Function at 0x1800270a0
Capabilities:
List user accounts

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r14, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rbp + 0x48], r15d
mov qword [rbp - 0x30], r15
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x58], r15d
mov dword [rbp + 0x50], r15d
lea rax, [rbp + 0x50]
mov qword [r11 - 0x70], rax
lea rax, [rbp + 0x58]
mov qword [r11 - 0x78], rax
lea rax, [rbp + 0x48]
mov qword [r11 - 0x80], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rbp - 0x30]
lea edx, [r15 + 1]
xor ecx, ecx
lea r8d, [r15 + 2]
call qword [sym.imp.NETAPI32.dll_NetUserEnum]
mov r13d, eax
test eax, eax
je 0x180027124
cmp eax, 0xea
jne 0x1800272e0
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x180027300
mov r12d, r15d
cmp dword [rbp + 0x48], esi
jbe 0x1800272e4
nop dword [rax]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x30]
mov r9d, dword [rax + 0x14]
mov r8, qword [rdi]
lea rdx, str._s__ld
lea rcx, [rbp - 0x18]
call fcn.180002980
mov r11d, dword [rdi + 0x14]
cmp r11d, 2
je 0x1800271fb
cmp r11d, 1
jne 0x1800271f7
mov rbx, qword [rdi]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x1800271ce
test rbx, 0xffffffffffff0000
jne 0x1800271ce
movzx ebx, bx
mov ecx, ebx
call fcn.180001110
test rax, rax
je 0x1800271db
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.180001a00
jmp 0x1800271db
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.180027510
nop
or esi, 1
lea rdx, str.ASPNET
mov rcx, qword [rbp - 0x28]
call fcn.180030ab0
test eax, eax
setne al
test al, al
jne 0x1800271fb
xor bl, bl
jmp 0x1800271fd
mov bl, 1
test sil, 1
je 0x180027225
and esi, 0xfffffffe
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180027225
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
je 0x1800272b0
mov rbx, qword [rdi]
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
test rbx, rbx
je 0x180027277
test rbx, 0xffffffffffff0000
jne 0x180027277
movzx ebx, bx
mov ecx, ebx
call fcn.180001110
test rax, rax
je 0x180027284
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180001a00
jmp 0x180027284
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.180027510
nop
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.180008f80
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800272b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 0x38
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800272d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc r12d
cmp r12d, dword [rbp + 0x48]
jb 0x180027140
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x180027300
mov rcx, rdi
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rdi, r15
mov qword [rbp - 0x30], r15
nop dword [rax]
cmp r13d, 0xea
je 0x180027300
test rdi, rdi
je 0x180027317
mov rcx, rdi
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret