Function at 0x100d5a1
Capabilities:
List groups for user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x105
lea eax, [ebp - 0x330]
push eax
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x548], edi
call fcn.0100f2b3
cmp eax, edi
je 0x100d5ec
push eax
call fcn.0100295a
lea eax, [ebp - 0x534]
push eax
push 3
push ebx
lea eax, [ebp - 0x330]
push eax
call sub.samcli.dll_NetUserGetInfo
mov esi, eax
cmp esi, edi
je 0x100d610
cmp esi, 0xea
jne 0x100d631
mov ecx, dword [ebp - 0x534]
mov eax, dword [ecx + 0x48]
mov ecx, dword [ecx + 0x44]
cmp eax, edi
je 0x100d631
push edi
push ecx
push eax
call fcn.01014bc4
test al, al
jne 0x100d631
mov esi, 0x85c
cmp esi, edi
je 0x100d63b
push esi
call fcn.0100295a
mov eax, dword [ebp - 0x534]
test dword [eax + 0x18], 0x3800
je 0x100d655
push ebx
push 0xeab
call fcn.0101081b
lea eax, [ebp - 0x564]
push eax
push 0x1020678
push 0x17
call fcn.01010adf
mov esi, dword [ebp - 0x564]
lea eax, [ebp - 0x56c]
push eax
push 0x1020730
push 0xc
add esi, 5
call fcn.01010adf
lea eax, [ebp - 0x56c]
push eax
push 0x1020790
push 7
call fcn.01010adf
mov ecx, dword [ebp - 0x534]
mov edx, dword [ecx + 0x30]
mov eax, edx
lea ebx, [eax + 2]
mov dword [ebp - 0x540], ebx
mov bx, word [eax]
inc eax
inc eax
cmp bx, di
jne 0x100d6ab
sub eax, dword [ebp - 0x540]
sar eax, 1
jne 0x100d6cc
mov eax, dword [0x102074c]
mov dword [ebp - 0x540], eax
jmp 0x100d6d2
mov dword [ebp - 0x540], edx
mov eax, dword [ecx + 0x18]
mov edx, dword [0x102073c]
mov ebx, dword [0x1020734]
test al, 2
je 0x100d6ed
mov dword [ebp - 0x538], edx
jmp 0x100d70b
test al, 0x10
je 0x100d705
mov ebx, dword [0x102077c]
mov dword [ebp - 0x538], ebx
mov ebx, dword [0x1020734]
jmp 0x100d70b
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x53c], edx
test al, 0x20
jne 0x100d71b
mov dword [ebp - 0x53c], ebx
mov dword [ebp - 0x54c], edx
test al, 0x40
jne 0x100d72b
mov dword [ebp - 0x54c], ebx
push dword [ecx + 0x58]
call fcn.0100cae9
mov ebx, eax
mov eax, dword [ebp - 0x534]
push dword [eax]
push edi
push dword [0x102067c]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x24]
push edi
push dword [0x1020684]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x14]
push edi
push dword [0x102068c]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x28]
push edi
push dword [0x1020694]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push ebx
push edi
push dword [0x10206a4]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push dword [ebp - 0x538]
push edi
push dword [0x10206bc]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
mov eax, dword [eax + 0x3c]
add esp, 0x14
mov dword [ebp - 0x574], eax
mov ebx, 0x80
cmp eax, 0xffffffff
je 0x100d849
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.0100c1f9
lea eax, [ebp - 0x124]
push eax
jmp 0x100d84f
push dword [0x1020784]
push edi
push dword [0x10206c4]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
call fcn.010108a7
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x570]
push eax
mov eax, dword [ebp - 0x534]
push dword [eax + 8]
call fcn.0100c98b
cmp eax, edi
je 0x100d8a6
push eax
call fcn.0100295a
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.0100c1f9
lea eax, [ebp - 0x124]
push eax
push edi
push dword [0x10206cc]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
test dword [eax + 0x18], 0x10000
jne 0x100d914
cmp dword [ebp - 0x554], 0xffffffff
je 0x100d914
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0100c1f9
lea eax, [ebp - 0x124]
push eax
jmp 0x100d91a
push dword [0x1020784]
push edi
push dword [0x10206d4]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
cmp dword [ebp - 0x55c], 0xffffffff
je 0x100d95e
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x55c]
push eax
call fcn.0100c1f9
lea eax, [ebp - 0x124]
push eax
jmp 0x100d964
push dword [0x1020784]
push edi
push dword [0x10206dc]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push dword [ebp - 0x53c]
push edi
push dword [0x1020724]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push dword [ebp - 0x54c]
push edi
push dword [0x102072c]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
call fcn.010108a7
push dword [ebp - 0x540]
push edi
push dword [0x10206e4]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x1c]
push edi
push dword [0x10206fc]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x68]
push edi
push dword [0x10206ec]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
push dword [eax + 0x10]
push edi
push dword [0x1020704]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
mov eax, dword [ebp - 0x534]
add esp, 0x14
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x560], eax
cmp eax, edi
jbe 0x100da98
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.0100c1f9
lea eax, [ebp - 0x124]
push eax
jmp 0x100da9e
push dword [0x102078c]
push edi
push dword [0x102070c]
push esi
call fcn.010108bb
push eax
push esi
push edi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x568]
push eax
mov eax, dword [ebp - 0x534]
push 0x100392c
push dword [eax + 0x2c]
call fcn.0100fb23
test eax, eax
jl 0x100db31
cmp dword [ebp - 0x578], edi
je 0x100db31
xor eax, eax
push 0xf81
mov word [ebp - 0x530], ax
push 0x100
lea eax, [ebp - 0x530]
push eax
call fcn.01012e19
lea eax, [ebp - 0x530]
push eax
push dword [0x102069c]
push esi
push esi
push dword [0x1020990]
call fcn.01010562
add esp, 0x14
push dword [ebp - 0x578]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.010108a7
mov eax, dword [ebp - 0x534]
push dword [eax + 0x48]
push dword [eax + 0x44]
push esi
call fcn.0100d132
call fcn.010108a7
push dword [ebp - 0x534]
call sub.netutils.dll_NetApiBufferFree
push dword [0x10206f4]
lea eax, [ebp - 0x24]
push str.__.ws
push dword [ebp - 0x544]
push eax
push esi
lea eax, [ebp - 0x330]
push eax
call fcn.0100d3c5
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x550]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x558]
push eax
push edi
push dword [ebp - 0x544]
lea eax, [ebp - 0x330]
push eax
call sub.samcli.dll_NetUserGetGroups
test eax, eax
je 0x100dbb7
mov dword [ebp - 0x548], 1
jmp 0x100dc8a
push 0x1e
pop eax
cmp eax, esi
mov eax, dword [ebp - 0x558]
push edi
push dword [0x1020714]
sbb ebx, ebx
inc ebx
push esi
inc ebx
mov dword [ebp - 0x53c], eax
call fcn.010108bb
push eax
push esi
push edi
push str.__.ws
call fcn.01010562
add esp, 0x10
mov dword [ebp - 0x538], edi
cmp dword [ebp - 0x550], edi
jbe 0x100dc85
mov eax, dword [ebp - 0x538]
cmp eax, edi
je 0x100dc22
xor edx, edx
div ebx
test edx, edx
jne 0x100dc22
push dword [0x1020954]
push esi
push esi
push str.__.ws
call fcn.01010562
add esp, 0x10
mov eax, dword [ebp - 0x53c]
push edi
push dword [eax]
push 0x15
call fcn.010108bb
push eax
push 0x1003920
call fcn.01010562
mov eax, dword [ebp - 0x538]
inc eax
xor edx, edx
mov dword [ebp - 0x544], eax
div ebx
pop ecx
pop ecx
test edx, edx
jne 0x100dc59
call fcn.010108a7
mov eax, dword [ebp - 0x544]
add dword [ebp - 0x53c], 4
mov dword [ebp - 0x538], eax
cmp eax, dword [ebp - 0x550]
jb 0x100dbfb
cmp eax, edi
je 0x100dc85
cmp ebx, 1
jle 0x100dc8a
xor edx, edx
div ebx
test edx, edx
je 0x100dc8a
call fcn.010108a7
push dword [ebp - 0x558]
call sub.netutils.dll_NetApiBufferFree
cmp dword [ebp - 0x548], edi
pop edi
pop esi
pop ebx
je 0x100dcb3
push 0xdb0
call fcn.010108f6
push 1
call fcn.01002992
jmp 0x100dcb8
call fcn.010108de
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002d45
leave
ret 4