Function at 0x3bc1c4b74
Capabilities:
List user accounts for group

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov r15, rdx
mov qword [rsp + 0xb0], r8
test rcx, rcx
je 0x3bc1c4bc1
test rdx, rdx
je 0x3bc1c4bf1
cmp qword [rsp + 0xb0], 0
je 0x3bc1c4c21
mov ebp, 0
mov esi, 0
mov r12d, 0
mov ebx, 0xea
jmp 0x3bc1c4c7e
mov dword [rsp + 0x20], 0x317
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._group___NULL_
lea rdx, str.sam_member_list
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov ebp, 0x40000004
jmp 0x3bc1c4bac
mov dword [rsp + 0x20], 0x318
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._users___NULL_
lea rdx, str.sam_member_list
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov ebp, 0x40000004
jmp 0x3bc1c4bac
mov dword [rsp + 0x20], 0x319
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._user_num___NULL_
lea rdx, str.sam_member_list
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov ebp, 0x40000004
jmp 0x3bc1c4bac
mov r8, rdi
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov ebp, 0x40000002
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x3bc1c4c7e
call sub.NETAPI32.dll_NetApiBufferFree
test ebp, ebp
sete al
cmp ebx, 0xea
sete dl
test al, al
je 0x3bc1c4dcd
test dl, dl
je 0x3bc1c4dcd
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov rdx, qword [r14]
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x48]
mov r8d, 0
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupGetMembers
mov ebx, eax
test eax, eax
sete al
cmp ebx, 0xea
sete dl
or al, dl
je 0x3bc1c4c6f
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x3bc1c4c6f
lea eax, [rax + r12]
lea rdi, [rax*8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x3bc1c4c54
test rsi, rsi
je 0x3bc1c4d73
mov r8d, r12d
shl r8, 3
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, r12d
mov eax, r12d
add eax, dword [rsp + 0x40]
cmp edi, eax
jae 0x3bc1c4dc2
test ebp, ebp
jne 0x3bc1c4db7
movsxd rsi, edi
shl rsi, 3
mov rax, rsi
add rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov r9d, 0
mov r8d, 0
mov edx, 0
call fcn.3bc1c4a4c
mov qword [r13 + rsi], rax
add edi, 1
jmp 0x3bc1c4d76
mov rsi, r13
mov r12d, eax
jmp 0x3bc1c4c6f
mov rsi, r13
mov r12d, eax
jmp 0x3bc1c4c6f
test ebx, ebx
setne dl
test al, dl
jne 0x3bc1c4e53
test ebp, ebp
je 0x3bc1c4e73
test rsi, rsi
je 0x3bc1c4dfa
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, ebp
and r8d, 0x3fffffff
lea rdx, str.sam_member_list
lea rcx, [0x3bc1d4fce]
call fcn.3bc1c1292
mov esi, 0
mov r12d, 0
cmp qword [rsp + 0xb0], 0
je 0x3bc1c4e38
mov rax, qword [rsp + 0xb0]
mov dword [rax], r12d
test r15, r15
je 0x3bc1c4e40
mov qword [r15], rsi
mov eax, ebp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, ebx
lea rdx, str.sam_member_list
lea rcx, str._E____s_____NetLocalGroupGetMembers_failed_enum_err_08lx__n
call fcn.3bc1c1292
mov ebp, 0x40000001
jmp 0x3bc1c4dde
mov r8d, r12d
lea rdx, str.sam_member_list
lea rcx, str._I____s_____Done__user_num_u__n
call fcn.3bc1c1292
jmp 0x3bc1c4e22