Function at 0x140250200
Capabilities:
List user accounts

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x41], rcx
xor r14d, r14d
mov dword [rbp - 0x51], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x59], r14
mov dword [rbp - 0x4d], r14d
mov esi, r14d
mov dword [rbp - 0x69], r14d
mov dword [rbp - 0x65], r14d
mov dword [rbp - 0x61], r14d
lea rax, [rbp - 0x4d]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x65]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x59]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.samcli.dll_NetUserEnum]
nop dword [rax + rax]
mov dword [rbp - 0x69], eax
test eax, eax
je 0x140250333
cmp eax, 0xea
je 0x140250333
call fcn.1400550c0
mov rdi, qword [rax + 8]
cmp dword [rdi], 2
jbe 0x1402503b9
lea rax, [rbp - 0x69]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 4
lea rax, str.GetLocalMachineUsers_failed_with_system_error
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], 0x2e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x5d], eax
lea rax, [rbp - 0x5d]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140485423]
mov rcx, rdi
call fcn.140001208
jmp 0x1402503b9
mov edi, r14d
cmp dword [rbp - 0x65], r14d
jbe 0x1402503b9
mov ecx, edi
mov rax, qword [rbp - 0x59]
mov rdx, qword [rax + rcx*8]
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r14w
lea rcx, [rbp - 0x39]
call fcn.140055574
nop
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x14025039a
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r14w
add qword [rbx + 8], 0x20
jmp 0x1402503a7
lea r8, [rbp - 0x39]
mov rcx, rbx
call fcn.1400b0a24
nop
lea rcx, [rbp - 0x39]
call fcn.140055f70
inc esi
inc edi
cmp edi, dword [rbp - 0x65]
jb 0x14025033c
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1402503d5
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov rcx, r14
mov qword [rbp - 0x59], rcx
cmp dword [rbp - 0x69], 0xea
je 0x14025025f
test rcx, rcx
je 0x1402503f7
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov qword [rbp - 0x59], r14
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x140250464
lea rax, str.GetLocalMachineUsers_finished
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], reloc.Cabinet.dll_CreateCompressor
mov eax, dword [rbp - 0x69]
mov dword [rbp - 0x5d], eax
lea rax, [rbp - 0x5d]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], 4
mov dword [rbp - 0x61], esi
lea rax, [rbp - 0x61]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1404853eb]
call fcn.140001208
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret