Function at 0x100d7ee
Capabilities:
List groups for user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x101d78c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x105
lea eax, [ebp - 0x330]
push eax
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x544], edi
call fcn.0100f0c4
cmp eax, edi
je 0x100d837
push eax
call fcn.010108fa
lea eax, [ebp - 0x534]
push eax
push 3
push ebx
lea eax, [ebp - 0x330]
push eax
call sub.NETAPI32.dll_NetUserGetInfo
mov esi, eax
cmp esi, edi
je 0x100d85b
cmp esi, 0xea
jne 0x100d87c
mov ecx, dword [ebp - 0x534]
mov eax, dword [ecx + 0x48]
cmp eax, edi
mov ecx, dword [ecx + 0x44]
je 0x100d87c
push edi
push ecx
push eax
call fcn.010155a5
test al, al
jne 0x100d87c
mov esi, 0x85c
cmp esi, edi
je 0x100d886
push esi
call fcn.010108fa
mov eax, dword [ebp - 0x534]
test byte [eax + 0x19], 0x38
je 0x100d89d
push ebx
push 0xeab
call fcn.010107ca
lea eax, [ebp - 0x564]
push eax
push 0x101d3f0
push 0x17
call fcn.01010a4f
mov esi, dword [ebp - 0x564]
lea eax, [ebp - 0x56c]
push eax
push 0x101d4a8
push 0xc
add esi, 5
call fcn.01010a4f
lea eax, [ebp - 0x56c]
push eax
push 0x101d508
push 7
call fcn.01010a4f
mov eax, dword [ebp - 0x534]
push dword [eax + 0x30]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [0x101d4c4]
test eax, eax
mov eax, dword [ebp - 0x534]
je 0x100d902
mov ecx, dword [eax + 0x30]
mov edx, dword [0x101d4ac]
mov ebx, dword [0x101d4b4]
mov dword [ebp - 0x55c], ecx
mov ecx, dword [eax + 0x18]
test cl, 2
je 0x100d924
mov dword [ebp - 0x538], ebx
jmp 0x100d943
test cl, 0x10
je 0x100d93d
mov ebx, dword [0x101d4f4]
mov dword [ebp - 0x538], ebx
mov ebx, dword [0x101d4b4]
jmp 0x100d943
mov dword [ebp - 0x538], edx
test cl, 0x20
mov dword [ebp - 0x53c], ebx
jne 0x100d954
mov dword [ebp - 0x53c], edx
test cl, 0x40
mov dword [ebp - 0x554], ebx
jne 0x100d965
mov dword [ebp - 0x554], edx
push dword [eax + 0x58]
call fcn.0100ce70
mov ebx, eax
mov eax, dword [ebp - 0x534]
push dword [eax]
push edi
push dword [0x101d3f4]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x24]
push edi
push dword [0x101d3fc]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x14]
push edi
push dword [0x101d404]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x28]
push edi
push dword [0x101d40c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
push ebx
push edi
push dword [0x101d41c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
push dword [ebp - 0x538]
push edi
push dword [0x101d434]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
mov eax, dword [eax + 0x3c]
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x574], eax
mov ebx, 0x80
je 0x100da83
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.0100c629
lea eax, [ebp - 0x124]
push eax
jmp 0x100da89
push dword [0x101d4fc]
push edi
push dword [0x101d43c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
call fcn.01010854
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x560]
push eax
mov eax, dword [ebp - 0x534]
push dword [eax + 8]
call fcn.0100cd3b
cmp eax, edi
je 0x100dae0
push eax
call fcn.010108fa
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.0100c629
lea eax, [ebp - 0x124]
push eax
push edi
push dword [0x101d444]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
test byte [eax + 0x1a], 1
jne 0x100db4b
cmp dword [ebp - 0x558], 0xffffffff
je 0x100db4b
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.0100c629
lea eax, [ebp - 0x124]
push eax
jmp 0x100db51
push dword [0x101d4fc]
push edi
push dword [0x101d44c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
cmp dword [ebp - 0x54c], 0xffffffff
je 0x100db95
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.0100c629
lea eax, [ebp - 0x124]
push eax
jmp 0x100db9b
push dword [0x101d4fc]
push edi
push dword [0x101d454]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
push dword [ebp - 0x53c]
push edi
push dword [0x101d49c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
push dword [ebp - 0x554]
push edi
push dword [0x101d4a4]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
call fcn.01010854
push dword [ebp - 0x55c]
push edi
push dword [0x101d45c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x1c]
push edi
push dword [0x101d474]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x68]
push edi
push dword [0x101d464]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x10]
push edi
push dword [0x101d47c]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
mov eax, dword [ebp - 0x534]
add esp, 0x14
mov eax, dword [eax + 0x34]
cmp eax, edi
mov dword [ebp - 0x568], eax
jbe 0x100dccf
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.0100c629
lea eax, [ebp - 0x124]
push eax
jmp 0x100dcd5
push dword [0x101d504]
push edi
push dword [0x101d484]
push esi
call fcn.0101052e
push eax
push esi
push edi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x570]
push eax
mov eax, dword [ebp - 0x534]
push 0x1001eb8
push dword [eax + 0x2c]
call fcn.0100f935
test eax, eax
jl 0x100dd66
cmp dword [ebp - 0x578], edi
je 0x100dd66
push 0xf81
push 0x100
lea eax, [ebp - 0x530]
push eax
mov word [ebp - 0x530], di
call fcn.01013675
lea eax, [ebp - 0x530]
push eax
push dword [0x101d414]
push esi
push esi
push dword [0x101d7d4]
call fcn.010104ef
add esp, 0x14
push dword [ebp - 0x578]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.01010854
mov eax, dword [ebp - 0x534]
push dword [eax + 0x48]
push dword [eax + 0x44]
push esi
call fcn.0100d3dd
call fcn.01010854
push dword [ebp - 0x534]
call sub.NETAPI32.dll_NetApiBufferFree
push dword [0x101d46c]
lea eax, [ebp - 0x24]
push str.__.ws
push dword [ebp - 0x540]
push eax
push esi
lea eax, [ebp - 0x330]
push eax
call fcn.0100d625
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x548]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x550]
push eax
push edi
push dword [ebp - 0x540]
lea eax, [ebp - 0x330]
push eax
call sub.NETAPI32.dll_NetUserGetGroups
test eax, eax
je 0x100ddec
mov dword [ebp - 0x544], 1
jmp 0x100debf
push 0x1e
pop eax
cmp eax, esi
mov eax, dword [ebp - 0x550]
push edi
push dword [0x101d48c]
sbb ebx, ebx
inc ebx
push esi
inc ebx
mov dword [ebp - 0x53c], eax
call fcn.0101052e
push eax
push esi
push edi
push str.__.ws
call fcn.010104ef
add esp, 0x10
cmp dword [ebp - 0x548], edi
mov dword [ebp - 0x538], edi
jbe 0x100deba
mov eax, dword [ebp - 0x538]
cmp eax, edi
je 0x100de57
xor edx, edx
div ebx
test edx, edx
jne 0x100de57
push dword [0x101d794]
push esi
push esi
push str.__.ws
call fcn.010104ef
add esp, 0x10
mov eax, dword [ebp - 0x53c]
push edi
push dword [eax]
push 0x15
call fcn.0101052e
push eax
push 0x1001eac
call fcn.010104ef
mov eax, dword [ebp - 0x538]
inc eax
xor edx, edx
mov dword [ebp - 0x540], eax
div ebx
pop ecx
pop ecx
test edx, edx
jne 0x100de8e
call fcn.01010854
mov eax, dword [ebp - 0x540]
add dword [ebp - 0x53c], 4
cmp eax, dword [ebp - 0x548]
mov dword [ebp - 0x538], eax
jb 0x100de30
cmp eax, edi
je 0x100deba
cmp ebx, 1
jle 0x100debf
xor edx, edx
div ebx
test edx, edx
je 0x100debf
call fcn.01010854
push dword [ebp - 0x550]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x544], edi
pop edi
pop esi
pop ebx
je 0x100dee8
push 0xdb0
call fcn.01010880
push 1
call fcn.010103d5
jmp 0x100deed
call fcn.01010868
mov ecx, dword [ebp - 4]
call fcn.0100fd6e
leave
ret 4