmp 0x1003112
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0x10012a4
test edi, edi
je 0x1003119
mov dword [ebp - 0x38], edi
and dword [ebp - 0x18], 0
cmp dword [0x100b3e0], 0
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
je 0x1003246
mov esi, 0x100b3e0
push str._PERSISTENT
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._PERSISTENT
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x10031a4
push dword [esi]
mov dword [ebp - 0x24], 1
call fcn.0100642f
mov edi, eax
test edi, edi
jne 0x1003173
push 0xdb1
call fcn.0100529c
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.01006379
test eax, eax
je 0x100318d
push dword [esi]
push 0xf70
call fcn.01005181
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
xor eax, eax
cmp dword [ebp - 0x2c], 1
sete al
mov dword [ebp - 0x10], eax
jmp 0x1003229
push str._USER
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._USER
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x10031e0
push dword [esi]
call fcn.0100642f
mov esi, eax
test esi, esi
jne 0x10031db
push 0xdb1
call fcn.0100529c
mov dword [ebp - 4], esi
jmp 0x1003229
push str._SMARTCARD
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x10031f8
mov dword [ebp - 0x1c], 1
jmp 0x1003229
push str._SAVECRED
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x1003210
mov dword [ebp - 0xc], 1
jmp 0x1003229
push str._DELETE
push dword [esi]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x1003229
push 0xdb6
call fcn.0100529c
inc dword [ebp - 0x18]
movzx esi, word [ebp - 0x18]
lea esi, [esi*4 + 0x100b3e0]
cmp dword [esi], 0
jne 0x1003135
cmp dword [ebp - 0x24], 0
jne 0x100325e
lea eax, [ebp - 0x10]
push eax
call fcn.0100279c
test ax, ax
je 0x100325e
push 0xe5f
call fcn.01005222
xor esi, esi
cmp dword [ebp - 4], esi
je 0x1003274
cmp dword [ebp - 0xc], esi
je 0x1003274
push 0xdb6
call fcn.0100529c
cmp dword [ebp - 0x1c], esi
je 0x100332f
cmp dword [ebp - 0xc], esi
je 0x100328c
push 0xdb6
call fcn.0100529c
cmp dword [ebp - 4], 0
mov esi, 0x100ba20
je 0x10032ab
push 0x201
push dword [ebp - 4]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x10032b3
and word [0x100ba20], 0
cmp dword [ebp + 0x10], 0
mov edi, 0x100
je 0x10032f8
push 0x1001404
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x10032f8
push dword [ebp + 0x10]
call fcn.01005f90
test ax, ax
je 0x10032e8
movzx eax, ax
push eax
call fcn.0100529c
push edi
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x1003300
and word [0x100be28], 0
push 0x102
xor eax, eax
push eax
push edi
push ebx
push 0x201
push esi
push eax
push eax
push 0x100c0d8
call dword [sym.imp.credui.dll_CredUICmdLinePromptForCredentialsW]
test eax, eax
je 0x1003327
push eax
call fcn.0100529c
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
jmp 0x1003391
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1003391
cmp dword [ebp - 0xc], 0
je 0x1003346
push 0xdb6
call fcn.0100529c
push 0x1001404
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100337a
mov eax, dword [ebp + 0xc]
push 0
push 1
push 0x1105
push 0
push 0x100
mov esi, ebx
push ebx
mov dword [ebp + 0x10], esi
mov dword [0x100b9e0], eax
call fcn.010052ec
push ebx
jmp 0x100337b
push esi
call fcn.01005f90
test ax, ax
je 0x100338e
movzx eax, ax
push eax
call fcn.0100529c
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 8]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x10], ebx
je 0x10033ab
push dword [ebp + 0xc]
push edi
call fcn.010029a4
test eax, eax
je 0x10033ab
inc esi
cmp dword [ebp + 0x10], ebx
jne 0x10033c6
cmp dword [ebp - 0x1c], ebx
jne 0x10033c6
or esi, 0x808
cmp dword [ebp - 0xc], ebx
je 0x10033c6
or esi, 0x1000
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
sub eax, ebx
je 0x1003458
sub eax, 5
je 0x10033f5
sub eax, 0x3e
je 0x100343a
sub eax, 0x12
je 0x10033fb
dec eax
je 0x10033f5
sub eax, 0x4d8
jne 0x1003450
push esi
call fcn.0100283f
push dword [ebp + 8]
call fcn.01005c25
test eax, eax
jne 0x100340e
push 0x55
call fcn.0100529c
inc word [edi]
push edi
push 0x1001404
call fcn.01002b6e
mov edi, eax
cmp edi, ebx
jne 0x100342c
push 0xf50
call fcn.0100529c
mov dword [ebp - 0x3c], edi
cmp esi, 0x55
je 0x1003396
jmp 0x10034ad
push dword [ebp + 0xc]
call fcn.0100274e
test eax, eax
je 0x1003450
push 0xe9f
call fcn.0100529c
push esi
call fcn.0100283f
jmp 0x100342f
cmp dword [ebp - 0x24], ebx
je 0x100346f
push dword [ebp - 0x10]
call fcn.01002802
cmp eax, ebx
je 0x100346f
push eax
call fcn.0100529c
cmp dword [ebp + 0x18], ebx
je 0x100349f
push dword [ebp + 8]
call fcn.01005c25
test eax, eax
je 0x100349a
mov eax, dword [ebp + 0xc]
push 2
push 0xf4f
mov dword [0x100b9e0], edi
mov dword [0x100b9e4], eax
call fcn.01005240
call fcn.0100520a
cmp dword [ebp - 0x28], ebx
je 0x10034ad
movzx eax, word [edi]
push eax
call fcn.01001cb8
pop edi
pop esi
pop ebx
leave
ret 0x14