Function at 0x140001000
Capabilities:
Add user account
Add user account to group

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Creating_user_with_the_following_credentials:
call fcn.140001360
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Username:
call fcn.140001360
lea rdi, str.rootshell
mov rcx, rax
mov rdx, rdi
call fcn.140001360
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Password:
call fcn.140001360
lea rbx, str.Welcome_1234
mov rcx, rax
mov rdx, rbx
call fcn.140001360
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x40], rbx
lea r8, [rsp + 0x38]
mov dword [rsp + 0x4c], 1
mov edx, 1
mov dword [rsp + 0x60], 0x10001
xor ecx, ecx
mov qword [rsp + 0x68], 0
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.NETAPI32.dll_NetUserAdd]
mov ebx, eax
test eax, eax
jne 0x1400012a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.User
call fcn.140001360
mov rcx, rax
mov rdx, rdi
call fcn.140001360
mov rcx, rax
lea rdx, str._has_been_successfully_created.
call fcn.140001360
mov rcx, rax
lea rdx, [0x140001540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov r8d, 3
mov dword [rsp + 0x20], 1
lea rdx, str.Remote_Desktop_Users
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
mov ebx, eax
test eax, eax
jne 0x14000118d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.User
call fcn.140001360
mov rcx, rax
mov rdx, rdi
call fcn.140001360
mov rcx, rax
lea rdx, str._added_to_Remote_Desktop_Users_group.
call fcn.140001360
jmp 0x1400011ab
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_add_user_to_Remote_Desktop_Users_group._Error:
call fcn.140001360
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 1
mov r8d, 3
lea rdx, str.Remote_Management_Users
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
mov ebx, eax
test eax, eax
jne 0x140001212
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.User
call fcn.140001360
mov rcx, rax
mov rdx, rdi
call fcn.140001360
mov rcx, rax
lea rdx, str._added_to_Remote_Management_Users_group.
call fcn.140001360
jmp 0x140001230
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_add_user_to_Remote_Management_Users_group._Error:
call fcn.140001360
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 1
mov r8d, 3
lea rdx, str.Administrators
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
mov ebx, eax
test eax, eax
jne 0x140001297
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.User
call fcn.140001360
mov rcx, rax
mov rdx, rdi
call fcn.140001360
mov rcx, rax
lea rdx, str._added_to_Administrators_group.
call fcn.140001360
jmp 0x1400012be
lea rdx, str.Failed_to_add_user_to_Administrators_group._Error:
jmp 0x1400012a7
lea rdx, str.Failed_to_create_user._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140001360
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001590
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret