Function at 0x1000cfc0
Capabilities:
Get session user name
List user account groups

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036e9c
mov eax, dword fs:[0]
push eax
mov eax, 0x10060
call fcn.10010670
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10050], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov word [ebp - 0x1002c], 0
push 0xfffc
push 0
lea eax, [ebp - 0x1002a]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x20], 0xfffe
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1002c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1000d081
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x10054], eax
push 0x7d
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_GetUserName_failed._n
mov eax, dword [ebp - 0x10054]
push eax
mov ecx, dword [ebp - 0x10054]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
xor eax, eax
jmp 0x1000d2d4
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
call sub.NETAPI32.dll_NetLocalGroupEnum
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000d1c6
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10058], edx
cmp dword [ebp - 0x10058], 0x84b
ja 0x1000d0e8
cmp dword [ebp - 0x10058], 0x84b
je 0x1000d195
cmp dword [ebp - 0x10058], 5
je 0x1000d0f9
cmp dword [ebp - 0x10058], 0xea
je 0x1000d12f
jmp 0x1000d1c6
cmp dword [ebp - 0x10058], 0x92f
je 0x1000d162
jmp 0x1000d1c6
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1005c], eax
push 0x89
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_ERROR_ACCESS_DENIED_failed._n
mov eax, dword [ebp - 0x1005c]
push eax
mov ecx, dword [ebp - 0x1005c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
jmp 0x1000d1c6
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x10060], eax
push 0x8e
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_ERROR_MORE_DATA_failed._n
mov ecx, dword [ebp - 0x10060]
push ecx
mov edx, dword [ebp - 0x10060]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
jmp 0x1000d1c6
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x10064], eax
push 0x93
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_NERR_InvalidComputer_failed._n
mov edx, dword [ebp - 0x10064]
push edx
mov eax, dword [ebp - 0x10064]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
jmp 0x1000d1c6
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x10068], eax
push 0x98
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_NERR_BufTooSmall_failed._n
mov eax, dword [ebp - 0x10068]
push eax
mov ecx, dword [ebp - 0x10068]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
cmp dword [ebp - 0x24], 0
je 0x1000d211
cmp dword [ebp - 0x24], 0xea
je 0x1000d211
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1006c], eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0xa0
push str.e:AMWork_trunkBRincRegPrivilege.h
push str._s__d_return_code:__ld_n
mov edx, dword [ebp - 0x1006c]
push edx
mov eax, dword [ebp - 0x1006c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x14
xor eax, eax
jmp 0x1000d2d4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10030], 0
jmp 0x1000d232
mov ecx, dword [ebp - 0x10030]
add ecx, 1
mov dword [ebp - 0x10030], ecx
mov edx, dword [ebp - 0x10030]
cmp edx, dword [ebp - 0x10]
jae 0x1000d2c6
push 1
mov eax, dword [ebp - 0x10030]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4]
push edx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000d25c
jmp 0x1000d223
lea eax, [ebp - 0x1002c]
push eax
mov ecx, dword [ebp - 0x10030]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
push eax
mov ecx, dword [ebp - 0x10050]
call fcn.1000cee0
test eax, eax
je 0x1000d2c1
mov ecx, dword [ebp - 0x10030]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x1004c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1004c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1004c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x1000d223
mov edx, dword [ebp - 0x28]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 4