Function at 0x140030cd0
Capabilities:
List user accounts
Read .ini file

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x6f0]
sub rsp, 0x7f0
mov r12d, ecx
mov ecx, 0x20
call fcn.1400462e4
mov rcx, rax
mov r13, rax
call fcn.140005f10
test al, al
jne 0x140030d18
mov rcx, r13
call fcn.1400462d0
xor eax, eax
add rsp, 0x7f0
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x810], rbx
lea rcx, [0x140085ef0]
mov qword [rsp + 0x7e8], rsi
mov qword [rsp + 0x7e0], rdi
mov qword [rsp + 0x7d8], r14
mov qword [rsp + 0x7d0], r15
call fcn.14000c020
mov qword [rbp - 0x70], rax
mov rbx, rax
test rax, rax
je 0x140031324
mov r9, rax
lea rcx, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call fcn.1400466d8
mov rcx, qword [rsp + 0x48]
mov edx, 1
call fcn.1400462ec
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140031324
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400466b8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140031324
mov r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp byte [rcx + rax], 0
jne 0x140030db5
test rax, rax
je 0x140031324
lea rcx, [0x140085f00]
call fcn.14000c020
mov qword [rbp - 0x68], rax
mov rdi, rax
test rax, rax
je 0x140031324
mov rcx, r15
inc rcx
cmp byte [rax + rcx], 0
jne 0x140030de6
mov rdx, qword [rsp + 0x40]
mov rax, r15
inc rax
cmp byte [rdx + rax], 0
jne 0x140030df7
inc rax
mov edx, 1
add rcx, rax
mov qword [rsp + 0x48], rcx
call fcn.1400462ec
mov qword [rsp + 0x68], rax
mov rbx, rax
test rax, rax
je 0x140031324
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov rdx, qword [rsp + 0x48]
call fcn.1400466e0
mov rdx, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call fcn.140046b08
xor eax, eax
lea rcx, [0x140086130]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x718], eax
mov dword [rsp + 0x58], eax
mov dword [rbp + 0x728], eax
call fcn.14000c020
mov qword [rsp + 0x70], rax
mov rsi, rax
test rax, rax
je 0x140031324
lea rcx, [0x140086148]
call fcn.14000c020
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140031324
lea rcx, [0x140086150]
call fcn.14000c020
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140031324
nop
lea rax, [rbp + 0x728]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x718]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], 0xffffffff
call sub.NETAPI32.dll_NetUserEnum
mov dword [rsp + 0x5c], eax
mov r14d, eax
test eax, eax
je 0x140030f02
cmp eax, 0xea
jne 0x1400311ee
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x140031207
cmp dword [rbp + 0x718], 0
mov dword [rbp + 0x720], 0
jbe 0x1400311f3
nop dword [rax]
test rdi, rdi
je 0x1400311e9
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400311e9
mov rdx, r15
nop dword [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x140030f50
inc rdx
call fcn.140009a30
mov r14, rax
mov qword [rbp - 0x78], rax
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140030f70
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140030f80
add rcx, rax
mov rax, r15
nop
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140030f90
lea rbx, [rax + 1]
mov edx, 1
add rbx, rcx
mov rcx, rbx
call fcn.1400462ec
mov rsi, rax
test rax, rax
je 0x1400311bc
mov r8, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, rax
call fcn.1400466e0
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.140046b08
mov r8, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.140046b08
mov r9, rsi
lea r8, [0x140086158]
mov edx, 0x104
lea rcx, [rbp + 0xb0]
call fcn.14000c300
lea r8, [rbp + 0xb0]
mov edx, 0x1000
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp byte [rbp + 0x2d0], 0
lea rbx, [rbp + 0x2d0]
je 0x140031171
mov r14, qword [rsp + 0x78]
nop word [rax + rax]
mov r8d, 7
mov rdx, r14
mov rcx, rbx
call fcn.140050ae0
test eax, eax
jne 0x140031146
mov rdx, qword [rbp - 0x80]
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1c0]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, 0x2f
lea rcx, [rbp + 0x1c0]
call fcn.140044cac
test rax, rax
je 0x140031146
inc rax
lea r8, [0x140086178]
mov r9, rsi
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14000c300
cmp r12d, 1
jne 0x1400310fb
mov edx, r12d
lea rcx, [rbp - 0x60]
call fcn.140031360
mov rdi, rax
test rax, rax
je 0x140031146
lea r9, [0x14002e200]
mov rdx, rax
lea r8, [0x14002e320]
mov rcx, r13
call fcn.140005b30
mov rcx, rdi
call fcn.14000f7b0
jmp 0x140031146
test r12d, r12d
jne 0x140031146
lea rcx, [rbp - 0x60]
call qword [0x140063120]
test eax, eax
jne 0x140031146
lea rcx, [rbp - 0x60]
call fcn.140031f50
mov rdi, rax
test rax, rax
je 0x140031140
lea r9, [0x14002e200]
mov rdx, rax
lea r8, [0x14002e320]
mov rcx, r13
call fcn.140005b30
mov rcx, rdi
call fcn.14000f7b0
call qword [0x140063128]
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140031150
inc rbx
add rbx, rax
cmp byte [rbx], 0
jne 0x140031040
mov r14, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x60]
test r14, r14
je 0x14003119c
mov r8, r15
nop dword [rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140031180
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
mov r8, r15
nop
inc r8
cmp byte [rsi + r8], 0
jne 0x1400311a0
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov eax, dword [rbp + 0x720]
add rdi, 8
mov rbx, qword [rsp + 0x68]
inc eax
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x60], rdi
mov dword [rbp + 0x720], eax
cmp eax, dword [rbp + 0x718]
jb 0x140030f30
mov r14d, dword [rsp + 0x5c]
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140031207
mov rcx, rdi
call sub.NETAPI32.dll_NetApiBufferFree
xor edi, edi
mov qword [rsp + 0x50], rdi
cmp r14d, 0xea
je 0x140030eb0
test rdi, rdi
je 0x140031221
mov rcx, rdi
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140031254
mov r8, r15
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x140031230
xor edx, edx
call fcn.1400452a0
mov rcx, qword [rsp + 0x40]
call fcn.1400462d0
mov qword [rsp + 0x40], 0
mov rdi, qword [rbp - 0x70]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140031260
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov rdi, qword [rbp - 0x68]
mov r8, r15
inc r8
cmp byte [rdi + r8], 0
jne 0x140031283
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov r8, r15
inc r8
cmp byte [rbx + r8], 0
jne 0x1400312a2
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov r8, r15
inc r8
cmp byte [rsi + r8], 0
jne 0x1400312c1
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov r14, qword [rsp + 0x78]
mov r8, r15
inc r8
cmp byte [r14 + r8], 0
jne 0x1400312e5
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
mov rbx, qword [rbp - 0x80]
inc r15
cmp byte [rbx + r15], 0
jne 0x140031305
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov r14, qword [rsp + 0x7d8]
mov rax, r13
mov rdi, qword [rsp + 0x7e0]
mov rsi, qword [rsp + 0x7e8]
mov rbx, qword [rsp + 0x810]
mov r15, qword [rsp + 0x7d0]
add rsp, 0x7f0
pop r13
pop r12
pop rbp
ret