Function at 0x100db49
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x101d774]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x240], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x40
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x234], ecx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x100db8e
push 0x89a
call fcn.0101004c
push ebx
push esi
push edi
push 0
push 0x202
mov ebx, 0x1020c10
push ebx
call fcn.01004ce1
mov esi, dword [0x101c378]
push 0x1d
xor eax, eax
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x40], 0xffffffff
mov eax, dword [ebp - 0x244]
xor edi, edi
inc edi
cmp dword [ebp - 0x234], 0
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], 0x10015f8
mov dword [esi + 0x54], 0x101d7e4
mov dword [esi + 0x64], 0x201
mov dword [esi], eax
jne 0x100dbef
and dword [esi + 4], 0
jmp 0x100dc63
push dword [ebp - 0x234]
push 0x10019e8
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x100dc1e
push edi
push eax
push 0x1106
push edi
push 0x100
push ebx
call fcn.0101009c
mov dword [esi + 4], ebx
jmp 0x100dc63
push dword [ebp - 0x234]
call fcn.01012082
test ax, ax
je 0x100dc37
movzx eax, ax
push eax
call fcn.0101004c
mov eax, dword [ebp - 0x234]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0xe
pop ecx
jbe 0x100dc63
push edi
push 0x14a0
call fcn.01010064
test eax, eax
jne 0x100dc63
push 2
call fcn.0100fb27
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
push edi
push esi
call fcn.0100d619
cmp dword [ebp - 0x234], 0
jne 0x100dc99
cmp dword [ebp - 0x240], 0
je 0x100dc99
push dword [ebp - 0x240]
push ebx
call fcn.0100c73b
mov dword [esi + 4], ebx
cmp dword [ebp - 0x238], edi
jne 0x100dcbd
push 0
push edi
push 0x10015f8
push esi
call fcn.0100f146
test eax, eax
je 0x100dcbd
push 0xf7f
call fcn.0101004c
push edi
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x105
lea eax, [ebp - 0x230]
push eax
call fcn.0100e833
test eax, eax
je 0x100dcdf
push eax
call fcn.0101004c
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x23c], eax
mov eax, dword [0x101c378]
mov eax, dword [eax + 0x48]
test eax, eax
pop ecx
je 0x100dd0f
push edi
push 0xa8
push eax
call fcn.01014d05
test al, al
je 0x100dd39
push 0
push dword [0x101c378]
lea eax, [ebp - 0x230]
push 3
push eax
call sub.NETAPI32.dll_NetUserAdd
test eax, eax
mov dword [ebp - 0x248], eax
je 0x100dd5c
cmp eax, 0x35
je 0x100dd40
cmp eax, 0x57
jne 0x100dd51
push 0xeba
jmp 0x100dd57
lea eax, [ebp - 0x230]
push eax
push 0xe81
call fcn.0100ff1c
push dword [ebp - 0x248]
call fcn.0101004c
call fcn.01007aa3
cmp eax, edi
jne 0x100dd96
cmp dword [ebp - 0x23c], 0
jne 0x100dd96
push dword [esi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0100c60a
test eax, eax
je 0x100dd96
push 0
push eax
call fcn.0100fa67
push 0xebe
call fcn.0101004c
cmp dword [ebp - 0x238], edi
jne 0x100de3c
call fcn.01007aa3
test eax, eax
jne 0x100ddb4
call fcn.01007ac3
test eax, eax
je 0x100ddc6
cmp dword [ebp - 0x23c], 0
ja 0x100ddc6
and dword [ebp - 0x23c], 0
jmp 0x100ddcc
mov dword [ebp - 0x23c], edi
lea eax, [ebp - 0x238]
push eax
push 3
push dword [ebp - 0x244]
lea eax, [ebp - 0x230]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
mov edi, 0xf7d
je 0x100ddf6
push edi
call fcn.0101004c
push dword [ebp - 0x23c]
push 0
push dword [esi + 4]
push dword [ebp - 0x238]
call fcn.0100f146
test eax, eax
je 0x100de16
push edi
call fcn.0101004c
push 0
push dword [ebp - 0x238]
lea eax, [ebp - 0x230]
push 3
push dword [ebp - 0x244]
push eax
call sub.NETAPI32.dll_NetUserSetInfo
test eax, eax
je 0x100de3c
push edi
call fcn.0101004c
cmp dword [ebp - 0x234], 0
jne 0x100de6b
cmp dword [ebp - 0x240], 0
je 0x100de6b
mov eax, dword [ebp - 0x244]
push 2
push 0xf80
mov dword [0x1020840], eax
mov dword [0x1020844], ebx
call fcn.0100fff0
call fcn.0100ffba
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100f4dc
leave
ret 8