Function at 0x49b943
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push esi
push 0xf0
push 0x678
push edi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
test eax, eax
je 0x49b9b8
push 0x672
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
xor ecx, ecx
push ecx
push 0x674
push edi
call ebx
push eax
call esi
xor eax, eax
push eax
push 0x675
push edi
call ebx
push eax
call esi
xor eax, eax
push eax
push 0x673
push edi
call ebx
push eax
call esi
mov esi, 0x674
jmp 0x49bbb0
push 0x673
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push esi
push 0x146
mov esi, 0x674
push esi
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
test eax, eax
jne 0x49bb80
lea eax, [ebp - 0x1c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], ecx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
push eax
push 0xffffffffffffffff
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], ecx
push eax
push 2
push 3
push ecx
mov dword [ebp + 8], ecx
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
jne 0x49bb67
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x10], ecx
jbe 0x49bb09
mov ebx, ecx
mov eax, dword [ebp + 8]
test byte [ebx + eax + 0x18], 2
jne 0x49baf0
mov eax, dword [ebx + eax]
test eax, eax
je 0x49baf0
cmp word [eax], cx
je 0x49baf0
push eax
push ecx
push 0x143
push esi
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp + 8]
cmp dword [ebx + eax + 0xc], 2
jne 0x49bab8
cmp dword [ebp - 4], 0
jne 0x49ba89
cmp dword [ebx + eax + 0x60], 0x1f4
jne 0x49ba89
xor ecx, ecx
push ecx
push dword [ebx + eax]
call fcn.004e230a
mov dword [ebp - 4], eax
jmp 0x49baec
cmp dword [ebp - 8], 0
jne 0x49baee
push dword [ebx + eax]
mov eax, dword [ebp - 0xc]
add eax, 0xe0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x49baee
xor eax, eax
push eax
mov eax, dword [ebp + 8]
push dword [ebx + eax]
call fcn.004e230a
mov dword [ebp - 8], eax
jmp 0x49baec
cmp dword [ebp - 0x14], 0
jne 0x49baee
cmp dword [ebx + eax + 0xc], 1
jne 0x49baee
push dword [ebx + eax]
mov eax, dword [ebp - 0xc]
add eax, 0xe0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x49baee
xor eax, eax
push eax
mov eax, dword [ebp + 8]
push dword [ebx + eax]
call fcn.004e230a
mov dword [ebp - 0x14], eax
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
add ebx, 0x74
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x10]
jb 0x49ba2e
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x49bb41
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
add eax, 0xe0
test ecx, ecx
cmovne eax, ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
cmovne eax, ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
cmovne eax, ecx
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp + 8]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 4]
test eax, eax
je 0x49bb57
push eax
call fcn.004e1bea
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x49bb80
push eax
call fcn.004e1bea
pop ecx
jmp 0x49bb80
mov eax, dword [ebp - 0xc]
add eax, 0xe0
push eax
xor eax, eax
push eax
push 0x143
push esi
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
push eax
push 0x672
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 0x675
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp + 0x10], 0x679
jne 0x49bbc4
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10