Function at 0x660a1d9c
Capabilities:
Get session user name
Get token membership
List groups for user account
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
push edx
push eax
mov eax, 0x1a54
call section.HTSTACK_
mov edx, dword [esp + 0x1a58]
mov eax, dword [esp + 0x1a54]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], ebx
mov ecx, dword [0x660bd1c8]
movzx edi, word [0x660bd1cc]
mov dword [ebp - 0x34], ecx
cmp eax, 3
jl 0x660a20ea
cmp eax, 2
jle 0x660a238f
mov dword [ebp - 0x14], 0x101
mov word [ebp - 0x30], di
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov ecx, 0x800
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor esi, esi
mov edi, 2
mov dword [ebp - 0xc], esi
mov esi, edx
push 2
push 0x660c5240
lea ebx, [edi + edi]
push dword [esi + edi*4]
call fcn.660ac190
add esp, 0xc
test eax, eax
jne 0x660a1e5b
mov eax, dword [esi + ebx*2]
add eax, 4
movzx ecx, word [eax]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x660a2106
mov eax, dword [ebp - 8]
add edi, 1
cmp edi, eax
jl 0x660a1e1f
jmp 0x660a20f6
push 2
push 0x660c5270
push dword [esi + ebx*2]
call fcn.660ac190
add esp, 0xc
test eax, eax
jne 0x660a1e94
mov eax, dword [esi + ebx*2]
add eax, 4
movzx ecx, word [eax]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x660a212f
mov eax, dword [ebp - 8]
add edi, 1
cmp edi, eax
jl 0x660a1e1f
jmp 0x660a211f
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, 1
test ebx, ebx
je 0x660a238f
cmp edi, 0x12c
je 0x660a1ebe
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov eax, edi
mov edi, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x660a22e4
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x48]
push edx
xor edx, edx
push ecx
push 0xffffffffffffffff
push eax
push 1
push edx
push ebx
push edx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x660a1f6d
mov edx, dword [ebp - 0x44]
test edx, edx
jbe 0x660a1fc4
mov dword [ebp - 4], ebx
xor eax, eax
mov ebx, eax
mov edx, dword [ebp - 0x20]
push dword [edx + ebx*4]
push esi
call fcn.660ac370
add esp, 8
test eax, eax
jne 0x660a1f58
mov edx, dword [ebp - 4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0x54]
lea edi, [ebp - 0x258]
push ecx
push 0x100
push edi
push 0x400
push 0xc002003c
push 0
push 0x3800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea edx, [ebp - 0x258]
push edx
push section..data1
push 0x660c1760
call fcn.660abfb0
add esp, 0xc
xor edi, edi
add ebx, 1
cmp ebx, dword [ebp - 0x44]
jae 0x660a214d
test edi, edi
jne 0x660a1efa
jmp 0x660a20b3
cmp eax, 0x54b
je 0x660a200f
cmp eax, 5
je 0x660a218f
cmp eax, 0xea
je 0x660a2176
cmp eax, 0x92f
je 0x660a215d
cmp eax, 0x8ad
jne 0x660a1fb4
push 0
push 0xc002003b
call fcn.660a2840
add esp, 8
mov edi, 0x132
jmp 0x660a1fc4
push 0
push eax
call fcn.660a2840
add esp, 8
mov edi, 0x133
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], esi
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x458]
push edx
push 0x100
push ecx
push 0x400
push 0xc002003d
push 0
push 0x3800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea edx, [ebp - 0x458]
push edx
push section..data1
push 0x660c1760
call fcn.660abfb0
add esp, 0xc
jmp 0x660a20b3
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x18]
push edx
push ecx
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x1c]
push edx
push 3
push esi
push 0
call sub.NETAPI32.dll_NetLocalGroupGetMembers
test eax, eax
jne 0x660a22cf
mov edx, dword [ebp - 0x44]
test edx, edx
jbe 0x660a21b0
mov dword [ebp - 0xc], esi
xor eax, eax
mov esi, eax
mov edx, dword [ebp - 0x1c]
push dword [edx + esi*4]
push ebx
call fcn.660ac370
add esp, 8
test eax, eax
jne 0x660a20a3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], edx
lea ecx, [ebp - 0x54]
lea edi, [ebp - 0x658]
push ecx
push 0x100
push edi
push 0x400
push 0xc002003c
push 0
push 0x3800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea edx, [ebp - 0x658]
push edx
push section..data1
push 0x660c1760
call fcn.660abfb0
add esp, 0xc
xor edi, edi
add esi, 1
cmp esi, dword [ebp - 0x44]
jae 0x660a21a5
test edi, edi
jne 0x660a2045
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x660a20c0
push edx
call sub.NETAPI32.dll_NetApiBufferFree
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x660a20cd
push edx
call sub.NETAPI32.dll_NetApiBufferFree
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x660a20db
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov eax, edi
mov edi, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x40]
mov eax, 1
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, 0x12c
jmp 0x660a1ebe
push 0
push 0xc002003f
call fcn.660a2840
add esp, 8
mov edi, 2
jmp 0x660a1eaf
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, 0x12c
jmp 0x660a1e9f
mov esi, eax
mov ebx, dword [ebp - 4]
push 0
push 0xc0020040
call fcn.660a2840
add esp, 8
mov edi, 2
jmp 0x660a1e9f
mov ebx, dword [ebp - 4]
test edi, edi
jne 0x660a1fc4
jmp 0x660a20b3
push 0
push 0xc002003a
call fcn.660a2840
add esp, 8
mov edi, 0x131
jmp 0x660a1fc4
push 0
push 0xea
call fcn.660a2840
add esp, 8
mov edi, 0x130
jmp 0x660a1fc4
push 0
push 5
call fcn.660a2840
add esp, 8
mov edi, 0x12f
jmp 0x660a1fc4
mov esi, dword [ebp - 0xc]
test edi, edi
je 0x660a20b3
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x660a22b4
lea ecx, [ebp - 0x85c]
lea edx, [ebp - 0x14]
push edx
push ecx
push 2
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
test eax, eax
je 0x660a1fc4
lea edx, [ebp - 0x85c]
push edx
push ebx
call fcn.660ac370
add esp, 8
test eax, eax
jne 0x660a1fc4
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x660a2264
lea edx, [ebp - 0x10]
push edx
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x660a1fc4
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x660a1fc4
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x1a5c]
push eax
push 0x100
push edx
push 0x400
push 0xc002003c
push 0
push 0x3800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x1a5c]
push eax
push section..data1
push 0x660c1760
call fcn.660abfb0
add esp, 0xc
xor edi, edi
jmp 0x660a20b3
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x2c]
push edx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x660a2297
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x660a21f7
jmp 0x660a1fc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
call fcn.660a2840
add esp, 8
mov dword [ebp - 0x2c], 0
jmp 0x660a1fc4
push 0x660c5278
push esi
call fcn.660ac370
add esp, 8
test eax, eax
je 0x660a21bb
jmp 0x660a1fc4
push 0
push eax
call fcn.660a2840
add esp, 8
mov edi, 0x134
jmp 0x660a1fc4
lea esi, [ebp - 0x34]
lea edx, [ebp - 0x2c]
push edx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x660a236c
lea eax, [ebp - 0x24]
lea esi, [ebp - 0x185c]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x58]
push edx
push ecx
push esi
push eax
lea edx, [ebp - 0x105c]
push edx
push dword [ebp - 0x2c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x660a233b
lea esi, [ebp - 0x105c]
jmp 0x660a1ec6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
call fcn.660a2840
add esp, 8
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x660a235a
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
mov eax, 0x12e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
call fcn.660a2840
add esp, 8
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
mov eax, 0x12d
mov esp, ebp
pop ebp
ret
mov edi, 1
jmp 0x660a1eaf