Function at 0x180040d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r15d, r15d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x50], r15
lea rax, str.MinimumPasswordAge
mov qword [rsp + 0x60], rax
lea rax, str.MaximumPasswordAge
mov qword [rsp + 0x70], rax
lea rax, str.MinimumPasswordLength
mov qword [rbp - 0x80], rax
lea rax, str.PasswordComplexity
mov qword [rbp - 0x70], rax
lea rax, str.PasswordHistorySize
mov qword [rbp - 0x60], rax
lea rax, str.LockoutBadCount
mov qword [rbp - 0x50], rax
lea rax, str.ResetLockoutCount
mov qword [rbp - 0x40], rax
lea rax, str.LockoutDuration
mov qword [rbp - 0x30], rax
lea rax, str.AllowAdministratorLockout
mov qword [rbp - 0x20], rax
lea rax, str.RequireLogonToChangePassword
mov qword [rbp - 0x10], rax
lea rax, str.ForceLogoffWhenHourExpire
mov qword [rbp], rax
lea rax, str.ClearTextPassword
mov qword [rbp + 0x10], rax
lea rax, str.LSAAnonymousNameLookup
mov qword [rbp + 0x20], rax
lea rax, str.EnableAdminAccount
mov qword [rbp + 0x30], rax
lea rax, str.EnableGuestAccount
mov qword [rbp + 0x40], rax
mov rbx, r9
mov byte [rsp + 0x6c], 0x44
mov rsi, r8
mov dword [rsp + 0x78], 8
mov r14d, edx
mov byte [rsp + 0x7c], 0x44
mov dword [rbp - 0x78], 0xc
mov byte [rbp - 0x74], 0x44
mov dword [rbp - 0x68], 0x10
mov byte [rbp - 0x64], 0x44
mov dword [rbp - 0x58], 0x14
mov byte [rbp - 0x54], 0x44
mov dword [rbp - 0x48], 0x18
mov byte [rbp - 0x44], 0x44
mov dword [rbp - 0x38], 0x1c
mov byte [rbp - 0x34], 0x44
mov dword [rbp - 0x28], 0x20
mov byte [rbp - 0x24], 0x44
mov dword [rbp - 0x18], 0x24
mov byte [rbp - 0x14], 0x44
mov dword [rbp - 8], 0x28
mov byte [rbp - 4], 0x44
mov dword [rbp + 8], 0x2c
mov byte [rbp + 0xc], 0x44
mov dword [rbp + 0x18], 0x44
mov byte [rbp + 0x1c], 0x44
mov dword [rbp + 0x28], 0x48
mov byte [rbp + 0x2c], 0x44
mov dword [rbp + 0x38], 0xf8
mov byte [rbp + 0x3c], 0x44
mov dword [rbp + 0x48], 0xfc
mov byte [rbp + 0x4c], 0x44
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], r15
test r8, r8
jne 0x180040f1f
lea eax, [r8 + 1]
jmp 0x18004105b
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
lea rdx, [0x18007de48]
mov r9d, 0xf
mov dword [rsp + 0x20], r14d
call fcn.180042da0
test eax, eax
jne 0x18004105b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.NewAdministratorName
mov edx, r14d
call fcn.180041614
mov edi, eax
test eax, 0xfffffffd
je 0x180040fa7
lea r9, str.NewAdministratorName
mov r8d, 0x44d6
mov rdx, rbx
mov ecx, 0x1e
call fcn.18000dc90
mov rbx, qword [rsp + 0x40]
jmp 0x180041036
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180040fd2
cmp word [rcx], r15w
je 0x180040fbd
mov qword [rsi + 0x30], rcx
jmp 0x180040fcd
mov qword [rsi + 0x30], r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [rsp + 0x40], r15
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.NewGuestName
mov edx, r14d
call fcn.180041614
mov edi, eax
test eax, 0xfffffffd
je 0x180041007
lea r9, str.NewGuestName
jmp 0x180040f8a
mov rbx, qword [rsp + 0x40]
mov edi, r15d
test rbx, rbx
je 0x180041036
cmp word [rbx], r15w
je 0x180041020
mov qword [rsi + 0x38], rbx
jmp 0x180041033
mov rcx, rbx
mov qword [rsi + 0x38], r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rbx, r15
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.18004cd24
test rbx, rbx
je 0x180041059
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180002a90
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret