Function at 0x14009a928
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
movdqa xmm0, xmmword [0x140123900]
mov rsi, rcx
movdqa xmm1, xmmword [0x1401235f0]
lea rcx, str.hid_L___o__mgREHrxyn7Bu
movdqu xmmword [rbp - 9], xmm0
xor r15d, r15d
mov r14, r8
movdqa xmm0, xmmword [0x1401230e0]
mov rdi, rdx
and dword [rbp + 0x27], r15d
movdqu xmmword [rbp + 0x17], xmm0
movdqu xmmword [rbp + 7], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__C1ygeTIk4aLU
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__zbD9ilSuNzyq
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rax, [rbp - 0x45]
mov rdx, rdi
mov qword [rsp + 0x30], rax
lea r9, [0x140112648]
lea rax, [rbp - 0x21]
mov rcx, rsi
lea r8, str.SAMDomainsAccount
mov qword [rsp + 0x28], rax
call fcn.14000e164
test eax, eax
je 0x14009aa02
lea rcx, [rbp - 9]
call fcn.14000b314
mov ecx, dword [rbp - 0x45]
add rcx, 0xffffffffffffffe8
add rcx, qword [rbp - 0x21]
call fcn.140011780
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x29]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, str.SAMDomainsAccount
mov rcx, rsi
mov dword [rsp + 0x20], 0x20019
call fcn.14000d630
test eax, eax
je 0x14009acb3
mov rdx, qword [rbp - 0x29]
lea r9, [rbp - 0x19]
mov r8, r14
mov rcx, rsi
call fcn.14009b0ec
test eax, eax
je 0x14009aca7
mov rdx, qword [rbp - 0x29]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r8, str.Users
mov rcx, rsi
mov dword [rsp + 0x20], 0x20019
call fcn.14000d630
test eax, eax
je 0x14009aca7
and qword [rsp + 0x50], r15
lea rax, [rbp - 0x49]
and qword [rsp + 0x48], r15
xor r9d, r9d
and qword [rsp + 0x40], r15
xor r8d, r8d
mov rdx, qword [rbp - 0x39]
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
call fcn.14000d8b0
mov r15d, eax
test eax, eax
je 0x14009ac9b
mov ecx, dword [rbp - 0x49]
inc ecx
mov dword [rbp - 0x49], ecx
lea edx, [rcx + 1]
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x14009ac9b
xor r12d, r12d
cmp dword [rbp - 0x41], r12d
jbe 0x14009ac92
mov ecx, dword [rbp - 0x49]
lea rax, [rbp - 0x45]
mov rdx, qword [rbp - 0x39]
mov r9, r14
mov dword [rbp - 0x45], ecx
mov r8d, r12d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14000dd64
test eax, eax
je 0x14009ac85
lea rdx, str.Names
mov rcx, r14
call fcn.1400ca084
test eax, eax
je 0x14009ac85
lea r8, [rbp + 0x7f]
mov rcx, r14
lea rdx, [0x140112514]
call fcn.140011268
cmp eax, 0xffffffff
je 0x14009ac85
mov edx, dword [rbp + 0x7f]
lea rcx, str._nRID__:__08x___u__n
mov r8d, edx
call fcn.14000b314
mov rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov r8, r14
mov rcx, rsi
mov dword [rsp + 0x20], 0x20019
call fcn.14000d630
and r15d, eax
je 0x14009ac85
and qword [rsp + 0x28], 0
lea rax, [rbp - 0x21]
mov rdx, qword [rbp - 0x31]
lea r8, [0x140112648]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.14000e1e0
and r15d, eax
je 0x14009ac69
mov rdi, qword [rbp - 0x21]
lea rcx, str.User_:__.s_n
mov eax, dword [rdi + 0xc]
lea r8, [rdi + 0xcc]
mov edx, dword [rdi + 0x10]
add r8, rax
shr rdx, 1
call fcn.14000b314
and dword [rsp + 0x28], 0
lea rbx, [rdi + 0xcc]
mov r9d, dword [rbp + 0x7f]
lea rcx, [rdi + 0x9c]
and dword [rsp + 0x20], 0
lea r8, [rbp - 0x19]
mov rdx, rbx
call fcn.14009acd4
mov r9d, dword [rbp + 0x7f]
lea rcx, [rdi + 0xa8]
and dword [rsp + 0x28], 0
lea r8, [rbp - 0x19]
mov rdx, rbx
mov dword [rsp + 0x20], 1
call fcn.14009acd4
mov r9d, dword [rbp + 0x7f]
lea rcx, [rdi + 0xc0]
lea r8, [rbp - 0x19]
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov rdx, rbx
call fcn.14009acd4
mov r9d, dword [rbp + 0x7f]
lea rcx, [rdi + 0xb4]
mov eax, 1
lea r8, [rbp - 0x19]
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov dword [rsp + 0x20], eax
call fcn.14009acd4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbp - 0x31]
lea r8, [rbp - 0x19]
mov rcx, rsi
call fcn.14009af1c
mov rdx, qword [rbp - 0x31]
mov rcx, rsi
call fcn.14000e124
inc r12d
cmp r12d, dword [rbp - 0x41]
jb 0x14009aae4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbp - 0x39]
mov rcx, rsi
call fcn.14000e124
mov rdx, qword [rbp - 0x29]
mov rcx, rsi
call fcn.14000e124
lea r11, [rsp + 0xf0]
mov eax, r15d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret