Function at 0x100e3da
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x101d78c]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x240], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x40
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x234], ecx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x100e41f
push 0x89a
call fcn.010108fa
push ebx
push esi
push edi
push 0
push 0x202
mov ebx, 0x1020cd8
push ebx
call fcn.01004d5b
mov esi, dword [0x101c360]
push 0x1d
xor eax, eax
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x40], 0xffffffff
mov eax, dword [ebp - 0x244]
xor edi, edi
inc edi
cmp dword [ebp - 0x234], 0
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], 0x10015f4
mov dword [esi + 0x54], 0x101d7fc
mov dword [esi + 0x64], 0x201
mov dword [esi], eax
jne 0x100e480
and dword [esi + 4], 0
jmp 0x100e4f4
push dword [ebp - 0x234]
push 0x10019e4
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x100e4af
push edi
push eax
push 0x1106
push edi
push 0x100
push ebx
call fcn.0101094a
mov dword [esi + 4], ebx
jmp 0x100e4f4
push dword [ebp - 0x234]
call fcn.01013650
test ax, ax
je 0x100e4c8
movzx eax, ax
push eax
call fcn.010108fa
mov eax, dword [ebp - 0x234]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0xe
pop ecx
jbe 0x100e4f4
push edi
push 0x14a0
call fcn.01010912
test eax, eax
jne 0x100e4f4
push 2
call fcn.010103d5
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
push edi
push esi
call fcn.0100defe
cmp dword [ebp - 0x234], 0
jne 0x100e52a
cmp dword [ebp - 0x240], 0
je 0x100e52a
push dword [ebp - 0x240]
push ebx
call fcn.0100d020
mov dword [esi + 4], ebx
cmp dword [ebp - 0x238], edi
jne 0x100e54e
push 0
push edi
push 0x10015f4
push esi
call fcn.0100f9d8
test eax, eax
je 0x100e54e
push 0xf7f
call fcn.010108fa
push edi
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x105
lea eax, [ebp - 0x230]
push eax
call fcn.0100f0c4
test eax, eax
je 0x100e570
push eax
call fcn.010108fa
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x23c], eax
mov eax, dword [0x101c360]
mov eax, dword [eax + 0x48]
test eax, eax
pop ecx
je 0x100e5a0
push edi
push 0xa8
push eax
call fcn.010155a5
test al, al
je 0x100e5ca
push 0
push dword [0x101c360]
lea eax, [ebp - 0x230]
push 3
push eax
call sub.NETAPI32.dll_NetUserAdd
test eax, eax
mov dword [ebp - 0x248], eax
je 0x100e5ed
cmp eax, 0x35
je 0x100e5d1
cmp eax, 0x57
jne 0x100e5e2
push 0xeba
jmp 0x100e5e8
lea eax, [ebp - 0x230]
push eax
push 0xe81
call fcn.010107ca
push dword [ebp - 0x248]
call fcn.010108fa
call fcn.01007a6c
cmp eax, edi
jne 0x100e627
cmp dword [ebp - 0x23c], 0
jne 0x100e627
push dword [esi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0100ceef
test eax, eax
je 0x100e627
push 0
push eax
call fcn.01010315
push 0xebe
call fcn.010108fa
cmp dword [ebp - 0x238], edi
jne 0x100e6cd
call fcn.01007a6c
test eax, eax
jne 0x100e645
call fcn.01007a8c
test eax, eax
je 0x100e657
cmp dword [ebp - 0x23c], 0
ja 0x100e657
and dword [ebp - 0x23c], 0
jmp 0x100e65d
mov dword [ebp - 0x23c], edi
lea eax, [ebp - 0x238]
push eax
push 3
push dword [ebp - 0x244]
lea eax, [ebp - 0x230]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
mov edi, 0xf7d
je 0x100e687
push edi
call fcn.010108fa
push dword [ebp - 0x23c]
push 0
push dword [esi + 4]
push dword [ebp - 0x238]
call fcn.0100f9d8
test eax, eax
je 0x100e6a7
push edi
call fcn.010108fa
push 0
push dword [ebp - 0x238]
lea eax, [ebp - 0x230]
push 3
push dword [ebp - 0x244]
push eax
call sub.NETAPI32.dll_NetUserSetInfo
test eax, eax
je 0x100e6cd
push edi
call fcn.010108fa
cmp dword [ebp - 0x234], 0
jne 0x100e6fc
cmp dword [ebp - 0x240], 0
je 0x100e6fc
mov eax, dword [ebp - 0x244]
push 2
push 0xf80
mov dword [0x1020900], eax
mov dword [0x1020904], ebx
call fcn.0101089e
call fcn.01010868
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100fd6e
leave
ret 8