Function at 0x420b30
Capabilities:
Get token membership
Get user security identifier
List groups for user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x354]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push ecx
lea ecx, [ebp - 0x348]
mov dword [ebp - 0x338], eax
push ecx
push esi
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x34c], esi
push ecx
push esi
push eax
push esi
mov dword [ebp - 0x340], esi
mov dword [ebp - 0x348], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x420b93
push 0x534
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x420bfb
push dword [ebp - 0x340]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x420bf1
lea eax, [ebp - 0x354]
mov dword [ebp - 0x348], 0x12c
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x340]
push eax
push esi
push dword [ebp - 0x338]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x420bfb
push esi
jmp 0x420bf3
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
test edi, edi
je 0x420c6b
lea eax, [ebp - 0x350]
mov dword [ebp - 0x334], 0
push eax
push 4
lea eax, [ebp - 0x334]
mov dword [ebp - 0x350], 0
push eax
push 8
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x420c39
cmp dword [ebp - 0x334], 2
je 0x420c6b
lea eax, [ebp - 0x344]
mov dword [ebp - 0x34c], 1
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x420c71
call ebx
push eax
push str.DuplicateToken_failed:__lu_n
push 2
call fcn.0041a380
add esp, 0xc
jmp 0x420c71
mov dword [ebp - 0x344], edi
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x33c], 0
push eax
push esi
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x420ca5
call ebx
push eax
push str.CheckTokenMembership_failed_with__d_r_n
push 2
call fcn.0041a380
add esp, 0xc
cmp dword [ebp - 0x34c], 0
pop ebx
je 0x420cbb
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x33c], 0
jne 0x420d9d
push str.BUILTINAdministrators
push dword [ebp - 0x338]
call fcn.004266cb
add esp, 8
test eax, eax
jne 0x420d9d
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x204]
push 0x100
push eax
push edi
call fcn.00420dc0
add esp, 0xc
test eax, eax
jne 0x420d12
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x338]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x334]
push eax
push 1
push 0
lea eax, [ebp - 0x204]
push eax
push 0
call sub.NETAPI32.dll_NetUserGetLocalGroups
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test esi, esi
jne 0x420d9d
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x420d9d
xor edi, edi
cmp dword [ebp - 0x338], edi
jbe 0x420d93
push str.Administrators
push dword [esi]
call fcn.0042bff6
add esp, 8
test eax, eax
je 0x420d83
inc edi
add esi, 4
cmp edi, dword [ebp - 0x338]
jb 0x420d62
jmp 0x420d8d
mov dword [ebp - 0x33c], 1
mov esi, dword [ebp - 0x334]
test esi, esi
je 0x420d9d
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x33c]
xor ecx, ebp
pop edi
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret