Function at 0x100be0b
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x578
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x10
lea eax, [ebp - 0x6c]
push eax
push 0x105
lea eax, [ebp - 0x378]
push eax
mov dword [ebp - 0xc], edi
call fcn.0100d443
cmp eax, edi
je 0x100be3e
push eax
call fcn.0100e881
lea eax, [ebp - 4]
push eax
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x378]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
mov esi, eax
cmp esi, edi
je 0x100be61
cmp esi, 0xea
jne 0x100be7f
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x48]
cmp eax, edi
mov ecx, dword [ecx + 0x44]
je 0x100be7f
push edi
push ecx
push eax
call fcn.01012f01
test al, al
jne 0x100be7f
mov esi, 0x85c
cmp esi, edi
je 0x100be89
push esi
call fcn.0100e881
mov eax, dword [ebp - 4]
test byte [eax + 0x19], 0x38
je 0x100be9f
push dword [ebp + 8]
push 0xeab
call fcn.0100e791
lea eax, [ebp - 0x40]
push eax
push 0x101a3c0
push 0x17
call fcn.0100e9ac
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x2c]
push eax
push 0x101a478
push 0xc
add esi, 5
call fcn.0100e9ac
lea eax, [ebp - 0x2c]
push eax
push 0x101a4d8
push 7
call fcn.0100e9ac
mov eax, dword [ebp - 4]
push dword [eax + 0x30]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [0x101a494]
test eax, eax
mov eax, dword [ebp - 4]
je 0x100bef2
mov ecx, dword [eax + 0x30]
mov edx, dword [0x101a47c]
mov ebx, dword [0x101a484]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0x18]
test cl, 2
je 0x100bf0e
mov dword [ebp - 8], ebx
jmp 0x100bf27
test cl, 0x10
je 0x100bf24
mov ebx, dword [0x101a4c4]
mov dword [ebp - 8], ebx
mov ebx, dword [0x101a484]
jmp 0x100bf27
mov dword [ebp - 8], edx
test cl, 0x20
mov dword [ebp - 0x1c], ebx
jne 0x100bf32
mov dword [ebp - 0x1c], edx
test cl, 0x40
mov dword [ebp - 0x10], ebx
jne 0x100bf3d
mov dword [ebp - 0x10], edx
push dword [eax + 0x58]
call fcn.0100b5df
mov ebx, eax
mov eax, dword [ebp - 4]
push dword [eax]
push edi
push dword [0x101a3c4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x24]
push edi
push dword [0x101a3cc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x14]
push edi
push dword [0x101a3d4]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x28]
push edi
push dword [0x101a3dc]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push ebx
push edi
push dword [0x101a3ec]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 8]
push edi
push dword [0x101a404]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov ebx, 0x80
je 0x100c043
push ebx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0100ae42
lea eax, [ebp - 0x16c]
push eax
jmp 0x100c049
push dword [0x101a4cc]
push edi
push dword [0x101a40c]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
call fcn.0100e806
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.0100b4c4
cmp eax, edi
je 0x100c094
push eax
call fcn.0100e881
push ebx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0100ae42
lea eax, [ebp - 0x16c]
push eax
push edi
push dword [0x101a414]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
test byte [eax + 0x1a], 1
jne 0x100c0f3
cmp dword [ebp - 0x14], 0xffffffff
je 0x100c0f3
push ebx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0100ae42
lea eax, [ebp - 0x16c]
push eax
jmp 0x100c0f9
push dword [0x101a4cc]
push edi
push dword [0x101a41c]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
cmp dword [ebp - 0x24], 0xffffffff
je 0x100c137
push ebx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0100ae42
lea eax, [ebp - 0x16c]
push eax
jmp 0x100c13d
push dword [0x101a4cc]
push edi
push dword [0x101a424]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 0x1c]
push edi
push dword [0x101a46c]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 0x10]
push edi
push dword [0x101a474]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
call fcn.0100e806
push dword [ebp - 0x18]
push edi
push dword [0x101a42c]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x1c]
push edi
push dword [0x101a444]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x68]
push edi
push dword [0x101a434]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax + 0x10]
push edi
push dword [0x101a44c]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
mov eax, dword [ebp - 4]
add esp, 0x14
mov eax, dword [eax + 0x34]
cmp eax, edi
mov dword [ebp - 0x3c], eax
jbe 0x100c256
push ebx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0100ae42
lea eax, [ebp - 0x16c]
push eax
jmp 0x100c25c
push dword [0x101a4d4]
push edi
push dword [0x101a454]
push esi
call fcn.0100e523
push eax
push esi
push edi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
push 0x1001de0
push dword [eax + 0x2c]
call fcn.0100dc14
test eax, eax
jl 0x100c2de
cmp dword [ebp - 0x44], edi
je 0x100c2de
push 0xf81
push 0x100
lea eax, [ebp - 0x578]
push eax
mov word [ebp - 0x578], di
call fcn.01010725
lea eax, [ebp - 0x578]
push eax
push dword [0x101a3e4]
push esi
push esi
push dword [0x101a79c]
call fcn.0100e4f5
add esp, 0x14
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0100e806
mov eax, dword [ebp - 4]
push dword [eax + 0x48]
push dword [eax + 0x44]
push esi
call fcn.0100ba7f
call fcn.0100e806
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
push dword [0x101a43c]
lea eax, [ebp - 0x6c]
push str.__.ws
push dword [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x378]
push eax
call fcn.0100bca3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x378]
push eax
call sub.NETAPI32.dll_NetUserGetGroups
test eax, eax
je 0x100c34c
mov dword [ebp - 0xc], 1
jmp 0x100c3f7
push 0x1e
pop eax
cmp eax, esi
mov eax, dword [ebp - 0x28]
push edi
push dword [0x101a45c]
sbb ebx, ebx
inc ebx
push esi
inc ebx
mov dword [ebp - 8], eax
call fcn.0100e523
push eax
push esi
push edi
push str.__.ws
call fcn.0100e4f5
add esp, 0x10
cmp dword [ebp - 0x20], edi
mov dword [ebp + 8], edi
jbe 0x100c3f2
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x100c3a4
xor edx, edx
div ebx
test edx, edx
jne 0x100c3a4
push dword [0x101a75c]
push esi
push esi
push str.__.ws
call fcn.0100e4f5
add esp, 0x10
mov eax, dword [ebp - 8]
push edi
push dword [eax]
push 0x15
call fcn.0100e523
push eax
push 0x1001dd4
call fcn.0100e4f5
mov eax, dword [ebp + 8]
inc eax
xor edx, edx
mov dword [ebp + 8], eax
div ebx
pop ecx
pop ecx
test edx, edx
jne 0x100c3d2
call fcn.0100e806
mov eax, dword [ebp + 8]
add dword [ebp - 8], 4
cmp eax, dword [ebp - 0x20]
mov dword [ebp + 8], eax
jb 0x100c380
cmp eax, edi
je 0x100c3f2
cmp ebx, 1
jle 0x100c3f7
xor edx, edx
div ebx
test edx, edx
je 0x100c3f7
call fcn.0100e806
push dword [ebp - 0x28]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
je 0x100c41a
push 0xdb0
call fcn.0100e828
push 1
call fcn.0100e405
jmp 0x100c41f
call fcn.0100e815
leave
ret 4