Function at 0x1400252c0
Capabilities:
List user accounts
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11a8]
mov eax, 0x12a8
call fcn.1400366d0
sub rsp, rax
xor edi, edi
lea r9, [0x1400748f8]
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
mov r14d, edi
call fcn.14003a07c
mov rcx, qword [rsp + 0x40]
lea edx, [rdi + 1]
call fcn.14003853c
lea r8, [0x1400748f8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003a05c
mov rax, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], dil
jne 0x140025331
add rcx, 8
mov edx, 1
mov qword [rsp + 0x40], rcx
call fcn.14003853c
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [rsp + 0x40]
mov rsi, rax
mov qword [rsp + 0x70], rax
call fcn.140038690
mov rdx, qword [rsp + 0x40]
lea r8, [0x140074908]
mov rcx, rsi
call fcn.1400386f0
mov qword [rsp + 0x50], rdi
mov dword [rbp + 0x11f0], edi
mov dword [rbp + 0x1208], edi
mov dword [rbp + 0x1200], edi
lea rax, [rbp + 0x1200]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
lea rax, [rbp + 0x1208]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x11f0]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], 0xffffffff
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
test ebx, ebx
je 0x1400253f5
cmp ebx, 0xea
jne 0x1400256e4
test rax, rax
je 0x140025392
cmp dword [rbp + 0x11f0], 0
mov dword [rbp + 0x11f8], edi
jbe 0x1400256e4
nop dword [rax + rax]
test rax, rax
je 0x1400256d9
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x140025423
inc rdx
call fcn.140007870
mov rdi, rax
mov qword [rsp + 0x68], rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140025444
mov rax, 0xffffffffffffffff
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140025454
lea rbx, [rax + 0x11]
mov edx, 1
add rbx, rcx
mov rcx, rbx
call fcn.14003853c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov r13, rax
call fcn.140038690
mov r8, rdi
mov rdx, rbx
mov rcx, r13
call fcn.1400386f0
lea r8, [0x140074ae0]
mov rdx, rbx
mov rcx, r13
call fcn.1400386f0
lea r9, [0x140074af8]
mov qword [rsp + 0x20], r13
mov edx, 0x104
lea rcx, [rbp - 0x80]
mov r8, 0xffffffffffffffff
call fcn.140026600
mov r9, r13
lea r8, [0x140074b18]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.140008f50
lea r8, [rbp - 0x80]
mov edx, 0x1000
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea rcx, [0x140074b38]
lea rsi, [rbp + 0x1a0]
call fcn.140008c70
mov r12, rax
test rax, rax
je 0x14002569c
lea rcx, [0x140074b40]
call fcn.140008c70
mov r15, rax
test rax, rax
je 0x140025670
cmp byte [rbp + 0x1a0], 0
je 0x14002564d
nop word [rax + rax]
mov r8d, 7
mov rdx, r12
mov rcx, rsi
call fcn.140042aa4
test eax, eax
jne 0x140025627
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x90]
mov rdx, r15
mov dword [rsp + 0x20], 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, 0x2f
lea rcx, [rbp + 0x90]
call fcn.140036edc
test rax, rax
je 0x140025627
inc rax
lea r8, [0x140074b48]
mov r9, r13
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.140008f50
lea rcx, [rbp - 0x80]
call qword [0x140054048]
test eax, eax
jne 0x140025627
lea rcx, [rbp - 0x80]
call fcn.140025fa0
mov rdi, rax
mov rax, qword [rax + 8]
test rax, rax
je 0x140025619
test r14, r14
jne 0x1400255fa
lea ecx, [r14 + 0x20]
call fcn.140038534
mov rcx, rax
mov r14, rax
call fcn.140004b90
mov rax, qword [rdi + 8]
xor ebx, ebx
test rax, rax
je 0x140025619
mov rdx, qword [rdi]
mov rcx, r14
mov rdx, qword [rdx + rbx*8]
call fcn.140004950
inc rbx
cmp rbx, qword [rdi + 8]
jb 0x140025601
call qword [0x140054050]
mov rcx, rdi
call fcn.140038520
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140025630
inc rsi
add rsi, rax
cmp byte [rsi], 0
jne 0x140025540
mov rdi, qword [rsp + 0x68]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r15 + r8], 0
jne 0x140025654
xor edx, edx
mov rcx, r15
call fcn.1400376d0
mov rcx, r15
call fcn.140038520
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x140025680
xor edx, edx
mov rcx, r12
call fcn.1400376d0
mov rcx, r12
call fcn.140038520
mov rcx, r13
call fcn.140038520
mov rcx, rdi
call fcn.140038520
mov rax, qword [rsp + 0x60]
mov ecx, dword [rbp + 0x11f8]
add rax, 8
mov rsi, qword [rsp + 0x70]
inc ecx
mov qword [rsp + 0x60], rax
mov dword [rbp + 0x11f8], ecx
cmp ecx, dword [rbp + 0x11f0]
jb 0x140025410
mov rax, qword [rsp + 0x50]
xor edi, edi
mov ebx, dword [rsp + 0x58]
test rax, rax
je 0x1400256f9
mov rcx, rax
call sub.NETAPI32.dll_NetApiBufferFree
mov rax, rdi
mov qword [rsp + 0x50], rax
cmp ebx, 0xea
je 0x140025392
test rax, rax
je 0x140025712
mov rcx, rax
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x48]
call fcn.140038520
mov rcx, rsi
mov qword [rsp + 0x48], rdi
call fcn.140038520
mov rax, r14
add rsp, 0x12a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret