Function at 0x1400195b0
Capabilities:
List groups for user account

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140174940]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, rdx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r14d, r14d
mov edi, r14d
mov rcx, qword [0x1401776e0]
cmp dword [rcx + 0x358], r14d
je 0x14001983f
add rcx, 0x360
lea rdx, str._Everyone_
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
je 0x14001983f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
test rbx, rbx
jne 0x140019639
mov qword [rsp + 0x70], r14
jmp 0x14001969e
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140019640
add eax, 1
js 0x140019878
movsxd rsi, eax
cmp eax, 0x80
jle 0x14001967a
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140019883
jmp 0x140019689
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x78]
lea r8, [rsi + rsi]
test r8, r8
je 0x14001969e
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
mov r8d, 0x64
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rbx, rax
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x1400196ce
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400197f8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetLocalGroups
mov ebx, eax
test eax, eax
jne 0x1400197b5
mov ebx, r14d
mov edi, r14d
cmp ebx, dword [rsp + 0x48]
jae 0x1400197a0
mov eax, ebx
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, str.administrators
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
je 0x14001979b
mov rax, qword [0x1401776e0]
mov rdx, qword [rax + 0x360]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
je 0x14001979b
mov rax, qword [0x1401776e0]
mov rdx, qword [rax + 0x368]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
je 0x140019794
inc ebx
jmp 0x140019721
mov edi, 1
jmp 0x1400197a0
mov edi, 2
mov rcx, qword [rsp + 0x50]
call sub.NETAPI32.dll_NetApiBufferFree
cmp edi, 2
je 0x140019844
jmp 0x1400197f8
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.14009d5a0
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.AppMan::CheckGroupAccess__error__d_looking_up_group_access___s_
mov edx, 2
lea r8d, [rdx - 4]
mov rcx, qword [0x1401776d0]
call fcn.1400a5ff0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [0x1401776e0]
add rcx, 0x368
lea rdx, str._Everyone_
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x14001981c
lea edi, [rax + 1]
jmp 0x140019844
mov rcx, qword [0x1401776e0]
add rcx, 0x368
lea rdx, str._No_One_
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
cmove edi, r14d
jmp 0x140019844
mov edi, 2
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400c7c30
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001e20
int3
mov ecx, 0x8007000e
call fcn.140001e20
int3