Function at 0x1400a0194
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and dword [rbp - 0x40], 0
mov rdi, rcx
lea rcx, str.hid_E___R__dbrtjj1ODn8J
mov r13d, r9d
mov esi, r8d
mov r15, rdx
mov ebx, 0xc0000062
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__vWuLUq9jI8d7
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__cq3a1PmBBHR0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test r15, r15
jne 0x1400a01fc
test esi, esi
je 0x1400a03c9
xor r9d, r9d
lea rdx, [rbp - 0x30]
mov rcx, rdi
lea r8d, [r9 + 0x31]
call qword [sym.imp.SAMLIB.dll_SamConnect]
mov ebx, eax
test eax, eax
js 0x1400a03c9
mov rcx, qword [rbp - 0x30]
lea rax, [rbp + 0x38]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x40]
call qword [sym.imp.SAMLIB.dll_SamEnumerateDomainsInSamServer]
mov r12d, eax
test eax, eax
js 0x1400a03b2
xor edi, edi
cmp dword [rbp + 0x38], edi
jbe 0x1400a03a8
mov rcx, qword [rbp - 0x38]
lea r14, [rdi + rdi*2]
mov r8b, 1
lea rdx, [0x1400f9250]
lea rcx, [rcx + r14*8]
add rcx, 8
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
jne 0x1400a039d
mov rdx, qword [rbp - 0x38]
lea rcx, str.Domain_name__:__wZ_n
add rdx, 8
lea rdx, [rdx + r14*8]
call fcn.14000b314
mov rdx, qword [rbp - 0x38]
lea r8, [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
add rdx, 8
lea rdx, [rdx + r14*8]
call qword [sym.imp.SAMLIB.dll_SamLookupDomainInSamServer]
mov ebx, eax
test eax, eax
js 0x1400a039d
lea rcx, str.Domain_SID___:
call fcn.14000b314
mov rcx, qword [rbp - 0x20]
call fcn.140011780
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
mov r8, qword [rbp - 0x20]
lea r9, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov edx, 0x200
call qword [sym.imp.SAMLIB.dll_SamOpenDomain]
mov ebx, eax
test eax, eax
js 0x1400a0393
test r15, r15
je 0x1400a0346
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x10]
and qword [rbp - 0x18], 0
lea r9, [rbp - 0x18]
and qword [rbp - 0x10], 0
mov r8, r15
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SAMLIB.dll_SamLookupNamesInDomain]
mov ebx, eax
test eax, eax
js 0x1400a0346
mov rcx, qword [rbp - 0x18]
mov esi, dword [rcx]
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400a0346
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
test esi, esi
je 0x1400a0389
mov edx, esi
lea rcx, str.User_RID_____:__u_n
call fcn.14000b314
mov rcx, qword [rbp - 0x28]
lea r9, [rbp - 8]
mov r8d, esi
mov edx, r13d
call qword [sym.imp.SAMLIB.dll_SamOpenUser]
mov ebx, eax
test eax, eax
js 0x1400a0389
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp - 8]
call qword [rbp + 0x50]
mov rcx, qword [rbp - 8]
mov ebx, eax
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
inc edi
cmp edi, dword [rbp + 0x38]
jb 0x1400a0251
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
cmp r12d, 0x105
je 0x1400a021a
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret