Function at 0x1002faf
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edi
call fcn.01002c83
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
mov eax, dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, 0x100ba20
je 0x100301a
cmp word [ebx], 0x5c
jne 0x1003000
cmp word [ebx + 2], 0x5c
jne 0x1003000
lea ecx, [ebx + 4]
push ecx
jmp 0x1003001
push ebx
push esi
call eax
pop ecx
pop ecx
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, edi
pop ecx
pop ecx
je 0x1003021
mov word [eax], di
jmp 0x1003021
mov word [0x100ba20], di
xor esi, esi
push esi
push 0x202
mov edi, 0x100c038
push edi
call fcn.01001945
cmp dword [ebp + 8], esi
je 0x1003066
push dword [ebp + 8]
call fcn.01005c3a
test eax, eax
je 0x100304c
mov dword [ebp - 0x28], 1
push esi
push dword [ebp + 8]
call fcn.01002b42
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x1003066
push 0xf50
call fcn.0100524c
cmp dword [ebp - 8], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
je 0x10030d1
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push 0
call sub.NETAPI32.dll_I_NetPathType
test eax, eax
mov esi, 0xe84
je 0x1003096
push esi
call fcn.0100524c
cmp dword [ebp - 0x14], 0x4000
jne 0x10030a8
mov dword [ebp - 0x48], 1
jmp 0x10030c9
cmp dword [ebp - 0x14], 0x4010
jne 0x10030ba
mov dword [ebp - 0x48], 2
jmp 0x10030c9
cmp dword [ebp - 0x14], 0x4020
je 0x10030b1
push esi
call fcn.0100524c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
jmp 0x10030db
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0x1001294
test ebx, ebx
je 0x10030e2
mov dword [ebp - 0x38], ebx
and dword [ebp - 0x18], 0
cmp dword [0x100b3e0], 0
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
je 0x100320f
mov esi, 0x100b3e0
push str._PERSISTENT
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._PERSISTENT
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x100316d
push dword [esi]
mov dword [ebp - 0x24], 1
call fcn.010063fd
mov ebx, eax
test ebx, ebx
jne 0x100313c
push 0xdb1
call fcn.0100524c
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.01006347
test eax, eax
je 0x1003156
push dword [esi]
push 0xf70
call fcn.01005131
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
xor eax, eax
cmp dword [ebp - 0x2c], 1
sete al
mov dword [ebp - 0x10], eax
jmp 0x10031f2
push str._USER
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push str._USER
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x10031a9
push dword [esi]
call fcn.010063fd
mov esi, eax
test esi, esi
jne 0x10031a4
push 0xdb1
call fcn.0100524c
mov dword [ebp - 4], esi
jmp 0x10031f2
push str._SMARTCARD
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10031c1
mov dword [ebp - 0x1c], 1
jmp 0x10031f2
push str._SAVECRED
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10031d9
mov dword [ebp - 0xc], 1
jmp 0x10031f2
push str._DELETE
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10031f2
push 0xdb6
call fcn.0100524c
inc dword [ebp - 0x18]
movzx esi, word [ebp - 0x18]
lea esi, [esi*4 + 0x100b3e0]
cmp dword [esi], 0
jne 0x10030fe
cmp dword [ebp - 0x24], 0
jne 0x1003227
lea eax, [ebp - 0x10]
push eax
call fcn.01002774
test ax, ax
je 0x1003227
push 0xe5f
call fcn.010051d2
xor esi, esi
cmp dword [ebp - 4], esi
je 0x100323d
cmp dword [ebp - 0xc], esi
je 0x100323d
push 0xdb6
call fcn.0100524c
cmp dword [ebp - 0x1c], esi
je 0x10032eb
cmp dword [ebp - 0xc], esi
je 0x1003255
push 0xdb6
call fcn.0100524c
cmp dword [ebp - 4], 0
mov esi, 0x100bc30
je 0x100326e
push dword [ebp - 4]
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1003276
and word [0x100bc30], 0
cmp dword [ebp + 0x10], 0
je 0x10032b0
push 0x10013f4
push dword [ebp + 0x10]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x10032b0
push dword [ebp + 0x10]
call fcn.01005f5e
test ax, ax
je 0x10032a2
movzx eax, ax
push eax
call fcn.0100524c
push dword [ebp + 0x10]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x10032b8
and word [0x100c038], 0
push 0x102
xor ebx, ebx
push ebx
push 0x100
push edi
push 0x201
push esi
push ebx
push ebx
push 0x100ba20
call dword [sym.imp.credui.dll_CredUICmdLinePromptForCredentialsW]
cmp eax, ebx
je 0x10032e3
push eax
call fcn.0100524c
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edi
jmp 0x100334d
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x100334d
cmp dword [ebp - 0xc], 0
je 0x1003302
push 0xdb6
call fcn.0100524c
push 0x10013f4
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1003336
mov eax, dword [ebp + 0xc]
push 0
push 1
push 0x1105
push 0
push 0x100
mov esi, edi
push edi
mov dword [ebp + 0x10], esi
mov dword [0x100b9e0], eax
call fcn.0100529c
push edi
jmp 0x1003337
push esi
call fcn.01005f5e
test ax, ax
je 0x100334a
movzx eax, ax
push eax
call fcn.0100524c
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 8]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x10], ebx
je 0x1003367
push dword [ebp + 0xc]
push edi
call fcn.0100297c
test eax, eax
je 0x1003367
inc esi
cmp dword [ebp + 0x10], ebx
jne 0x1003382
cmp dword [ebp - 0x1c], ebx
jne 0x1003382
or esi, 0x808
cmp dword [ebp - 0xc], ebx
je 0x1003382
or esi, 0x1000
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
sub eax, ebx
je 0x1003414
sub eax, 5
je 0x10033b1
sub eax, 0x3e
je 0x10033f6
sub eax, 0x12
je 0x10033b7
dec eax
je 0x10033b1
sub eax, 0x4d8
jne 0x100340c
push esi
call fcn.01002817
push dword [ebp + 8]
call fcn.01005bf3
test eax, eax
jne 0x10033ca
push 0x55
call fcn.0100524c
inc word [edi]
push edi
push 0x10013f4
call fcn.01002b42
mov edi, eax
cmp edi, ebx
jne 0x10033e8
push 0xf50
call fcn.0100524c
mov dword [ebp - 0x3c], edi
cmp esi, 0x55
je 0x1003352
jmp 0x1003469
push dword [ebp + 0xc]
call fcn.01002737
test eax, eax
je 0x100340c
push 0xe9f
call fcn.0100524c
push esi
call fcn.01002817
jmp 0x10033eb
cmp dword [ebp - 0x24], ebx
je 0x100342b
push dword [ebp - 0x10]
call fcn.010027da
cmp eax, ebx
je 0x100342b
push eax
call fcn.0100524c
cmp dword [ebp + 0x18], ebx
je 0x100345b
push dword [ebp + 8]
call fcn.01005bf3
test eax, eax
je 0x1003456
mov eax, dword [ebp + 0xc]
push 2
push 0xf4f
mov dword [0x100b9e0], edi
mov dword [0x100b9e4], eax
call fcn.010051f0
call fcn.010051ba
cmp dword [ebp - 0x28], ebx
je 0x1003469
movzx eax, word [edi]
push eax
call fcn.01001cc8
pop edi
pop esi
pop ebx
leave
ret 0x14