Function at 0x140024ee0
Capabilities:
List user accounts

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
lea r9, [0x1400748f8]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
xor r13d, r13d
call fcn.14003a07c
mov rcx, qword [rsp + 0x40]
lea edx, [r13 + 1]
call fcn.14003853c
lea r8, [0x1400748f8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003a05c
mov rax, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], r13b
jne 0x140024f40
add rcx, 8
mov edx, 1
mov qword [rsp + 0x40], rcx
call fcn.14003853c
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [rsp + 0x40]
mov rbp, rax
call fcn.140038690
mov rdx, qword [rsp + 0x40]
lea r8, [0x140074908]
mov rcx, rbp
call fcn.1400386f0
xor r12d, r12d
mov qword [rsp + 0x50], r13
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r13d
nop word [rax + rax]
lea rax, [rsp + 0xb8]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], 0xffffffff
call sub.NETAPI32.dll_NetUserEnum
mov ecx, dword [rsp + 0xb0]
mov edi, eax
shl rcx, 3
mov dword [rsp + 0xc8], eax
call fcn.140038534
mov r14, qword [rsp + 0x50]
mov rbx, rax
mov qword [rsp + 0x58], rax
test edi, edi
je 0x14002502c
cmp edi, 0xea
jne 0x14002518f
test r14, r14
je 0x140024fb0
mov ecx, dword [rsp + 0xb0]
xor r15d, r15d
test ecx, ecx
je 0x140025181
nop
test r14, r14
je 0x140025175
mov rcx, qword [r14]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x140025053
inc rdx
call fcn.140007870
mov rsi, rax
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140025070
mov rax, 0xffffffffffffffff
cmp byte [rax + rbp + 1], 0
lea rax, [rax + 1]
jne 0x140025080
lea rbx, [rax + 0x30]
mov edx, 1
add rbx, rcx
mov rcx, rbx
call fcn.14003853c
mov r8, rbp
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140038690
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400386f0
lea r8, [0x140074910]
mov rdx, rbx
mov rcx, rdi
call fcn.1400386f0
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400250d7
inc rdx
mov rcx, rdi
call fcn.140007770
mov rcx, rax
mov rbx, rax
call fcn.140027310
test al, al
je 0x14002514e
mov rcx, 0xffffffffffffffff
cmp word [rbx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140025101
lea rcx, [rcx*2 + 2]
call fcn.140038534
mov rcx, qword [rsp + 0x58]
mov rdx, 0xffffffffffffffff
mov qword [rcx + r12*8], rax
nop word [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140025130
inc rdx
mov r8, rbx
mov rcx, rax
call fcn.14004126c
inc r13d
inc r12
mov rcx, rdi
call fcn.140038520
mov rcx, rsi
call fcn.140038520
mov ecx, dword [rsp + 0xb0]
add r14, 8
inc r15d
cmp r15d, ecx
jb 0x140025040
mov rbx, qword [rsp + 0x58]
mov edi, dword [rsp + 0xc8]
cmp edi, 0xea
je 0x140024fb0
jmp 0x140025196
mov ecx, dword [rsp + 0xb0]
cmp r13d, ecx
jge 0x1400251b3
sub ecx, r13d
movsxd rax, r13d
movsxd r8, ecx
xor edx, edx
shl r8, 3
lea rcx, [rbx + rax*8]
call fcn.1400376d0
mov rax, rbx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret