Function at 0x3bc1c387f
Capabilities:
Get user security identifier
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
call fcn.3bc1c379f
mov ebp, 0xea
mov edi, 0
jmp 0x3bc1c3d9c
mov r8, rbx
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov edi, 0x40000002
jmp 0x3bc1c3d8d
mov r8, r15
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
jmp 0x3bc1c3d3e
mov edi, 0x40000002
cmp qword [rbx + 8], 0
je 0x3bc1c39d4
mov edx, 0x44
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x10], 0
je 0x3bc1c3cb9
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x44
mov rdx, qword [rsi]
mov rcx, qword [rbx]
mov r8, r12
call sub.msvcrt.dll_wcsncpy
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
call fcn.3bc1ca05a
mov eax, dword [rsi + 0x14]
mov dword [rbx + 0x20], eax
mov eax, dword [rsi + 0x28]
mov dword [rbx + 0x24], eax
mov eax, dword [rsi + 0x60]
mov dword [rbx + 0x28], eax
mov eax, dword [rsi + 0x64]
mov dword [rbx + 0x2c], eax
mov eax, dword [rsi + 0x68]
mov dword [rbx + 0x30], eax
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov ecx, 0
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x3bc1c39de
test edi, edi
je 0x3bc1c3b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r8d, eax
lea rdx, str.users_sync
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c3bfb
ja case.0x3bc1c39d2.1
mov eax, edi
lea rdx, [0x3bc1d524c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov edi, 0x40000002
jmp 0x3bc1c3902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
cmp eax, 0x7a
je 0x3bc1c3a01
lea rdx, str.users_sync
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
jmp 0x3bc1c3995
mov edx, dword [rsp + 0x5c]
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x3bc1c3b7a
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov ecx, 0
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x3bc1c3a61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x3bc1c398d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r8d, eax
lea rdx, str.users_sync
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
inc dword [rbx + 0x187720ff]
inc dword [rbx + 0x187720ff]
ja case.0x3bc1c3a9a.1
add byte [rax], al
mov eax, edi
lea rdx, [0x3bc1d52d0]
add byte [rax + 0x63], cl
add al, 0x82
add byte [rax + 0x63], cl
add al, 0x82
add rax, rdx
jmp rax
cmp edi, 0x94
je 0x3bc1c3b34
add byte [rax], al
add byte [rax], al
cmp edi, 0x94
ja 0x3bc1c3ae0
cmp edi, 0x7f
ja 0x3bc1c3ace
cmp edi, 0x7e
jae 0x3bc1c3b3e
cmp edi, 0x50
jne 0x3bc1c3b48
mov edi, 0x40000007
jmp case.0x3bc1c3a9a.0
cmp edi, 0x91
jne 0x3bc1c3b52
mov edi, 0x4000000d
jmp case.0x3bc1c3a9a.0
cmp edi, 0xb7
je 0x3bc1c3b5c
cmp edi, 0x80070005
je 0x3bc1c3b66
cmp edi, 0xaa
jne 0x3bc1c3b70
mov edi, 0x4000000d
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000003
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000009
jmp case.0x3bc1c3a9a.0
mov edi, 0x4000000d
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000001
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000008
jmp case.0x3bc1c3a9a.0
mov edi, 0x4000000d
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000003
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000001
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000001
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000007
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000009
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000001
jmp case.0x3bc1c3a9a.0
mov edi, 0x40000002
jmp 0x3bc1c398d
mov qword [rbx + 0x18], 0
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
je 0x3bc1c3bd5
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x3bc1c3c81
mov r8, qword [rbx + 8]
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x20], eax
lea rdx, str.users_sync
lea rcx, str._D____s_____User_found_name_s_s_sid_s_acct_expires_x_last_logon_x__n
call fcn.3bc1c1292
jmp case.0x3bc1c39d2.0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.sid_to_str
lea rcx, str._E____s_____ConvertSidToStringSid_failed_gle_lu__n
call fcn.3bc1c1292
mov qword [rbx + 0x18], 0
jmp 0x3bc1c3b9e
cmp edi, 0x94
je 0x3bc1c3c8f
cmp edi, 0x94
jbe 0x3bc1c3c39
cmp edi, 0xb7
je 0x3bc1c3cab
cmp edi, 0x80070005
je 0x3bc1c3cb2
cmp edi, 0xaa
je 0x3bc1c3c5e
mov edi, 0x40000001
jmp case.0x3bc1c39d2.0
cmp edi, 0x7f
ja 0x3bc1c3c4f
cmp edi, 0x7e
jae 0x3bc1c3c96
cmp edi, 0x50
jne 0x3bc1c3c9d
mov edi, 0x40000007
jmp case.0x3bc1c39d2.0
cmp edi, 0x91
jne 0x3bc1c3ca4
mov edi, 0x4000000d
jmp case.0x3bc1c39d2.0
mov edi, 0x4000000d
jmp case.0x3bc1c39d2.0
mov edi, 0x40000003
jmp case.0x3bc1c39d2.0
mov edi, 0x40000009
jmp case.0x3bc1c39d2.0
mov edi, 0x4000000d
jmp case.0x3bc1c39d2.0
mov edi, 0x40000001
jmp case.0x3bc1c39d2.0
mov edi, 0x40000001
jmp case.0x3bc1c39d2.0
mov edi, 0x40000008
jmp case.0x3bc1c39d2.0
mov edi, 0x4000000d
jmp case.0x3bc1c39d2.0
mov edi, 0x40000003
jmp case.0x3bc1c39d2.0
mov edi, 0x40000001
jmp case.0x3bc1c39d2.0
mov edi, 0x40000001
jmp case.0x3bc1c39d2.0
mov edi, 0x40000007
jmp case.0x3bc1c39d2.0
mov edi, 0x40000009
jmp case.0x3bc1c39d2.0
mov edi, 0x40000002
add r13d, 1
mov eax, dword [rsp + 0x54]
cmp r13d, eax
jae 0x3bc1c3d87
test edi, edi
jne 0x3bc1c3d87
movsxd rax, r13d
mov rsi, qword [rsp + 0x48]
lea rcx, [rsi + rax]
lea rdx, [rcx*8]
sub rdx, rcx
mov rsi, qword [rsp + 0x40]
lea rbx, [rsi + rdx*8]
lea rdx, [rax + rax*8]
lea rsi, [rax + rdx*2]
shl rsi, 3
add rsi, qword [rsp + 0x68]
mov rcx, qword [rsi]
call sub.msvcrt.dll_wcslen
mov r12, rax
lea r14, [rax + 1]
lea r15, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x3bc1c38c3
cmp qword [rbx], 0
je 0x3bc1c38de
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], rax
test rax, rax
jne 0x3bc1c38e3
mov r8, r14
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
jmp 0x3bc1c38e3
add dword [0x3bc1dd248], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x3bc1c3d9c
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
sete al
cmp ebp, 0xea
sete dl
test al, al
je 0x3bc1c3ed7
test dl, dl
je 0x3bc1c3ed7
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x68]
mov r8d, 2
mov edx, 2
mov ecx, 0
call sub.NETAPI32.dll_NetUserEnum
mov ebp, eax
test eax, eax
sete al
cmp ebp, 0xea
sete dl
or al, dl
je 0x3bc1c3d8d
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x3bc1c3d8d
add eax, dword [0x3bc1dd248]
lea rbx, [rax*8]
sub rbx, rax
shl rbx, 3
shl ebx, 3
shl ebx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x3bc1c38a3
mov rbx, qword [0x3bc1dd250]
test rbx, rbx
je 0x3bc1c3eb5
mov eax, dword [0x3bc1dd248]
lea r8, [rax*8]
sub r8, rax
shl r8, 3
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x40]
mov qword [0x3bc1dd250], rax
add eax, 0x1938f
add eax, 0x1938f
mov eax, dword [0x3bc1dd248]
mov qword [rsp + 0x48], rax
add byte [rax - 0x77], cl
and al, 0x48
mov r13d, 0
add byte [rax], al
jmp 0x3bc1c3cc2
test ebp, ebp
setne dl
xchg ebp, eax
ret 0xd084
jne 0x3bc1c3f1d
xchg ebp, eax
ret 0xd084
test edi, edi
je 0x3bc1c402a
call fcn.3bc1c379f
mov r8d, edi
and r8d, 0x3fffffff
lea rdx, str.users_sync
lea rcx, [0x3bc1d4fce]
call fcn.3bc1c1292
mov eax, edi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, ebp
lea rdx, str.users_sync
lea rcx, str._E____s_____NetUserEnum_failed_enum_err_08lx__n
call fcn.3bc1c1292
cmp ebp, 0x20
ja 0x3bc1c3f57
ja case.0x3bc1c3f4e.1
mov eax, ebp
lea rdx, [0x3bc1d5354]
movsxd rax, dword [rdx + rax*4]
invalid
add rax, rdx
jmp rax
invalid
mov edi, 0x40000008
jmp 0x3bc1c3ee8
jmp 0x3bc1c3ee8
cmp ebp, 0x94
je 0x3bc1c3fec
invalid
mov dword [rax], eax
add byte [rax], al
test byte [rcx + 0x77000000], cl
xor eax, dword [rbx + 0x1c777ffd]
ja 0x3bc1c3f98
cmp ebp, 0x7f
ja 0x3bc1c3f86
cmp ebp, 0x7e
jae 0x3bc1c3ff6
cmp ebp, 0x50
jne 0x3bc1c4000
mov edi, 0x40000007
jmp 0x3bc1c3ee8
cmp ebp, 0x91
jne 0x3bc1c400a
mov edi, 0x4000000d
jmp 0x3bc1c3ee8
cmp ebp, 0xb7
je 0x3bc1c4014
cmp ebp, 0x80070005
je 0x3bc1c401e
invalid
cmp ebp, 0xaa
je 0x3bc1c3fba
mov edi, 0x40000001
jmp 0x3bc1c3ee8
mov edi, 0x4000000d
jmp 0x3bc1c3ee8
mov edi, 0x4000000d
jmp 0x3bc1c3ee8
mov edi, 0x40000009
jmp 0x3bc1c3ee8
mov edi, 0x40000003
jmp 0x3bc1c3ee8
mov edi, 0x40000001
jmp 0x3bc1c3ee8
mov edi, 0x4000000d
jmp 0x3bc1c3ee8
mov edi, 0x40000003
jmp 0x3bc1c3ee8
mov edi, 0x40000001
jmp 0x3bc1c3ee8
mov edi, 0x40000001
jmp 0x3bc1c3ee8
mov edi, 0x40000007
jmp 0x3bc1c3ee8
mov edi, 0x40000009
jmp 0x3bc1c3ee8
mov edi, ebp
mov r8d, dword [0x3bc1dd248]
lea rdx, str.users_sync
lea rcx, str._I____s_____Done_sam_user_num_u__n
call fcn.3bc1c1292
jmp 0x3bc1c3f0a