Function at 0x140018bac
Capabilities:
Add user account
Manipulate user privileges
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xa8]
sub rsp, 0x1a0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov edi, 7
mov qword [rbp - 0x28], rdi
xor esi, esi
mov qword [rbp - 0x30], rsi
mov word [rbp - 0x40], si
lea rcx, [rbp - 0x40]
call fcn.14001a1a4
mov ebx, eax
test eax, eax
jns 0x140018c16
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibprofilingaccount.cpp
mov edx, 0xfc
jmp 0x140018f0f
lea rbx, str.VSProfilingAccount
mov qword [rsp + 0x50], rbx
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x10241
mov qword [rbp - 0x80], rsi
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x50]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.samcli.dll_NetUserAdd]
test eax, eax
je 0x140018c9b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140018f22
mov r9d, ebx
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibprofilingaccount.cpp
mov edx, 0x10f
jmp 0x140018f12
lea rcx, [rbp - 0x20]
call fcn.1400198dc
nop
mov dword [rbp + 0x30], edi
lea rcx, [rbp + 0x38]
call fcn.1400194b8
lea rcx, [rbp + 0x40]
call fcn.1400194b8
lea rcx, [rbp + 0x48]
call fcn.1400194b8
lea rcx, [rbp + 0x50]
call fcn.1400194b8
mov byte [rbp + 0x2c], sil
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14001953c
lea rdi, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibprofilingaccount.cpp
test al, al
jne 0x140018d0b
mov rcx, qword [rbp + 0xa8]
mov r8, rdi
mov edx, 0xa7
call fcn.140002c6c
mov ebx, eax
lea rcx, [rbp - 0x20]
call fcn.1400197b0
jmp 0x140018de6
mov qword [rsp + 0x40], rsi
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rbp - 0x70]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x40]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaOpenPolicy]
test eax, eax
jns 0x140018d50
mov rcx, qword [rbp + 0xa8]
mov r9d, eax
mov edx, 0xae
call fcn.140019188
jmp 0x140018cfb
lea rax, str.SeSystemProfilePrivilege
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x60], 0x320030
lea rax, str.SeImpersonatePrivilege
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x70], 0x2e002c
lea rax, str.SeProfileSingleProcessPrivilege
mov qword [rbp + 0x88], rax
mov dword [rbp + 0x80], 0x40003e
mov r9d, 3
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x18]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaAddAccountRights]
test eax, eax
jns 0x140018dcf
mov rcx, qword [rbp + 0xa8]
mov r9d, eax
mov edx, 0xc4
call fcn.140019188
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaClose]
jmp 0x140018cfd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaClose]
nop
lea rcx, [rbp - 0x20]
call fcn.1400197b0
mov ebx, esi
test ebx, ebx
jns 0x140018dfa
mov r9d, ebx
mov r8, rdi
mov edx, 0x111
jmp 0x140018f12
call fcn.14000a024
test eax, eax
jne 0x140018e8a
call fcn.140009fd0
test eax, eax
jne 0x140018e8a
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, str.ProfileAsAdmin
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDevTools
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x140018e8a
cmp dword [rsp + 0x48], esi
je 0x140018e8a
lea rcx, str.Administrators
call fcn.140018a98
mov ebx, eax
test eax, eax
jns 0x140018e8a
mov edx, 0x122
jmp 0x140018f0c
call fcn.14000a024
test eax, eax
je 0x140018ede
lea rcx, str.Users
call fcn.140018a98
mov ebx, eax
test eax, eax
jns 0x140018eac
mov edx, 0x12a
jmp 0x140018f0c
lea rcx, str.Performance_Log_Users
call fcn.140018a98
mov ebx, eax
test eax, eax
jns 0x140018ec5
mov edx, 0x12b
jmp 0x140018f0c
lea rcx, str.Performance_Monitor_Users
call fcn.140018a98
mov ebx, eax
test eax, eax
jns 0x140018ede
mov edx, 0x12c
jmp 0x140018f0c
lea rax, str.Microsoft_DevToolsLauncher_VSProfilingUser
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.14001425c
mov ebx, eax
test eax, eax
jns 0x140018f20
mov edx, 0x131
mov r8, rdi
mov r9d, eax
mov rcx, qword [rbp + 0xa8]
call fcn.140002c38
jmp 0x140018f22
mov ebx, esi
cmp qword [rbp - 0x28], 8
jb 0x140018f33
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14001ae30
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret