Function at 0x10096a9
Capabilities:
List user accounts

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x1c], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
je 0x1009756
lea eax, [ebp - 0x1c]
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x10]
call sub.ADVAPI32.dll_LsaEnumerateTrustedDomainsEx
cmp eax, edi
mov dword [ebp - 0xc], eax
jge 0x1009707
cmp eax, reloc.WLDAP32.dll_Ordinal_26
jne 0x100973d
cmp dword [ebp - 0x2c], edi
je 0x100971a
push 0x1f72
call fcn.0100371a
pop ecx
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], edi
jbe 0x100973d
xor esi, esi
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [ebx + 4]
push dword [eax + 4]
call fcn.01009452
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0x1c]
jb 0x1009721
xor edi, edi
push dword [ebp - 8]
call sub.ADVAPI32.dll_LsaFreeMemory
cmp dword [ebp - 0xc], 0x105
mov dword [ebp - 8], edi
je 0x10096e0
jmp 0x1009b4a
lea eax, [ebp - 0x1c]
push eax
push 0x1000
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x10]
call sub.ADVAPI32.dll_LsaEnumerateTrustedDomains
cmp eax, edi
mov dword [ebp - 0xc], eax
jge 0x1009781
cmp eax, reloc.WLDAP32.dll_Ordinal_26
jne 0x10098d8
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
add eax, esi
shl eax, 5
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x10098e7
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 4]
lea ecx, [eax + esi]
shl ecx, 5
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov eax, esi
mov esi, dword [ebp - 8]
shl eax, 5
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], esi
jbe 0x100988f
mov dword [ebp - 0x2c], esi
mov ebx, eax
jmp 0x10097f3
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov dword [ebx + eax + 0x18], 1
mov eax, dword [ebp - 4]
mov dword [ebx + eax + 0x14], 2
mov eax, dword [ebp - 4]
lea eax, [ebx + eax + 4]
push eax
mov eax, dword [ebp - 0x24]
movzx eax, word [esi + eax + 2]
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x1009882
mov eax, dword [ebp - 0x24]
add eax, esi
movzx ecx, word [eax + 2]
mov esi, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edi, dword [ebx + eax + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x2c]
and ecx, 3
inc dword [ebp - 0x18]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov cx, word [eax + ecx]
mov edx, dword [ebp - 4]
mov word [ebx + edx], cx
mov ecx, dword [ebp - 0x24]
mov cx, word [eax + ecx + 2]
mov edx, dword [ebp - 4]
add eax, 0xc
mov word [ebx + edx + 2], cx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
add ebx, 0x20
cmp eax, dword [ebp - 0x1c]
jb 0x10097f0
jmp 0x1009889
mov dword [ebp - 0xc], 0xc000009a
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jl 0x10098ab
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
jmp 0x10098d6
mov edi, dword [ebp - 0x18]
test edi, edi
jbe 0x10098ce
mov esi, eax
mov eax, dword [ebp - 4]
push dword [esi + eax + 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 4]
and dword [esi + eax + 4], 0
add esi, 0x20
dec edi
jne 0x10098b4
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
xor edi, edi
cmp dword [ebp - 0xc], 0x105
je 0x1009756
jmp 0x10098ee
mov dword [ebp - 0xc], 0xc000009a
cmp dword [ebp - 0xc], edi
jl 0x1009b3e
mov eax, dword [ebx]
cmp eax, edi
je 0x1009939
cmp word [eax], 0x5c
je 0x1009939
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 6]
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x1009b31
push dword [ebx]
push 0x1001484
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
jmp 0x100993c
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x10], edi
jne 0x1009b31
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
push 8
push edi
push dword [ebp - 0x28]
call sub.NETAPI32.dll_NetUserEnum
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x1009974
cmp eax, 0xea
jne 0x1009aec
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
jbe 0x1009ad7
mov ebx, dword [ebp - 0x14]
shl ebx, 5
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
push 0x24
push dword [eax + ecx*4]
call dword [sym.imp.msvcrt.dll_wcsrchr]
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
je 0x10099a5
mov word [eax], si
xor edi, edi
cmp dword [ebp - 0x14], esi
jbe 0x10099e2
mov eax, dword [ebp - 8]
push dword [esi + eax + 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
push dword [eax + ecx*4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10099d3
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0x14]
jb 0x10099ac
jmp 0x10099e2
mov ecx, dword [ebp - 8]
mov eax, edi
shl eax, 5
lea eax, [eax + ecx + 0x14]
or dword [eax], 1
cmp edi, dword [ebp - 0x14]
jne 0x1009aae
lea eax, [ebp - 4]
push eax
lea esi, [ebx + 0x20]
push esi
call sub.NETAPI32.dll_NetApiBufferAllocate
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x1009acb
mov edi, dword [ebp - 4]
mov ecx, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x18]
xor eax, eax
inc eax
mov dword [ebx + ecx + 0x18], eax
mov ecx, dword [ebp - 4]
mov dword [ebx + ecx + 0x14], eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax + 4]
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
call sub.NETAPI32.dll_NetApiBufferAllocate
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x1009acb
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
mov eax, dword [ebp - 4]
push dword [ebx + eax + 4]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 4]
pop ecx
pop ecx
add eax, ebx
push dword [eax + 4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp - 0xc], 0
jl 0x1009aa6
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 4]
inc dword [ebp - 0x14]
mov dword [ebp - 8], eax
add ebx, 0x20
jmp 0x1009aae
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x1009aba
mov word [eax], 0x24
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jb 0x1009986
jmp 0x1009ad2
mov dword [ebp - 0xc], 0xc000009a
mov ebx, dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 0x20]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x10], 0xea
je 0x1009945
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebx]
je 0x1009af9
push eax
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x10], edi
jne 0x1009b31
cmp dword [ebp - 0x14], edi
jbe 0x1009b31
push 0x1f72
call fcn.0100371a
cmp dword [ebp - 0x14], edi
pop ecx
jbe 0x1009b31
mov edi, dword [ebp - 0x14]
xor esi, esi
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [ebx + 4]
push dword [eax + 4]
call fcn.01009452
add esi, 0x20
dec edi
jne 0x1009b18
xor edi, edi
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.0100941e
jmp 0x1009b4a
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], reloc.WLDAP32.dll_Ordinal_26
jne 0x1009b56
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0x10], edi
pop edi
pop esi
pop ebx
jne 0x1009b6a
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8