Function at 0x140060c00
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x138], 0
mov dword [rsp + 0x50], 0
mov rax, qword [rsp + 0x190]
cmp dword [rax + 0xc0], 0
jl 0x140060c6f
cmp qword [rsp + 0x198], 0
je 0x140060c6f
mov rax, qword [rsp + 0x198]
movsx eax, byte [rax]
test eax, eax
jne 0x140060c76
xor al, al
jmp 0x140061499
mov dword [rsp + 0x160], 0
jmp 0x140060c94
mov eax, dword [rsp + 0x160]
add eax, 1
mov dword [rsp + 0x160], eax
mov edi, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x190]
call fcn.140001650
cmp rdi, rax
jae 0x140060cf7
mov edx, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x190]
call fcn.140001680
mov rdx, rax
add rdx, 4
mov rcx, qword [rsp + 0x198]
call fcn.140025aac
test eax, eax
jne 0x140060cf5
mov edx, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x190]
call fcn.140001680
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
jmp 0x140060cf7
jmp 0x140060c83
cmp dword [rsp + 0x48], 0
jg 0x140060d05
xor al, al
jmp 0x140061499
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [0x140081f78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004d710
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140060d62
lea rcx, [0x140081f90]
call fcn.1400264fc
xor al, al
jmp 0x140061499
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x138], eax
mov rax, qword [rsp + 0x168]
mov ecx, dword [rax + 0x48]
add ecx, 1
mov rax, qword [rsp + 0x168]
mov dword [rax + 0x48], ecx
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [0x140081fb8]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.140050af0
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x38], 0
je 0x140060dfd
mov rcx, qword [rsp + 0x38]
call fcn.140025614
mov qword [rsp + 0x38], 0
mov edx, dword [rsp + 0x138]
mov rcx, qword [rsp + 0x190]
call fcn.140060940
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r9d, 0x80
lea r8, str.SAMDomainsAccountUsersNames
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bf50
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x140060e64
lea rdx, [rsp + 0x60]
lea rcx, [0x140081ff8]
call fcn.1400264fc
xor al, al
jmp 0x140061499
mov eax, dword [rsp + 0x4c]
add eax, 4
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r8, qword [rsp + 0x1a0]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004f6c0
test rax, rax
jne 0x140060ea8
xor al, al
jmp 0x140061499
mov r9, qword [rsp + 0x1a0]
lea r8, str.SAMDomainsAccountUsersNames_s
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
xor r9d, r9d
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bf50
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
add eax, 4
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r9d, dword [rsp + 0x138]
lea r8, [0x140079f7c]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.1400504c0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r9d, 0x80
lea r8, str.SAMDomainsAccountUsers
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bf50
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x140060f8c
lea rdx, [rsp + 0x60]
lea rcx, [0x140082058]
call fcn.1400264fc
xor al, al
jmp 0x140061499
mov eax, dword [rsp + 0x4c]
add eax, 4
mov dword [rsp + 0x4c], eax
mov byte [rsp + 0x148], 0
lea rdi, [rsp + 0x149]
xor eax, eax
mov ecx, 9
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x138]
lea rdx, [0x140082070]
lea rcx, [rsp + 0x148]
call fcn.140025b64
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
lea r8, [rsp + 0x148]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004f6c0
test rax, rax
jne 0x140061005
xor al, al
jmp 0x140061499
mov r9d, dword [rsp + 0x138]
lea r8, [0x140082078]
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
mov r9d, 0x80
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bf50
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
add eax, 4
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r9d, 3
lea r8, [0x14007a04c]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.1400504c0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov r9d, 3
lea r8, [0x14007a094]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.1400504c0
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x48]
lea r8, [0x140082098]
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004d710
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140061156
lea r9, [rsp + 0x60]
mov r8d, 0x24d
lea rdx, [0x1400820c0]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor al, al
jmp 0x140061499
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
mov eax, dword [rsp + 0x138]
mov dword [rcx + 0x30], eax
mov r9d, dword [rsp + 0x138]
lea r8, [0x1400820e8]
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.140050af0
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x38], 0
je 0x1400611f4
mov rcx, qword [rsp + 0x38]
call fcn.140025614
mov qword [rsp + 0x38], 0
mov r9d, dword [rsp + 0x48]
lea r8, [0x140082110]
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004d710
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14006127c
lea r9, [rsp + 0x60]
mov r8d, 0x25c
lea rdx, [0x140082138]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor al, al
jmp 0x140061499
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0xcc
jge 0x1400612a7
lea r9, [rsp + 0x60]
mov r8d, 0x262
lea rdx, [0x140082160]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 0x10]
call fcn.140025654
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x140]
movsxd r8, dword [rax + 0x10]
xor edx, edx
mov rcx, qword [rsp + 0x158]
call fcn.1400258a0
mov rdx, qword [rsp + 0x140]
mov eax, dword [rdx + 0x10]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x1a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x140]
movsxd r8, dword [rdx + 0x10]
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rcx + 0xcc]
mov rdx, qword [rsp + 0x158]
call fcn.1400252e0
mov rcx, qword [rsp + 0x158]
call fcn.140025614
mov rdx, qword [rsp + 0x140]
movsxd r8, dword [rdx + 0x1c]
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 0x18]
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rcx + 0xcc]
xor edx, edx
call fcn.1400258a0
mov rdx, qword [rsp + 0x140]
movsxd r8, dword [rdx + 0x28]
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 0x24]
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rcx + 0xcc]
xor edx, edx
call fcn.1400258a0
mov rdx, qword [rsp + 0x140]
mov r8d, dword [rdx + 0xc]
add r8d, 0xcc
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x190]
call fcn.14005c0e0
mov r9d, dword [rsp + 0x138]
lea r8, [0x1400821b0]
mov edx, 0xb4
lea rcx, [rsp + 0x60]
call fcn.1400260f4
mov rdx, qword [rsp + 0x190]
movsxd rax, dword [rdx + 0xc0]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.140050af0
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x38], 0
je 0x140061476
mov rcx, qword [rsp + 0x38]
call fcn.140025614
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x190]
movsxd rax, dword [rax + 0xc0]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bdc0
mov al, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x180
pop rdi
ret