Function at 0x180001f50
Capabilities:
Check os version
Link many functions at runtime
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2c38
call fcn.1800c9710
sub rsp, rax
mov qword [rsp + 0x2b0], 0xfffffffffffffffe
mov dword [rsp + 0xc0], 0
mov ecx, 2
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x130], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0xac], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x1c0], 0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x1b8], 0
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0x1bc], 0
mov qword [rsp + 0xe0], 0
lea rcx, str.samsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
jne 0x1800020d3
lea rax, [0x1800e84d4]
mov qword [rsp + 0x1c8], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1c8]
call fcn.1800cb000
lea rdx, str.SamIConnect
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x190], rax
lea rdx, str.SamrOpenDomain
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x198], rax
lea rdx, str.SamrEnumerateUsersInDomain
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x160], rax
lea rdx, str.SamrOpenUser
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1a8], rax
lea rdx, str.SamrQueryInformationUser
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x168], rax
lea rdx, str.SamIFree_SAMPR_USER_INFO_BUFFER
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x170], rax
lea rdx, str.SamIFree_SAMPR_ENUMERATION_BUFFER
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x178], rax
lea rdx, str.SamrCloseHandle
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x190], 0
je 0x180002213
cmp qword [rsp + 0x198], 0
je 0x180002213
cmp qword [rsp + 0x160], 0
je 0x180002213
cmp qword [rsp + 0x1a8], 0
je 0x180002213
cmp qword [rsp + 0x168], 0
je 0x180002213
cmp qword [rsp + 0x170], 0
je 0x180002213
cmp qword [rsp + 0x178], 0
je 0x180002213
cmp qword [rsp + 0x118], 0
jne 0x180002236
lea rax, [0x1800e84d5]
mov qword [rsp + 0x1d0], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1d0]
call fcn.1800cb000
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x290], 0
mov dword [rsp + 0x298], 0
mov qword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], 0
mov dword [rsp + 0x280], 0x30
lea r9, [rsp + 0xd8]
mov r8d, 0xf0fff
lea rdx, [rsp + 0x280]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jge 0x1800022c0
lea rax, [0x1800e84d6]
mov qword [rsp + 0x1d8], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1d8]
call fcn.1800cb000
lea r8, [rsp + 0x110]
mov edx, 5
mov rcx, qword [rsp + 0xd8]
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
test eax, eax
jge 0x180002301
lea rax, [0x1800e84d7]
mov qword [rsp + 0x1e0], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1e0]
call fcn.1800cb000
mov byte [rsp + 0x70], 0
lea r8, [rsp + 0x130]
mov edx, 0xc
mov rcx, qword [rsp + 0xd8]
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
test eax, eax
jl 0x180002329
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x70]
test eax, eax
je 0x1800023aa
mov rax, qword [rsp + 0x130]
movzx eax, word [rax + 0x10]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x800
jbe 0x18000236f
lea rax, [0x1800e84f7]
mov qword [rsp + 0x1e8], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1e8]
call fcn.1800cb000
mov eax, dword [rsp + 0x74]
mov r8d, eax
mov rax, qword [rsp + 0x130]
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x3e0]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0x74]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0x3e0], cx
jmp 0x18000241f
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x800
jbe 0x1800023e6
lea rax, [0x1800e850e]
mov qword [rsp + 0x1f0], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1f0]
call fcn.1800cb000
mov eax, dword [rsp + 0x74]
mov r8d, eax
mov rax, qword [rsp + 0x110]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x3e0]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0x74]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0x3e0], cx
mov r9d, 1
mov r8d, 0xf003f
lea rdx, [rsp + 0x108]
xor ecx, ecx
call qword [rsp + 0x190]
mov dword [rsp + 0x144], eax
cmp dword [rsp + 0x144], 0
jge 0x180002470
lea rax, [0x1800e850f]
mov qword [rsp + 0x1f8], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x1f8]
call fcn.1800cb000
lea r9, [rsp + 0xc8]
mov rax, qword [rsp + 0x110]
mov r8, qword [rax + 0x10]
mov edx, 0xf07ff
mov rcx, qword [rsp + 0x108]
call qword [rsp + 0x198]
mov dword [rsp + 0x140], eax
cmp dword [rsp + 0x140], 0
jge 0x1800024cc
lea rax, [0x1800e851c]
