Function at 0x3bc1c2fbf
Capabilities:
Get user security identifier
List user account groups

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
call fcn.3bc1c2edf
mov edi, 0xea
mov ebp, 0
jmp 0x3bc1c34b2
mov r8, rbx
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov ebp, 0x40000002
jmp 0x3bc1c34a3
mov r8, r15
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
jmp 0x3bc1c3454
mov ebp, 0x40000002
cmp qword [rbx + 8], 0
je 0x3bc1c30fa
mov edx, 0x44
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x10], 0
je 0x3bc1c33df
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x44
mov rdx, qword [rsi]
mov rcx, qword [rbx]
mov r8, r12
call sub.msvcrt.dll_wcsncpy
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
call fcn.3bc1ca05a
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov ecx, 0
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x3bc1c3104
test ebp, ebp
jne 0x3bc1c312f
mov qword [rbx + 0x18], 0
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
je 0x3bc1c32f8
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x3bc1c33a7
mov r8, qword [rbx + 8]
lea rdx, str.groups_sync
lea rcx, str._D____s_____Group_found_name_s_s_sid_s__n
call fcn.3bc1c1292
jmp case.0x3bc1c316c.0
mov ebp, 0x40000002
jmp 0x3bc1c3042
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x7a
je 0x3bc1c316e
mov r8d, eax
lea rdx, str.groups_sync
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
test esi, esi
je 0x3bc1c32f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r8d, eax
lea rdx, str.groups_sync
adc eax, 0x11da0
adc eax, 0x11da0
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
cmp ebp, 0x20
ja 0x3bc1c3321
ja case.0x3bc1c316c.1
mov eax, ebp
lea rdx, [0x3bc1d5014]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov edx, dword [rsp + 0x5c]
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x3bc1c32e7
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov ecx, 0
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x3bc1c31ce
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x3bc1c30af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r8d, eax
lea rdx, str.groups_sync
lea rcx, str._E____s_____LookupAccountNameW_failed_gle_lu__n
call fcn.3bc1c1292
inc dword [rbx + 0x187720fd]
inc dword [rbx + 0x187720fd]
ja case.0x3bc1c3207.1
add byte [rax], al
mov eax, ebp
lea rdx, [0x3bc1d5098]
add byte [rax + 0x63], cl
add al, 0x82
add byte [rax + 0x63], cl
add al, 0x82
add rax, rdx
jmp rax
cmp ebp, 0x94
je 0x3bc1c32a1
add byte [rax], al
add byte [rax], al
cmp ebp, 0x94
ja 0x3bc1c324d
cmp ebp, 0x7f
ja 0x3bc1c323b
cmp ebp, 0x7e
jae 0x3bc1c32ab
cmp ebp, 0x50
jne 0x3bc1c32b5
mov ebp, 0x40000007
jmp case.0x3bc1c3207.0
cmp ebp, 0x91
jne 0x3bc1c32bf
mov ebp, 0x4000000d
jmp case.0x3bc1c3207.0
cmp ebp, 0xb7
je 0x3bc1c32c9
cmp ebp, 0x80070005
je 0x3bc1c32d3
cmp ebp, 0xaa
jne 0x3bc1c32dd
mov ebp, 0x4000000d
jmp case.0x3bc1c3207.0
mov ebp, 0x40000003
jmp case.0x3bc1c3207.0
mov ebp, 0x40000009
jmp case.0x3bc1c3207.0
mov ebp, 0x4000000d
jmp case.0x3bc1c3207.0
mov ebp, 0x40000001
jmp case.0x3bc1c3207.0
mov ebp, 0x40000008
jmp case.0x3bc1c3207.0
mov ebp, 0x4000000d
jmp case.0x3bc1c3207.0
mov ebp, 0x40000003
jmp case.0x3bc1c3207.0
mov ebp, 0x40000001
jmp case.0x3bc1c3207.0
mov ebp, 0x40000001
jmp case.0x3bc1c3207.0
mov ebp, 0x40000007
jmp case.0x3bc1c3207.0
mov ebp, 0x40000009
jmp case.0x3bc1c3207.0
mov ebp, 0x40000001
jmp case.0x3bc1c3207.0
mov ebp, 0x40000002
jmp 0x3bc1c30af
mov ebp, esi
jmp 0x3bc1c30b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.sid_to_str
lea rcx, str._E____s_____ConvertSidToStringSid_failed_gle_lu__n
call fcn.3bc1c1292
mov qword [rbx + 0x18], 0
jmp 0x3bc1c30d1
cmp ebp, 0x94
je 0x3bc1c33b5
cmp ebp, 0x94
jbe 0x3bc1c335f
cmp ebp, 0xb7
je 0x3bc1c33d1
cmp ebp, 0x80070005
je 0x3bc1c33d8
cmp ebp, 0xaa
je 0x3bc1c3384
mov ebp, 0x40000001
jmp case.0x3bc1c316c.0
cmp ebp, 0x7f
ja 0x3bc1c3375
cmp ebp, 0x7e
jae 0x3bc1c33bc
cmp ebp, 0x50
jne 0x3bc1c33c3
mov ebp, 0x40000007
jmp case.0x3bc1c316c.0
cmp ebp, 0x91
jne 0x3bc1c33ca
mov ebp, 0x4000000d
jmp case.0x3bc1c316c.0
mov ebp, 0x4000000d
jmp case.0x3bc1c316c.0
mov ebp, 0x40000003
jmp case.0x3bc1c316c.0
mov ebp, 0x40000009
jmp case.0x3bc1c316c.0
mov ebp, 0x4000000d
jmp case.0x3bc1c316c.0
mov ebp, 0x40000001
jmp case.0x3bc1c316c.0
mov ebp, 0x40000001
jmp case.0x3bc1c316c.0
mov ebp, 0x40000008
jmp case.0x3bc1c316c.0
mov ebp, 0x4000000d
jmp case.0x3bc1c316c.0
mov ebp, 0x40000003
jmp case.0x3bc1c316c.0
mov ebp, 0x40000001
jmp case.0x3bc1c316c.0
mov ebp, 0x40000001
jmp case.0x3bc1c316c.0
mov ebp, 0x40000007
jmp case.0x3bc1c316c.0
mov ebp, 0x40000009
jmp case.0x3bc1c316c.0
mov ebp, 0x40000002
add r13d, 1
mov eax, dword [rsp + 0x54]
cmp r13d, eax
jae 0x3bc1c349d
test ebp, ebp
jne 0x3bc1c349d
movsxd rsi, r13d
mov rax, qword [rsp + 0x48]
lea rbx, [rax + rsi]
shl rbx, 5
mov rax, qword [rsp + 0x40]
add rbx, rax
shl rsi, 3
add rsi, qword [rsp + 0x68]
mov rcx, qword [rsi]
call sub.msvcrt.dll_wcslen
mov r12, rax
lea r14, [rax + 1]
lea r15, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x3bc1c3003
cmp qword [rbx], 0
je 0x3bc1c301e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], rax
test rax, rax
jne 0x3bc1c3023
mov r8, r14
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
jmp 0x3bc1c3023
add dword [0x3bc1dd24c], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x3bc1c34b2
call sub.NETAPI32.dll_NetApiBufferFree
test ebp, ebp
sete al
cmp edi, 0xea
sete dl
test al, al
je 0x3bc1c35d6
test dl, dl
je 0x3bc1c35d6
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x68]
mov edx, 0
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupEnum
mov edi, eax
test eax, eax
sete al
cmp edi, 0xea
sete dl
or al, dl
je 0x3bc1c34a3
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x3bc1c34a3
add r8d, dword [0x3bc1dd24c]
add eax, dword [0x3bc1dd24c]
mov rbx, r8
shl rbx, 5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x3bc1c2fe3
mov rbx, qword [0x3bc1dd258]
test rbx, rbx
je 0x3bc1c35b4
mov r8d, dword [0x3bc1dd24c]
shl r8, 5
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x40]
mov qword [0x3bc1dd258], rax
add eax, 0x19c98
add eax, 0x19c98
mov eax, dword [0x3bc1dd24c]
mov qword [rsp + 0x48], rax
add byte [rax - 0x77], cl
and al, 0x48
mov r13d, 0
add byte [rax], al
jmp 0x3bc1c33e8
test edi, edi
setne dl
xchg ebp, eax
ret 0xd084
jne 0x3bc1c361c
xchg ebp, eax
ret 0xd084
test ebp, ebp
je 0x3bc1c3729
call fcn.3bc1c2edf
mov r8d, ebp
and r8d, 0x3fffffff
lea rdx, str.groups_sync
lea rcx, [0x3bc1d4fce]
call fcn.3bc1c1292
mov eax, ebp
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, edi
lea rdx, str.groups_sync
lea rcx, str._E____s_____NetLocalGroupEnum_failed_enum_err_08lx__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c3656
ja case.0x3bc1c364d.1
mov eax, edi
lea rdx, [0x3bc1d511c]
movsxd rax, dword [rdx + rax*4]
invalid
add rax, rdx
jmp rax
invalid
mov ebp, 0x40000008
jmp 0x3bc1c35e7
jmp 0x3bc1c35e7
cmp edi, 0x94
je 0x3bc1c36eb
invalid
mov dword [rax], eax
add byte [rax], al
test byte [rcx + 0x76000000], cl
sub al, byte [rcx + 0xb7ff]
add byte [rdi], cl
test byte [rbx - 0x7f000000], ah
inc dword [0x3cb9c3d77]
test byte [rcx - 0x7f000000], ah
jmp [rdx + 0x74000000]
jbe 0x3bc1c368e
cmp edi, 0xb7
je 0x3bc1c3713
cmp edi, 0x80070005
je 0x3bc1c371d
cmp edi, 0xaa
je 0x3bc1c36b9
mov ebp, 0x40000001
jmp 0x3bc1c35e7
cmp edi, 0x7f
ja 0x3bc1c36a7
cmp edi, 0x7e
jae 0x3bc1c36f5
cmp edi, 0x50
jne 0x3bc1c36ff
mov ebp, 0x40000007
jmp 0x3bc1c35e7
invalid
invalid
invalid
invalid
invalid
cmp edi, 0x91
jne 0x3bc1c3709
mov ebp, 0x4000000d
jmp 0x3bc1c35e7
mov ebp, 0x4000000d
jmp 0x3bc1c35e7
mov ebp, 0x4000000d
jmp 0x3bc1c35e7
mov ebp, 0x40000009
jmp 0x3bc1c35e7
mov ebp, 0x40000003
jmp 0x3bc1c35e7
mov ebp, 0x40000001
jmp 0x3bc1c35e7
mov ebp, 0x4000000d
jmp 0x3bc1c35e7
mov ebp, 0x40000003
jmp 0x3bc1c35e7
mov ebp, 0x40000001
jmp 0x3bc1c35e7
mov ebp, 0x40000001
jmp 0x3bc1c35e7
mov ebp, 0x40000007
jmp 0x3bc1c35e7
mov ebp, 0x40000009
jmp 0x3bc1c35e7
mov ebp, edi
mov r8d, dword [0x3bc1dd24c]
lea rdx, str.groups_sync
lea rcx, str._I____s_____Done_sam_group_num_u__n
call fcn.3bc1c1292
jmp 0x3bc1c3609