Function at 0x1400be3a4
Capabilities:
List user accounts

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rsi, r9
mov rdi, rcx
xor r12d, r12d
mov rcx, rbx
mov qword [rax - 0x68], r12
xor r9d, r9d
mov edx, 0x678
mov r8d, 0xf0
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, rbx
test rax, rax
je 0x1400be457
mov edx, 0x672
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea edx, [r12 + 1]
call qword [sym.imp.USER32.dll_EnableWindow]
mov r14d, 0x674
mov rcx, rbx
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea edx, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea edx, [r14 - 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
jmp 0x1400be635
mov edx, 0x673
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov r14d, 0x674
mov qword [rsp + 0x20], r12
mov edx, r14d
xor r9d, r9d
mov r8d, 0x146
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
test rax, rax
jne 0x1400be5ef
lea rax, [rbp - 0x1c]
mov dword [rbp - 0x20], r12d
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x18], r12d
mov qword [rsp + 0x30], rax
mov edx, 3
lea rax, [rbp - 0x20]
mov dword [rbp - 0x1c], r12d
mov qword [rsp + 0x28], rax
xor ecx, ecx
or dword [rsp + 0x20], 0xffffffff
lea r8d, [rdx - 1]
mov qword [rbp - 8], r12
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
jne 0x1400be701
xor ecx, ecx
mov qword [rbp - 0x10], r12
mov r15, r12
mov rsi, r12
mov rdi, r12
cmp dword [rbp - 0x20], ecx
jbe 0x1400be586
mov eax, r12d
imul rdi, rax, 0xb8
mov rax, qword [rbp - 8]
test byte [rdi + rax + 0x28], 2
jne 0x1400be575
mov rax, qword [rdi + rax]
test rax, rax
je 0x1400be575
cmp word [rax], cx
je 0x1400be575
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x143
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rax, qword [rbp - 8]
xor ecx, ecx
cmp dword [rdi + rax + 0x14], 2
jne 0x1400be6b3
test r15, r15
jne 0x1400be677
cmp dword [rdi + rax + 0x98], 0x1f4
jne 0x1400be677
mov rcx, qword [rdi + rax]
xor edx, edx
call fcn.1401145e0
mov r15, rax
xor ecx, ecx
mov rdi, qword [rbp - 0x10]
inc r12d
cmp r12d, dword [rbp - 0x20]
jb 0x1400be4fd
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x1400be5c8
mov r8, qword [rbp + 0x30]
mov edx, r14d
add r8, 0x70
mov rcx, rbx
test rdi, rdi
cmovne r8, rdi
test rsi, rsi
cmovne r8, rsi
test r15, r15
cmovne r8, r15
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
test r15, r15
je 0x1400be5de
mov rcx, r15
call fcn.140113e18
test rsi, rsi
je 0x1400be5eb
mov rcx, rsi
call fcn.140113e18
mov rsi, qword [rbp + 0x48]
mov edx, 0x672
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x675
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
cmp rsi, 0x679
jne 0x1400be65c
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
test rsi, rsi
jne 0x1400be575
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rdi + rax]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
test eax, eax
je 0x1400be575
mov rcx, qword [rbp - 8]
xor edx, edx
mov rcx, qword [rdi + rcx]
call fcn.1401145e0
mov rsi, rax
jmp 0x1400be573
cmp qword [rbp - 0x10], rcx
jne 0x1400be575
cmp dword [rdi + rax + 0x14], 1
jne 0x1400be575
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rdi + rax]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
test eax, eax
je 0x1400be575
mov rcx, qword [rbp - 8]
xor edx, edx
mov rcx, qword [rdi + rcx]
call fcn.1401145e0
mov rdi, rax
mov qword [rbp - 0x10], rax
xor ecx, ecx
jmp 0x1400be579
lea rax, [rdi + 0x70]
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1400be5ef