Function at 0x140030750
Capabilities:
List user accounts

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xb8
mov ecx, 0x20
call fcn.1400462e4
mov qword [rbp - 9], rax
mov rbx, rax
test rax, rax
je 0x140030789
mov rcx, rax
call fcn.140005f10
test al, al
jne 0x140030795
mov rcx, rbx
call fcn.1400462d0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rbp
ret
mov qword [rsp + 0xa8], rdi
lea rcx, [0x140085ef0]
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r14
call fcn.14000c020
mov qword [rbp - 1], rax
mov rdi, rax
test rax, rax
je 0x140030b95
mov r9, rax
lea rcx, [rbp - 0x19]
xor r8d, r8d
xor edx, edx
call fcn.1400466d8
mov rcx, qword [rbp - 0x19]
mov edx, 1
call fcn.1400462ec
mov qword [rbp - 0x21], rax
test rax, rax
je 0x140030b95
mov r8, rdi
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x21]
call fcn.1400466b8
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140030b95
mov r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x140030824
test rax, rax
je 0x140030b95
lea rcx, [0x140085f00]
call fcn.14000c020
mov qword [rbp + 7], rax
mov rdi, rax
test rax, rax
je 0x140030b95
mov rcx, r14
inc rcx
cmp byte [rax + rcx], 0
jne 0x140030855
mov rdx, qword [rbp - 0x21]
mov rax, r14
inc rax
cmp byte [rdx + rax], 0
jne 0x140030865
inc rax
mov edx, 1
add rcx, rax
mov qword [rbp - 0x19], rcx
call fcn.1400462ec
mov r13, rax
test rax, rax
je 0x140030b95
mov r8, qword [rbp - 0x21]
mov rcx, rax
mov rdx, qword [rbp - 0x19]
call fcn.1400466e0
mov rdx, qword [rbp - 0x19]
mov r8, rdi
mov rcx, r13
call fcn.140046b08
lea rcx, [0x140085f08]
call fcn.14000c020
mov r12, rax
test rax, rax
je 0x140030b95
xor edi, edi
mov qword [rsp + 0xb0], rsi
mov qword [rbp - 0x11], rdi
mov dword [rbp + 0x67], edi
mov dword [rbp + 0x7f], edi
mov dword [rbp + 0x77], edi
mov qword [rsp + 0x88], r15
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x11]
lea rax, [rbp + 0x7f]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], 0xffffffff
call sub.NETAPI32.dll_NetUserEnum
mov dword [rbp - 0x29], eax
mov ebx, eax
test eax, eax
je 0x140030938
cmp eax, 0xea
jne 0x140030ab6
mov r15, qword [rbp - 0x11]
test r15, r15
je 0x140030ace
cmp dword [rbp + 0x67], 0
mov dword [rbp + 0x6f], edi
jbe 0x140030aba
test r15, r15
je 0x140030ab1
mov rcx, qword [r15]
test rcx, rcx
je 0x140030ab1
mov rdx, r14
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x140030970
inc rdx
call fcn.140009a30
mov rbx, rax
mov rcx, r14
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140030990
mov rax, r14
nop dword [rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400309a0
add rcx, rax
mov rax, r14
cmp byte [rax + r13 + 1], 0
lea rax, [rax + 1]
jne 0x1400309b0
lea rsi, [rax + 1]
mov edx, 1
add rsi, rcx
mov rcx, rsi
call fcn.1400462ec
mov rdi, rax
test rax, rax
je 0x140030a72
mov r8, r13
mov rdx, rsi
mov rcx, rax
call fcn.1400466e0
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140046b08
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140046b08
mov rdx, r14
nop dword [rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140030a10
inc rdx
mov rcx, rdi
call fcn.140009910
mov rcx, rax
mov rsi, rax
call fcn.140033460
test al, al
je 0x140030a3f
mov rcx, qword [rbp - 9]
mov rdx, rsi
call fcn.1400057c0
mov r8, r14
inc r8
cmp byte [rdi + r8], 0
jne 0x140030a42
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
test rbx, rbx
je 0x140030a9c
mov r8, r14
inc r8
cmp byte [rbx + r8], 0
jne 0x140030a66
jmp 0x140030a8a
test rbx, rbx
je 0x140030a9c
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140030a80
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov eax, dword [rbp + 0x6f]
add r15, 8
inc eax
mov dword [rbp + 0x6f], eax
cmp eax, dword [rbp + 0x67]
jb 0x140030952
mov ebx, dword [rbp - 0x29]
xor edi, edi
mov r15, qword [rbp - 0x11]
test r15, r15
je 0x140030ace
mov rcx, r15
call sub.NETAPI32.dll_NetApiBufferFree
mov r15, rdi
mov qword [rbp - 0x11], rdi
cmp ebx, 0xea
je 0x1400308f0
mov rsi, qword [rsp + 0xb0]
test r15, r15
je 0x140030aef
mov rcx, r15
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rbp - 0x21]
mov r15, qword [rsp + 0x88]
test rcx, rcx
je 0x140030b21
mov r8, r14
inc r8
cmp byte [rcx + r8], 0
jne 0x140030b03
xor edx, edx
call fcn.1400452a0
mov rcx, qword [rbp - 0x21]
call fcn.1400462d0
mov qword [rbp - 0x21], rdi
mov rbx, qword [rbp - 1]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140030b30
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rbx, qword [rbp + 7]
mov r8, r14
inc r8
cmp byte [rbx + r8], 0
jne 0x140030b53
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
nop
inc r14
cmp byte [r12 + r14], 0
jne 0x140030b70
mov r8, r14
xor edx, edx
mov rcx, r12
call fcn.1400452a0
mov rcx, r12
call fcn.1400462d0
mov rax, qword [rbp - 9]
jmp 0x140030b98
mov rax, rbx
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
add rsp, 0xb8
pop rbx
pop rbp
ret