Function at 0x10001790
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push str.kernel32
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x10001a4a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000d400
push ebx
call edi
push 0x1000d410
push ebx
mov dword [esi], eax
call edi
push 0x1000d420
push ebx
mov dword [esi + 4], eax
call edi
push str.OpenEventA
push ebx
mov dword [esi + 8], eax
call edi
push 0x1000d438
push ebx
mov dword [esi + 0xc], eax
call edi
push 0x1000d444
push ebx
mov dword [esi + 0x10], eax
call edi
push 0x1000d450
push ebx
mov dword [esi + 0x14], eax
call edi
xor edi, edi
mov dword [esi + 0x18], eax
cmp dword [esi], edi
je 0x10001a35
cmp dword [esi + 4], edi
je 0x10001a35
cmp dword [esi + 8], edi
je 0x10001a35
cmp dword [esi + 0xc], edi
je 0x10001a35
cmp dword [esi + 0x10], edi
je 0x10001a35
cmp dword [esi + 0x14], edi
je 0x10001a35
cmp eax, edi
je 0x10001a35
push 0xb
push str.samsrv.dll
lea eax, [esi + 0x1c]
push 0xb
push eax
call fcn.100026bc
push 0xc
push str.SamIConnect
lea ecx, [esi + 0x27]
push 0xc
push ecx
call fcn.100026bc
push 0xf
push str.SamrOpenDomain
lea edx, [esi + 0x33]
push 0xf
push edx
call fcn.100026bc
push 0xd
push str.SamrOpenUser
lea eax, [esi + 0x42]
push 0xd
push eax
call fcn.100026bc
add esp, 0x40
push 0x19
push str.SamrQueryInformationUser
lea ecx, [esi + 0x4f]
push 0x19
push ecx
call fcn.100026bc
push 0x1b
push str.SamrEnumerateUsersInDomain
lea edx, [esi + 0x68]
push 0x1b
push edx
call fcn.100026bc
push 0x20
push str.SamIFree_SAMPR_USER_INFO_BUFFER
lea eax, [esi + 0x83]
push 0x20
push eax
call fcn.100026bc
push 0x22
push str.SamIFree_SAMPR_ENUMERATION_BUFFER
lea ecx, [esi + 0xa3]
push 0x22
push ecx
call fcn.100026bc
add esp, 0x40
push 0x10
push str.SamrCloseHandle
lea edx, [esi + 0xc5]
push 0x10
push edx
call fcn.100026bc
push 0xd
push str.advapi32.dll
lea eax, [esi + 0xd5]
push 0xd
push eax
call fcn.100026bc
push 0xe
push str.LsaOpenPolicy
lea ecx, [esi + 0xe2]
push 0xe
push ecx
call fcn.100026bc
push 0x1a
push str.LsaQueryInformationPolicy
lea edx, [esi + 0xf0]
push 0x1a
push edx
call fcn.100026bc
add esp, 0x40
push 9
push str.LsaClose
lea eax, [esi + 0x10a]
push 9
push eax
call fcn.100026bc
push 0xb
push str.msvcrt.dll
lea ecx, [esi + 0x113]
push 0xb
push ecx
call fcn.100026bc
push 7
push str.malloc
lea edx, [esi + 0x11e]
push 7
push edx
call fcn.100026bc
push 8
push str.realloc
lea eax, [esi + 0x125]
push 8
push eax
call fcn.100026bc
add esp, 0x40
push 5
push str.free
lea ecx, [esi + 0x12d]
push 5
push ecx
call fcn.100026bc
push 7
push str.memcpy
lea edx, [esi + 0x132]
push 7
push edx
call fcn.100026bc
push 0xa
push str.ntdll.dll
lea eax, [esi + 0x139]
push 0xa
push eax
call fcn.100026bc
push 9
push str.wcstombs
lea ecx, [esi + 0x143]
push 9
push ecx
call fcn.100026bc
add esp, 0x40
push 0xb
push str.GlobalSAM
lea edx, [esi + 0x14c]
push 0xb
push edx
call fcn.100026bc
push 0xc
push str.GlobalFREE
lea eax, [esi + 0x157]
push 0xc
push eax
call fcn.100026bc
add esp, 0x20
mov dword [esi + 0x164], 0x7530
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], edi
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov esi, 0x57
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret