Function at 0x100cf09
Capabilities:
List groups for user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x101d774]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x105
lea eax, [ebp - 0x330]
push eax
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x544], edi
call fcn.0100e833
cmp eax, edi
je 0x100cf52
push eax
call fcn.0101004c
lea eax, [ebp - 0x534]
push eax
push 3
push ebx
lea eax, [ebp - 0x330]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
mov esi, eax
cmp esi, edi
je 0x100cf76
cmp esi, 0xea
jne 0x100cf97
mov ecx, dword [ebp - 0x534]
mov eax, dword [ecx + 0x48]
cmp eax, edi
mov ecx, dword [ecx + 0x44]
je 0x100cf97
push edi
push ecx
push eax
call fcn.01014d05
test al, al
jne 0x100cf97
mov esi, 0x85c
cmp esi, edi
je 0x100cfa1
push esi
call fcn.0101004c
mov eax, dword [ebp - 0x534]
test byte [eax + 0x19], 0x38
je 0x100cfb8
push ebx
push 0xeab
call fcn.0100ff1c
lea eax, [ebp - 0x564]
push eax
push 0x101d3d8
push 0x17
call fcn.010101a1
mov esi, dword [ebp - 0x564]
lea eax, [ebp - 0x56c]
push eax
push 0x101d490
push 0xc
add esi, 5
call fcn.010101a1
lea eax, [ebp - 0x56c]
push eax
push 0x101d4f0
push 7
call fcn.010101a1
mov eax, dword [ebp - 0x534]
push dword [eax + 0x30]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [0x101d4ac]
test eax, eax
mov eax, dword [ebp - 0x534]
je 0x100d01d
mov ecx, dword [eax + 0x30]
mov edx, dword [0x101d494]
mov ebx, dword [0x101d49c]
mov dword [ebp - 0x55c], ecx
mov ecx, dword [eax + 0x18]
test cl, 2
je 0x100d03f
mov dword [ebp - 0x538], ebx
jmp 0x100d05e
test cl, 0x10
je 0x100d058
mov ebx, dword [0x101d4dc]
mov dword [ebp - 0x538], ebx
mov ebx, dword [0x101d49c]
jmp 0x100d05e
mov dword [ebp - 0x538], edx
test cl, 0x20
mov dword [ebp - 0x53c], ebx
jne 0x100d06f
mov dword [ebp - 0x53c], edx
test cl, 0x40
mov dword [ebp - 0x554], ebx
jne 0x100d080
mov dword [ebp - 0x554], edx
push dword [eax + 0x58]
call fcn.0100c58b
mov ebx, eax
mov eax, dword [ebp - 0x534]
push dword [eax]
push edi
push dword [0x101d3dc]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x24]
push edi
push dword [0x101d3e4]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x14]
push edi
push dword [0x101d3ec]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x28]
push edi
push dword [0x101d3f4]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push ebx
push edi
push dword [0x101d404]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push dword [ebp - 0x538]
push edi
push dword [0x101d41c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
mov eax, dword [eax + 0x3c]
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x574], eax
mov ebx, 0x80
je 0x100d19e
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.0100bd11
lea eax, [ebp - 0x124]
push eax
jmp 0x100d1a4
push dword [0x101d4e4]
push edi
push dword [0x101d424]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
call fcn.0100ffa6
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x560]
push eax
mov eax, dword [ebp - 0x534]
push dword [eax + 8]
call fcn.0100c456
cmp eax, edi
je 0x100d1fb
push eax
call fcn.0101004c
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.0100bd11
lea eax, [ebp - 0x124]
push eax
push edi
push dword [0x101d42c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
test byte [eax + 0x1a], 1
jne 0x100d266
cmp dword [ebp - 0x558], 0xffffffff
je 0x100d266
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.0100bd11
lea eax, [ebp - 0x124]
push eax
jmp 0x100d26c
push dword [0x101d4e4]
push edi
push dword [0x101d434]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
cmp dword [ebp - 0x54c], 0xffffffff
je 0x100d2b0
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.0100bd11
lea eax, [ebp - 0x124]
push eax
jmp 0x100d2b6
push dword [0x101d4e4]
push edi
push dword [0x101d43c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push dword [ebp - 0x53c]
push edi
push dword [0x101d484]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push dword [ebp - 0x554]
push edi
push dword [0x101d48c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
call fcn.0100ffa6
push dword [ebp - 0x55c]
push edi
push dword [0x101d444]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x1c]
push edi
push dword [0x101d45c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x68]
push edi
push dword [0x101d44c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x10]
push edi
push dword [0x101d464]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
mov eax, dword [ebp - 0x534]
add esp, 0x14
mov eax, dword [eax + 0x34]
cmp eax, edi
mov dword [ebp - 0x568], eax
jbe 0x100d3ea
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.0100bd11
lea eax, [ebp - 0x124]
push eax
jmp 0x100d3f0
push dword [0x101d4ec]
push edi
push dword [0x101d46c]
push esi
call fcn.0100fc80
push eax
push esi
push edi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x570]
push eax
mov eax, dword [ebp - 0x534]
push 0x1001e98
push dword [eax + 0x2c]
call fcn.0100f0a3
test eax, eax
jl 0x100d481
cmp dword [ebp - 0x578], edi
je 0x100d481
push 0xf81
push 0x100
lea eax, [ebp - 0x530]
push eax
mov word [ebp - 0x530], di
call fcn.010120a7
lea eax, [ebp - 0x530]
push eax
push dword [0x101d3fc]
push esi
push esi
push dword [0x101d7bc]
call fcn.0100fc41
add esp, 0x14
push dword [ebp - 0x578]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0100ffa6
mov eax, dword [ebp - 0x534]
push dword [eax + 0x48]
push dword [eax + 0x44]
push esi
call fcn.0100caf8
call fcn.0100ffa6
push dword [ebp - 0x534]
call sub.NETAPI32.dll_NetApiBufferFree
push dword [0x101d454]
lea eax, [ebp - 0x24]
push str.__.ws
push dword [ebp - 0x540]
push eax
push esi
lea eax, [ebp - 0x330]
push eax
call fcn.0100cd40
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x548]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x550]
push eax
push edi
push dword [ebp - 0x540]
lea eax, [ebp - 0x330]
push eax
call sub.NETAPI32.dll_NetUserGetGroups
test eax, eax
je 0x100d507
mov dword [ebp - 0x544], 1
jmp 0x100d5da
push 0x1e
pop eax
cmp eax, esi
mov eax, dword [ebp - 0x550]
push edi
push dword [0x101d474]
sbb ebx, ebx
inc ebx
push esi
inc ebx
mov dword [ebp - 0x53c], eax
call fcn.0100fc80
push eax
push esi
push edi
push str.__.ws
call fcn.0100fc41
add esp, 0x10
cmp dword [ebp - 0x548], edi
mov dword [ebp - 0x538], edi
jbe 0x100d5d5
mov eax, dword [ebp - 0x538]
cmp eax, edi
je 0x100d572
xor edx, edx
div ebx
test edx, edx
jne 0x100d572
push dword [0x101d77c]
push esi
push esi
push str.__.ws
call fcn.0100fc41
add esp, 0x10
mov eax, dword [ebp - 0x53c]
push edi
push dword [eax]
push 0x15
call fcn.0100fc80
push eax
push 0x1001e8c
call fcn.0100fc41
mov eax, dword [ebp - 0x538]
inc eax
xor edx, edx
mov dword [ebp - 0x540], eax
div ebx
pop ecx
pop ecx
test edx, edx
jne 0x100d5a9
call fcn.0100ffa6
mov eax, dword [ebp - 0x540]
add dword [ebp - 0x53c], 4
cmp eax, dword [ebp - 0x548]
mov dword [ebp - 0x538], eax
jb 0x100d54b
cmp eax, edi
je 0x100d5d5
cmp ebx, 1
jle 0x100d5da
xor edx, edx
div ebx
test edx, edx
je 0x100d5da
call fcn.0100ffa6
push dword [ebp - 0x550]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x544], edi
pop edi
pop esi
pop ebx
je 0x100d603
push 0xdb0
call fcn.0100ffd2
push 1
call fcn.0100fb27
jmp 0x100d608
call fcn.0100ffba
mov ecx, dword [ebp - 4]
call fcn.0100f4dc
leave
ret 4