Function at 0x180001e38
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov rsi, rax
test rax, rax
je 0x180002193
lea rdx, [0x18000c398]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18000c3a8]
mov rcx, rsi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18000c3b8]
mov rcx, rsi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenEventA
mov rcx, rsi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18000c3d8]
mov rcx, rsi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18000c3e8]
mov rcx, rsi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18000c3f8]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
cmp qword [rbx], rdi
je 0x180002183
cmp qword [rbx + 8], rdi
je 0x180002183
cmp qword [rbx + 0x10], rdi
je 0x180002183
cmp qword [rbx + 0x18], rdi
je 0x180002183
cmp qword [rbx + 0x20], rdi
je 0x180002183
cmp qword [rbx + 0x28], rdi
je 0x180002183
test rax, rax
je 0x180002183
lea r13d, [rdi + 0xb]
lea rcx, [rbx + 0x38]
lea r8, str.samsrv.dll
mov r9d, r13d
mov edx, r13d
call fcn.180002abc
lea r12d, [rdi + 0xc]
lea rcx, [rbx + 0x43]
lea r8, str.SamIConnect
mov r9d, r12d
mov edx, r12d
call fcn.180002abc
lea edx, [rdi + 0xf]
lea rcx, [rbx + 0x4f]
lea r8, str.SamrOpenDomain
mov r9d, edx
call fcn.180002abc
lea r14d, [rdi + 0xd]
lea rcx, [rbx + 0x5e]
lea r8, str.SamrOpenUser
mov r9d, r14d
mov edx, r14d
call fcn.180002abc
lea edx, [rdi + 0x19]
lea rcx, [rbx + 0x6b]
lea r8, str.SamrQueryInformationUser
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 0x1b]
lea rcx, [rbx + 0x84]
lea r8, str.SamrEnumerateUsersInDomain
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 0x20]
lea rcx, [rbx + 0x9f]
lea r8, str.SamIFree_SAMPR_USER_INFO_BUFFER
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 0x22]
lea rcx, [rbx + 0xbf]
lea r8, str.SamIFree_SAMPR_ENUMERATION_BUFFER
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 0x10]
lea rcx, [rbx + 0xe1]
lea r8, str.SamrCloseHandle
mov r9d, edx
call fcn.180002abc
lea rcx, [rbx + 0xf1]
lea r8, str.advapi32.dll
mov r9d, r14d
mov edx, r14d
call fcn.180002abc
lea edx, [rdi + 0xe]
lea rcx, [rbx + 0xfe]
lea r8, str.LsaOpenPolicy
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 0x1a]
lea rcx, [rbx + 0x10c]
lea r8, str.LsaQueryInformationPolicy
mov r9d, edx
call fcn.180002abc
lea r15d, [rdi + 9]
lea rcx, [rbx + 0x126]
lea r8, str.LsaClose
mov r9d, r15d
mov edx, r15d
call fcn.180002abc
lea rcx, [rbx + 0x12f]
lea r8, str.msvcrt.dll
mov r9d, r13d
mov edx, r13d
call fcn.180002abc
lea r14d, [rdi + 7]
lea rcx, [rbx + 0x13a]
lea r8, str.malloc
mov r9d, r14d
mov edx, r14d
call fcn.180002abc
lea rcx, [rbx + 0x141]
lea edx, [rdi + 8]
lea r8, str.realloc
mov r9d, edx
call fcn.180002abc
lea edx, [rdi + 5]
lea rcx, [rbx + 0x149]
lea r8, str.free
mov r9d, edx
call fcn.180002abc
lea rcx, [rbx + 0x14e]
lea r8, str.memcpy
mov r9d, r14d
mov edx, r14d
call fcn.180002abc
lea edx, [rdi + 0xa]
lea rcx, [rbx + 0x155]
lea r8, str.ntdll.dll
mov r9d, edx
call fcn.180002abc
lea rcx, [rbx + 0x15f]
lea r8, str.wcstombs
mov r9d, r15d
mov edx, r15d
call fcn.180002abc
lea rcx, [rbx + 0x168]
lea r8, str.GlobalSAM
mov r9d, r13d
mov edx, r13d
call fcn.180002abc
lea rcx, [rbx + 0x173]
lea r8, str.GlobalFREE
mov r9d, r12d
mov edx, r12d
call fcn.180002abc
mov dword [rbx + 0x180], ebp
mov dword [rbx + 0x184], edi
mov qword [rbx + 0x188], rdi
jmp 0x180002188
mov edi, 0x57
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180002197
mov edi, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret