Function at 0x404970
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407370
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call edi
cdq
mov ebx, 0xa
idiv ebx
lea esi, [edx + 5]
test esi, esi
jle 0x404a44
mov ebx, 0x10ff7f
nop
call edi
cdq
idiv ebx
xor eax, eax
sub edx, 0xffffff80
mov dword [ebp - 0x14], eax
cmp edx, 0xffff
jg 0x4049ea
mov ax, dx
jmp 0x404a0c
cmp edx, 0x10ffff
jg 0x404a10
mov eax, edx
and edx, 0x3ff
sar eax, 0xa
sub eax, 0x2840
sub edx, 0x2400
mov word [ebp - 0x12], dx
mov word [ebp - 0x14], ax
test ax, ax
jne 0x404a19
xor ecx, ecx
jmp 0x404a2f
lea ecx, [ebp - 0x14]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404a20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405670
sub esi, 1
jne 0x4049d0
lea ebx, [esi + 0xa]
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 1
call edi
cdq
idiv ebx
lea esi, [edx + 5]
test esi, esi
jle 0x404ae1
call edi
cdq
mov ecx, 0x10ff7f
idiv ecx
xor eax, eax
sub edx, 0xffffff80
mov dword [ebp - 0x14], eax
cmp edx, 0xffff
jg 0x404a87
mov ax, dx
jmp 0x404aa9
cmp edx, 0x10ffff
jg 0x404aad
mov eax, edx
and edx, 0x3ff
sar eax, 0xa
sub eax, 0x2840
sub edx, 0x2400
mov word [ebp - 0x12], dx
mov word [ebp - 0x14], ax
test ax, ax
jne 0x404ab6
xor eax, eax
jmp 0x404acf
lea eax, [ebp - 0x14]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404ac0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x48]
call fcn.00405670
sub esi, 1
jne 0x404a68
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x6c]
push eax
push 1
push 0
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 0
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
push 0
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x10000
cmovae eax, dword [ebp - 0x2c]
push 0x3f0
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetUserSetInfo]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 1
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push 3
push str.Users
push 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x404b8b
inc eax
push eax
push dword [ebp - 0x48]
call fcn.00401a10
xor eax, eax
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], 0
cmp eax, 8
jb 0x404bb1
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00401a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004064e9
mov esp, ebp
pop ebp
ret