Function at 0x11050a30
Capabilities:
Connect network resource
Create directory
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dbb6c
mov eax, dword fs:[0]
push eax
sub esp, 0xd48
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx + 0xa8]
mov dword [ebp - 0xce4], esi
call fcn.1104ee90
mov dword [ebp - 0xcc8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp word [eax], bx
je 0x110510eb
lea ecx, [ebp - 0xcdc]
call fcn.1113dd30
xor eax, eax
mov word [ebp - 0xaa8], ax
lea ecx, [ebp - 0x6a0]
mov eax, ecx
push 0x80
push 0x208
mov dword [ebp - 0xccc], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xcc0], ecx
mov ecx, dword [esi + 0x48]
lea edx, [ebp - 0xaa8]
push eax
mov dword [ebp - 0xcc4], edx
mov dword [ebp - 0xcbc], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push str.ChatHistoryPath
push 0x112187c0
mov byte [ebp - 4], 1
call edx
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ebx
push 0x200
lea edx, [ebp - 0x6a0]
push edx
push 0x1120328c
push 0x112187c0
call eax
cmp word [ebp - 0x218], bx
jne 0x11050b33
push 3
call fcn.111bb510
lea edx, [ebp - 0x218]
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x11050b22
jmp 0x11050b93
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x11050b40
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x21a], 0x5c
lea eax, [ebp + eax*2 - 0x218]
jne 0x11050b67
xor ecx, ecx
mov word [eax - 2], cx
push ebx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x11050b80
mov eax, dword [0x11203288]
mov dword [edi], eax
mov ecx, dword [esi + 0x48]
push ebx
push ebx
push str.ChatHistoryWithTeacherName
push 0x112187c0
call fcn.110bbc00
test eax, eax
je 0x11050c73
lea ecx, [ebp - 0xce0]
push ecx
lea edx, [ebp - 0xca8]
push edx
mov dword [ebp - 0xce0], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.110e46f0
add esp, 4
cmp eax, 0x5c
je 0x11050c04
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x11050bf0
mov ecx, dword [0x11203288]
mov dword [edi], ecx
lea eax, [ebp - 0xca8]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x11050c10
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x11050c26
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [ebp - 0x218]
rep movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0xcdc]
call fcn.1113dbf0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x11050c60
mov eax, dword [0x11203288]
mov dword [edi], eax
cmp word [ebp - 0x6a0], bx
je 0x11050d59
mov esi, dword [sym.imp.MSVCR100.dll_wcschr]
lea ecx, [ebp - 0x6a0]
push 0x2f
push ecx
call esi
add esp, 8
test eax, eax
je 0x11050cbf
xor edx, edx
push edx
push edx
push 0x100
lea ecx, [ebp - 0xaa8]
mov word [eax], dx
push ecx
add eax, 2
push eax
call fcn.110ea730
add esp, 0x14
lea ebx, [ebp - 0xaa8]
jmp 0x11050cc4
mov ebx, 0x11247f3c
lea edx, [ebp - 0x6a0]
push 0x5c
push edx
mov dword [ebp - 0xcc4], ebx
call esi
mov edi, eax
add esp, 8
test edi, edi
je 0x11050ce8
xor eax, eax
mov word [edi], ax
add edi, 2
jmp 0x11050cf8
lea edi, [ebp - 0x6a0]
mov dword [ebp - 0xcc0], 0x11247f3c
mov edx, dword [ebp - 0xcc0]
mov esi, dword [sym.imp.ADVAPI32.dll_LogonUserW]
lea ecx, [ebp - 0xcbc]
push ecx
push 0
push 2
push ebx
push edx
push edi
mov dword [ebp - 0xccc], edi
call esi
test eax, eax
jne 0x11050d34
mov ecx, dword [ebp - 0xcc0]
lea eax, [ebp - 0xcbc]
push eax
push 0
push 3
push ebx
push ecx
push edi
call esi
cmp dword [ebp - 0xcbc], 0
jne 0x11050d59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0xcc0]
push eax
push edi
push edx
push str.Unable_to_LogonUser_for__s_s__gle_d_n
call fcn.111bd7b0
add esp, 0x10
lea eax, [ebp - 0xcb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xcac]
movzx edx, word [ebp - 0xcae]
movzx eax, word [ebp - 0xcb0]
push ecx
movzx ecx, word [ebp - 0xcb2]
push edx
movzx edx, word [ebp - 0xcb6]
push eax
movzx eax, word [ebp - 0xcb8]
push ecx
push edx
cdq
mov ecx, 0x64
idiv ecx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
lea edx, [ebp - 0x298]
push str._02d_02d_02d__02d_02d_02d
push edx
call esi
mov eax, dword [ebp - 0xce4]
mov eax, dword [eax + 0x10c]
add esp, 0x20
lea ecx, [ebp - 0x298]
lea edx, [ebp - 0x218]
push ecx
test eax, eax
je 0x11050de7
push eax
push edx
lea eax, [ebp - 0x4a0]
push str._s_s__s_chat.txt
push eax
call esi
add esp, 0x14
jmp 0x11050df9
push edx
lea eax, [ebp - 0x4a0]
push str._s_s_groupChat.txt
push eax
call esi
add esp, 0x10
mov eax, dword [ebp - 0xcbc]
test eax, eax
je 0x11050e0a
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov edx, dword [ebp - 0xcdc]
mov eax, dword [edx]
lea ecx, [ebp - 0xcdc]
call eax
test al, al
jne 0x11050e35
push 0x263
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
cmp dword [ebp - 0xcd4], 0
je 0x11050e78
mov edx, dword [ebp - 0xcdc]
mov eax, dword [edx]
lea ecx, [ebp - 0xcdc]
call eax
test al, al
jne 0x11050e69
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0xcd0]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x4a0]
push 0x111f88e8
push edx
or edi, 0xffffffff
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x11050f44
mov ebx, vtable.NSMFile.0
lea ecx, [ebp - 0xd04]
mov dword [ebp - 0xd0c], ebx
call fcn.1113dd30
mov dword [ebp - 0xcf4], esi
mov dword [ebp - 0xcf0], 0
mov word [ebp - 0xcec], 1
mov dword [ebp - 0xce8], edi
mov eax, dword [ebp - 0xcc8]
push eax
lea ecx, [ebp - 0xd0c]
mov byte [ebp - 4], 2
call fcn.1113b340
mov ecx, dword [ebp - 0xcf4]
mov esi, dword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
test ecx, ecx
je 0x11050efd
push ecx
call esi
add esp, 4
lea ecx, [ebp - 0x4a0]
push ecx
push str.Written_file__s_n
mov dword [ebp - 0xcf4], 0
mov edi, eax
call fcn.111bd7b0
mov eax, dword [ebp - 0xcf4]
add esp, 8
mov byte [ebp - 4], 1
mov dword [ebp - 0xd0c], ebx
test eax, eax
je 0x11050f37
push eax
call esi
add esp, 4
lea ecx, [ebp - 0xd04]
call fcn.1113cd80
jmp 0x11050f66
mov edx, dword [sym.imp.MSVCR100.dll__errno]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x4a0]
push eax
push str.Couldnt_create_file__s._gle_d__errno_d_n
call fcn.111bd7b0
add esp, 0x10
cmp dword [ebp - 0xcbc], 0
je 0x11050f75
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
je 0x110510c3
cmp word [ebp - 0x6a0], 0
je 0x110510c3
mov edx, dword [ebp - 0xcdc]
mov eax, dword [edx]
lea ecx, [ebp - 0xcdc]
call eax
test al, al
jne 0x11050fb6
push 0x263
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
cmp dword [ebp - 0xcd4], 0
jne 0x11051001
xor eax, eax
jmp 0x11050fd0
movzx ecx, word [ebp + eax - 0x4a0]
mov word [ebp + eax - 0x8a8], cx
add eax, 2
test cx, cx
jne 0x11050fd0
lea ecx, [ebp - 0x8a8]
push 0x5c
push ecx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
xor edx, edx
mov word [eax], dx
jmp 0x1105103a
lea ecx, [ebp - 0xcdc]
call fcn.1102f630
lea edx, [ebp - 0x8a8]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x11051014
lea eax, [ebp - 0x8a8]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [ebp - 0xccc]
mov eax, dword [ebp - 0xcc4]
xor edi, edi
push edi
push ebx
push eax
lea ecx, [ebp - 0xd2c]
lea edx, [ebp - 0x8a8]
push ecx
mov dword [ebp - 0xd2c], 2
mov dword [ebp - 0xd28], 1
mov dword [ebp - 0xd24], edi
mov dword [ebp - 0xd20], edi
mov dword [ebp - 0xd1c], edi
mov dword [ebp - 0xd18], edx
mov dword [ebp - 0xd14], edi
mov dword [ebp - 0xd10], edi
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
cmp esi, 0x4c3
jne 0x11051110
push ebx
push str.Credential_Conflict__user_s_n
call fcn.111bd7b0
add esp, 8
push ebx
lea edx, [ebp - 0x8a8]
push edx
push esi
push str.AddConn2_error__d__accessing_resource__s__user_s_n
call fcn.111bd7b0
add esp, 0x10
mov ecx, 0x200
lea eax, [ebp - 0xaa8]
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x110510d0
mov byte [ebp - 4], cl
lea ecx, [ebp - 0xcdc]
call fcn.1113cd80
mov eax, dword [ebp - 0xcc8]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
cmp esi, edi
jne 0x110510ad
lea ecx, [ebp - 0xcdc]
call fcn.1103f220
test al, al
jne 0x11051136
push edi
lea ecx, [ebp - 0xcdc]
call fcn.1102f630
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x4a0]
push 0x111f88e8
push edx
call dword [sym.imp.MSVCR100.dll__wfopen]
add esp, 8
cmp eax, edi
je 0x110511b2
push eax
lea ecx, [ebp - 0xd54]
call fcn.1102f660
mov eax, dword [ebp - 0xcc8]
push eax
lea ecx, [ebp - 0xd54]
mov byte [ebp - 4], 3
call fcn.1113b340
lea ecx, [ebp - 0xd54]
call fcn.1104daf0
lea ecx, [ebp - 0x4a0]
push ecx
push str.Written_file_2__s_n
call fcn.111bd7b0
add esp, 8
lea ecx, [ebp - 0xd54]
mov byte [ebp - 4], 1
call fcn.1102f6a0
push edi
push edi
lea ecx, [ebp - 0x8a8]
push ecx
call sub.MPR.dll_WNetCancelConnection2W
jmp 0x110510c3
mov edx, dword [sym.imp.MSVCR100.dll__errno]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x4a0]
push eax
push str.Couldnt_create_file_2__s._gle_d__errno_d_n
call fcn.111bd7b0
add esp, 0x10
push edi
push edi
lea ecx, [ebp - 0x8a8]
push ecx
call sub.MPR.dll_WNetCancelConnection2W
jmp 0x110510c3