Function at 0x100d3a00
Capabilities:
Change user account password
Get user security identifier
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014fc89
mov eax, dword fs:[0]
push eax
mov eax, 0x164c
call fcn.10116b00
mov eax, dword [0x1019a128]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14c0], esi
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
mov dword [ebp - 0x14b8], 0
mov dword [ebp - 0x1414], 0
mov dword [ebp - 0x141c], 0
mov dword [ebp - 0x1418], 0
call fcn.100c96b0
mov eax, dword [esi]
add esp, 4
mov edi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 4], eax
nop dword [eax + eax]
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x1414]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x14b8]
push eax
push 0
push 3
push 0
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov ebx, eax
mov dword [ebp - 0x14d0], ebx
test ebx, ebx
je 0x100d3ac2
cmp ebx, 0xea
jne 0x100d4236
lea ecx, [ebp - 0x14b4]
call fcn.100d3590
mov ecx, dword [ebp - 0x14c0]
mov eax, 0x8d3dcb09
mov dword [ebp - 4], 1
mov esi, dword [esi]
mov ebx, dword [ebp - 0x1414]
mov ecx, dword [ecx + 4]
sub ecx, esi
imul ecx
mov eax, dword [ebp - 0x14c0]
add edx, ecx
sar edx, 6
mov edi, edx
mov ecx, dword [eax + 8]
mov eax, 0x8d3dcb09
shr edi, 0x1f
sub ecx, esi
add edi, edx
imul ecx
add edi, ebx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x100d3b40
cmp edi, 0x234f72c
ja 0x100d4290
mov esi, dword [ebp - 0x14c0]
mov ecx, esi
push edi
call fcn.100ca020
mov ebx, dword [ebp - 0x1414]
jmp 0x100d3b46
mov esi, dword [ebp - 0x14c0]
mov edi, dword [ebp - 0x14b8]
mov dword [ebp - 0x14c8], edi
mov dword [ebp - 0x14cc], 0
test ebx, ebx
je 0x100d416a
test edi, edi
je 0x100d4189
mov esi, dword [edi]
test esi, esi
jne 0x100d3bb8
push str.GetLocalUsers
lea edx, [esi + 8]
lea ecx, [ebp - 0x15b0]
call fcn.1000aed0
add esp, 4
mov byte [ebp - 4], 3
cmp byte [eax + 0x48], 0
je 0x100d3b9e
mov edx, str.name_is_nullptr
mov ecx, eax
call fcn.10020800
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 1
call fcn.1000ad70
mov esi, dword [ebp - 0x14c0]
jmp 0x100d4142
mov ax, word [0x10168c44]
push 0xffe
mov word [ebp - 0x1410], ax
lea eax, [ebp - 0x140e]
push 0
push eax
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x1424], 0x400
call fcn.10117ff0
add esp, 0xc
mov dword [ebp - 0x1420], 0x800
lea eax, [ebp - 0x149c]
push eax
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100d3ca8
push str.GetLocalUsers
lea edx, [eax + 4]
lea ecx, [ebp - 0x15b0]
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 4
mov al, byte [esi + 0x48]
test al, al
je 0x100d3c7a
mov edx, str.LookupAccountName_for
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d3c7a
mov edx, dword [edi]
mov ecx, esi
call fcn.100205a0
cmp byte [esi + 0x48], 0
je 0x100d3c7a
mov edx, str._failed_err
mov ecx, esi
call fcn.10020800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x48], 0
je 0x100d3c8e
push eax
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 1
call fcn.1000ad70
mov esi, dword [ebp - 0x14c0]
jmp 0x100d4142
lea eax, [ebp - 0x14bc]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x100d3d3f
push str.GetLocalUsers
lea edx, [eax + 4]
lea ecx, [ebp - 0x15b0]
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 5
mov al, byte [esi + 0x48]
test al, al
je 0x100d3d11
mov edx, str.ConvertSidToStringSid_for
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d3d11
mov edx, dword [edi]
mov ecx, esi
call fcn.100205a0
cmp byte [esi + 0x48], 0
je 0x100d3d11
mov edx, str._failed_err
mov ecx, esi
call fcn.10020800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x48], 0
je 0x100d3d25
push eax
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 1
call fcn.1000ad70
mov esi, dword [ebp - 0x14c0]
jmp 0x100d4142
cmp dword [ebp - 0x14bc], 0
jne 0x100d3d90
push str.GetLocalUsers
mov edx, 8
lea ecx, [ebp - 0x15b0]
call fcn.1000aed0
add esp, 4
mov byte [ebp - 4], 6
cmp byte [eax + 0x48], 0
je 0x100d3d76
mov edx, str.ConvertSidToStringSid_return_nullptr
mov ecx, eax
call fcn.100205a0
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 1
call fcn.1000ad70
mov esi, dword [ebp - 0x14c0]
jmp 0x100d4142
xor eax, eax
mov dword [ebp - 0x1498], 0
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], 7
mov word [ebp - 0x1498], ax
mov dword [ebp - 0x1480], eax
mov dword [ebp - 0x1470], eax
mov dword [ebp - 0x146c], 7
mov word [ebp - 0x1480], ax
mov byte [ebp - 4], 8
push 0x14
mov byte [ebp - 0x1466], al
mov dword [ebp - 0x1464], eax
mov dword [ebp - 0x1460], eax
call fcn.101157fb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x1464], eax
mov byte [ebp - 0x1428], 0
mov byte [ebp - 4], 9
mov edx, dword [edi]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d3e20
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1498]
call fcn.10002060
mov edx, dword [ebp - 0x14bc]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100d3e47
sub eax, esi
lea ecx, [ebp - 0x1480]
sar eax, 1
push eax
push edx
call fcn.10002060
mov eax, dword [edi + 0x18]
shr eax, 1
not al
and al, 1
mov byte [ebp - 0x1468], al
je 0x100d402a
cmp dword [ebp - 0x14a0], 8
lea ebx, [ebp - 0x14b4]
mov esi, dword [edi]
mov ecx, str.WDAGUtilityAccount
cmovae ebx, dword [ebp - 0x14b4]
mov eax, esi
mov dword [ebp - 0x14d4], esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100d3ec6
test dx, dx
je 0x100d3ec2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100d3ec6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100d3ea0
xor eax, eax
jmp 0x100d3ecb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100d3f24
push str.HasEmptyPassword
lea edx, [eax + 0x10]
lea ecx, [ebp - 0x15b0]
call fcn.1000aed0
add esp, 4
mov byte [ebp - 4], 0xa
cmp byte [eax + 0x48], 0
je 0x100d3efb
mov edx, str.skip_check_empty_password_for_WDAGUtilityAccount_account
mov ecx, eax
call fcn.100205a0
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 9
call fcn.1000ad70
mov al, 1
mov byte [ebp - 0x14c2], al
mov byte [ebp - 0x14c1], al
movzx eax, word [ebp - 0x14c2]
jmp 0x100d4038
push 0x10168c44
push 0x10168c44
push esi
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserChangePassword]
push str.HasEmptyPassword
mov edx, 0x10
lea ecx, [ebp - 0x1658]
mov edi, eax
call fcn.1000aed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xb
mov al, byte [esi + 0x48]
test al, al
je 0x100d3f6c
mov edx, 0x101749f8
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test ebx, ebx
mov edx, str.nullptr
cmovne edx, ebx
test al, al
je 0x100d3f97
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d3f97
mov edx, 0x101749f4
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
mov ecx, dword [ebp - 0x14d4]
mov edx, str.nullptr
test ecx, ecx
cmovne edx, ecx
test al, al
je 0x100d3fd4
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d3fd4
mov edx, str._err
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d3fd4
push edi
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x1658]
mov byte [ebp - 4], 9
call fcn.1000ad70
test edi, edi
je 0x100d400c
cmp edi, 0x8c5
je 0x100d400c
mov edi, dword [ebp - 0x14c8]
mov al, 1
mov byte [ebp - 0x14c2], al
mov byte [ebp - 0x14c1], al
movzx eax, word [ebp - 0x14c2]
jmp 0x100d4038
mov edi, dword [ebp - 0x14c8]
xor al, al
mov byte [ebp - 0x14c2], al
mov byte [ebp - 0x14c1], 1
movzx eax, word [ebp - 0x14c2]
jmp 0x100d4038
mov byte [ebp - 0x14c3], 0
movzx eax, word [ebp - 0x14c4]
mov edx, dword [edi]
lea ecx, [ebp - 0x1508]
mov word [ebp - 0x1467], ax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x145c], eax
call fcn.100d36c0
cmp byte [eax + 0x30], 0
je 0x100d4080
cmp byte [ebp - 0x1428], 0
lea ecx, [ebp - 0x1458]
push eax
je 0x100d4072
call fcn.100be230
jmp 0x100d40a6
call fcn.100b30a0
mov byte [ebp - 0x1428], 1
jmp 0x100d40a6
cmp byte [ebp - 0x1428], 0
je 0x100d40a6
lea ecx, [ebp - 0x1440]
call fcn.10002400
lea ecx, [ebp - 0x1458]
call fcn.10002400
mov byte [ebp - 0x1428], 0
cmp byte [ebp - 0x14d8], 0
je 0x100d40c5
lea ecx, [ebp - 0x14f0]
call fcn.10002400
lea ecx, [ebp - 0x1508]
call fcn.10002400
mov esi, dword [ebp - 0x14c0]
lea ecx, [ebp - 0x1498]
push ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x100d40e7
mov ecx, eax
call fcn.100cac20
add dword [esi + 4], 0x74
jmp 0x100d40ef
push eax
mov ecx, esi
call fcn.100d5350
push dword [ebp - 0x14bc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 1
cmp byte [ebp - 0x1428], 0
je 0x100d411e
lea ecx, [ebp - 0x1440]
call fcn.10002400
lea ecx, [ebp - 0x1458]
call fcn.10002400
lea eax, [ebp - 0x1464]
push eax
mov ecx, eax
call fcn.100c9660
lea ecx, [ebp - 0x1480]
call fcn.10002400
lea ecx, [ebp - 0x1498]
call fcn.10002400
mov eax, dword [ebp - 0x14cc]
add edi, 0x74
inc eax
mov dword [ebp - 0x14c8], edi
mov dword [ebp - 0x14cc], eax
cmp eax, dword [ebp - 0x1414]
jb 0x100d3b64
mov edi, dword [ebp - 0x14b8]
mov ebx, dword [ebp - 0x14d0]
test edi, edi
je 0x100d41cf
push edi
mov edi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
call edi
mov dword [ebp - 0x14b8], 0
jmp 0x100d41d5
push str.GetLocalUsers
mov edx, 4
lea ecx, [ebp - 0x1658]
call fcn.1000aed0
add esp, 4
mov byte [ebp - 4], 2
cmp byte [eax + 0x48], 0
je 0x100d41b7
mov edx, str.Unexpected_nullptr_for_an_entry
mov ecx, eax
call fcn.10020800
lea ecx, [ebp - 0x1658]
call fcn.1000ad70
mov edi, dword [ebp - 0x14b8]
mov ebx, 0x1f
jmp 0x100d4170
mov edi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x14b4]
mov dword [ebp - 4], 0xffffffff
call fcn.10002400
cmp ebx, 0xea
je 0x100d3a80
mov eax, dword [ebp - 0x14b8]
test eax, eax
je 0x100d420a
push eax
call edi
mov dword [ebp - 0x14b8], 0
mov ecx, dword [ebp - 0x14c0]
call fcn.100d3070
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101157bc
mov esp, ebp
pop ebp
ret
push str.GetLocalUsers
mov edx, 4
lea ecx, [ebp - 0x1658]
call fcn.1000aed0
add esp, 4
mov esi, eax
mov dword [ebp - 4], 0
mov al, byte [esi + 0x48]
test al, al
je 0x100d4279
mov edx, str.NetUserEnum_err
mov ecx, esi
call fcn.100205a0
mov al, byte [esi + 0x48]
test al, al
je 0x100d4279
push ebx
mov ecx, esi
call fcn.100201d0
lea ecx, [ebp - 0x1658]
mov dword [ebp - 4], 0xffffffff
call fcn.1000ad70
jmp 0x100d41f3
call fcn.1001ca70
int3