mov qword [rsp + 0x200], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x200]
call fcn.1800cb000
mov r8d, 0x114
xor edx, edx
lea rcx, [rsp + 0x2c0]
call fcn.1800cae70
mov dword [rsp + 0x2c0], 0x114
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x2c4], 6
jne 0x180002513
cmp dword [rsp + 0x2c8], 1
jne 0x180002513
call fcn.1800015e0
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0xbc], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffff
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0xc8]
call qword [rsp + 0x160]
mov dword [rsp + 0x13c], eax
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1800025a2
lea rax, [0x1800e851d]
mov qword [rsp + 0x208], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x208]
call fcn.1800cb000
cmp dword [rsp + 0x88], 0
jne 0x1800025ae
jmp 0x1800025f3
mov eax, dword [rsp + 0x88]
mov ecx, dword [rsp + 0xbc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc], eax
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x178]
mov qword [rsp + 0xa0], 0
cmp dword [rsp + 0x98], 0x105
je 0x180002529
mov edx, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x2c48]
call fcn.180001a60
mov dword [rsp + 0x138], eax
cmp dword [rsp + 0x138], 0
jne 0x18000263b
lea rax, [0x1800e851e]
mov qword [rsp + 0x210], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x210]
call fcn.1800cb000
mov ecx, 0x148
call fcn.1800c96b8
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x1a0], rax
cmp qword [rsp + 0x1a0], 0
je 0x1800026a2
mov r9b, 1
mov r8, qword [rsp + 0x2c50]
mov rdx, qword [rsp + 0x2c40]
mov rcx, qword [rsp + 0x1a0]
call fcn.180003fb0
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x188], rax
jmp 0x1800026ae
mov qword [rsp + 0x188], 0
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0xe0], rax
lea rdx, [rsp + 0x3e0]
mov rcx, qword [rsp + 0xe0]
call fcn.180001aa0
mov dword [rsp + 0x154], eax
cmp dword [rsp + 0x154], 0
jne 0x180002717
lea rax, [0x1800e851f]
mov qword [rsp + 0x230], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x230]
call fcn.1800cb000
mov dword [rsp + 0xa8], 0
lea rcx, str.Getting_more_users_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffff
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0xc8]
call qword [rsp + 0x160]
mov dword [rsp + 0x148], eax
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1800027a8
lea rax, [0x1800e852f]
mov qword [rsp + 0x238], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x238]
call fcn.1800cb000
cmp dword [rsp + 0x88], 0
jne 0x1800027b7
jmp 0x180002db6
mov dword [rsp + 0x78], 0
jmp 0x1800027cb
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x78], eax
jae 0x180002d8a
mov eax, dword [rsp + 0x78]
imul rax, rax, 0x18
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 8]
movzx eax, word [rcx + rax + 8]
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 0x800
jbe 0x18000280b
jmp 0x1800027c1
mov eax, dword [rsp + 0x78]
imul rax, rax, 0x18
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0xf0]
mov r8d, dword [rcx + rax]
mov edx, 0xf07ff
mov rcx, qword [rsp + 0xc8]
call qword [rsp + 0x1a8]
mov dword [rsp + 0x14c], eax
cmp dword [rsp + 0x14c], 0
jge 0x180002873
lea rax, [0x1800e854b]
mov qword [rsp + 0x240], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x240]
call fcn.1800cb000
lea r8, [rsp + 0xd0]
mov edx, 0x12
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x168]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
jge 0x1800028c3
lea rax, [0x1800e854c]
mov qword [rsp + 0x248], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x248]
call fcn.1800cb000
lea r8, [rsp + 0x80]
mov edx, 5
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x168]
mov dword [rsp + 0x158], eax
cmp dword [rsp + 0x158], 0
jge 0x180002913
lea rax, [0x1800e854d]
mov qword [rsp + 0x250], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x250]
call fcn.1800cb000
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0x78]
imul rcx, rcx, 0x18
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 8]
mov r8d, eax
mov rdx, qword [rdx + rcx + 0x10]
lea rcx, [rsp + 0x2420]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0xac]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0x2420], cx
mov eax, dword [rsp + 0x78]
imul rax, rax, 0x18
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0xac]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xbc]
and eax, 0x400
test eax, eax
je 0x1800029b8
mov dword [rsp + 0xf8], 1
jmp 0x1800029c3
mov dword [rsp + 0xf8], 0
movzx eax, byte [rsp + 0xf8]
mov byte [rsp + 0x7f], al
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xbc]
and eax, 1
test eax, eax
je 0x1800029f1
mov dword [rsp + 0xfc], 1
jmp 0x1800029fc
mov dword [rsp + 0xfc], 0
movzx eax, byte [rsp + 0xfc]
mov byte [rsp + 0x7e], al
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xbc]
and eax, 0x200
test eax, eax
je 0x180002a2c
mov dword [rsp + 0x100], 1
jmp 0x180002a37
mov dword [rsp + 0x100], 0
movzx eax, byte [rsp + 0x100]
mov byte [rsp + 0x7d], al
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xbc]
and eax, 0x20000
test eax, eax
je 0x180002a67
mov dword [rsp + 0xe8], 1
jmp 0x180002a72
mov dword [rsp + 0xe8], 0
movzx eax, byte [rsp + 0xe8]
mov byte [rsp + 0x7c], al
mov rax, qword [rsp + 0x80]
movzx eax, word [rax + 0x10]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0x800
ja 0x180002adf
mov eax, dword [rsp + 0xb0]
mov r8d, eax
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x1c10]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0x1c10], cx
jmp 0x180002af2
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x1c10], cx
mov rax, qword [rsp + 0x80]
movzx eax, word [rax + 0x68]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0x800
ja 0x180002b53
mov eax, dword [rsp + 0xb4]
mov r8d, eax
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax + 0x70]
lea rcx, [rsp + 0x1400]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0xb4]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0x1400], cx
jmp 0x180002b66
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x1400], cx
mov rax, qword [rsp + 0x80]
movzx eax, word [rax + 0x28]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0x800
ja 0x180002bc7
mov eax, dword [rsp + 0xb8]
mov r8d, eax
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0xbf0]
call fcn.1800caa00
xor edx, edx
mov eax, dword [rsp + 0xb8]
mov ecx, 2
div ecx
mov eax, eax
xor ecx, ecx
mov word [rsp + rax*2 + 0xbf0], cx
jmp 0x180002bda
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0xbf0], cx
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0x21]
test eax, eax
je 0x180002c00
mov rax, qword [rsp + 0xd0]
add rax, 0x10
mov qword [rsp + 0x1b0], rax
jmp 0x180002c0c
mov qword [rsp + 0x1b0], 0
movzx eax, byte [rsp + 0x7c]
movzx ecx, byte [rsp + 0x7d]
movzx edx, byte [rsp + 0x7e]
movzx r8d, byte [rsp + 0x7f]
mov r9, qword [rsp + 0xd0]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], r8d
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xbf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1400]
lea r8, [rsp + 0x1c10]
lea rdx, [rsp + 0x2420]
mov rcx, qword [rsp + 0xe0]
call fcn.180001c00
mov dword [rsp + 0x124], eax
cmp dword [rsp + 0x124], 0
jne 0x180002cca
lea rax, [0x1800e854e]
mov qword [rsp + 0x260], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x260]
call fcn.1800cb000
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
mov r8d, dword [rsp + 0xbc]
mov edx, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x2c48]
call fcn.180001900
mov dword [rsp + 0x128], eax
cmp dword [rsp + 0x128], 0
jne 0x180002d2a
lea rax, [0x1800e854f]
mov qword [rsp + 0x268], rax
lea rdx, [0x18016b208]
lea rcx, [rsp + 0x268]
call fcn.1800cb000
mov edx, 0x12
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x170]
mov edx, 5
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x170]
lea rcx, [rsp + 0xf0]
call qword [rsp + 0x118]
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0xf0], 0
jmp 0x1800027c1
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x178]
mov qword [rsp + 0xa0], 0
cmp dword [rsp + 0x98], 0x105
je 0x180002722
mov dword [rsp + 0xc0], 1
jmp 0x180002dc3
cmp qword [rsp + 0xc8], 0
je 0x180002de9
lea rcx, [rsp + 0xc8]
call qword [rsp + 0x118]
mov qword [rsp + 0xc8], 0
cmp qword [rsp + 0x108], 0
je 0x180002e0f
lea rcx, [rsp + 0x108]
call qword [rsp + 0x118]
mov qword [rsp + 0x108], 0
cmp qword [rsp + 0xd8], 0
je 0x180002e33
mov rcx, qword [rsp + 0xd8]
call sub.ADVAPI32.dll_LsaClose
mov qword [rsp + 0xd8], 0
cmp qword [rsp + 0x90], 0
je 0x180002e58
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x90], 0
cmp qword [rsp + 0xe0], 0
je 0x180002eca
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x180], rax
cmp qword [rsp + 0x180], 0
je 0x180002eb2
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x180]
call qword [rax]
mov qword [rsp + 0x278], rax
jmp 0x180002ebe
mov qword [rsp + 0x278], 0
mov qword [rsp + 0xe0], 0
mov rcx, qword [rsp + 0x2c48]
call fcn.180001810
test eax, eax
jne 0x180002ee6
mov dword [rsp + 0xc0], 0
mov eax, dword [rsp + 0xc0]
add rsp, 0x2c38
ret