Function at 0x100401680
Capabilities:
Get domain controller name
List groups for user account
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f0
mov r8d, 0x111
lea rsi, [rsp + 0x1c0]
mov rdi, rdx
mov rdx, rcx
mov rcx, rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
call sub.cygwin1.dll_strncpy
mov edx, 0x5c
mov rcx, rsi
call sub.cygwin1.dll_strchr
mov rbx, rax
test rax, rax
jne 0x1004018a0
mov edx, 0x2f
mov rcx, rsi
call sub.cygwin1.dll_strchr
mov rbx, rax
test rax, rax
jne 0x1004018a0
lea r12, [rsp + 0xb0]
mov r8d, 0x101
mov rdx, rsi
mov rcx, r12
call fcn.100402320
mov rdx, qword [section..bss]
mov r8d, 0x111
mov rcx, rsi
call fcn.100402320
mov rbp, qword [0x1004057a0]
mov r13d, dword [rbp]
test r13d, r13d
jne 0x1004018d9
mov rcx, r12
lea r14, [rsp + 0x2e0]
call sub.cygwin1.dll_strlen
mov dword [rsp + 0x28], 0x101
mov qword [rsp + 0x20], r14
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, r12
xor edx, edx
lea r9d, [rax + 1]
xor ecx, ecx
call rbx
mov r12, qword [0x100409010]
lea r13, [rsp + 0x70]
mov rcx, r12
call sub.cygwin1.dll_strlen
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
mov r8, r12
lea r9d, [rax + 1]
call rbx
xor ecx, ecx
lea r8, [rsp + 0x68]
mov edx, 0x65
call sub.NETAPI32.dll_NetServerGetInfo
test eax, eax
jne 0x100401a20
mov rax, qword [rsp + 0x68]
test byte [rax + 0x18], 0x18
je 0x100401930
mov r12d, dword [rbp]
mov qword [rsp + 0x50], 0
test r12d, r12d
jne 0x100401a68
mov rdx, qword [0x100409010]
mov rcx, rsi
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x100401b20
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov edx, dword [rbp]
test edx, edx
jne 0x100401bd0
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
lea r9, [rsp + 0x60]
mov rdx, r14
call sub.NETAPI32.dll_NetUserGetGroups
test eax, eax
jne 0x100401988
mov r12, qword [rsp + 0x60]
test r12, r12
je 0x100401c28
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x100401c4a
xor ebx, ebx
jmp 0x100401885
inc rbx
cmp dword [rsp + 0x48], ebx
jbe 0x1004019a7
mov rcx, qword [r12 + rbx*8]
mov rdx, qword [rdi]
call fcn.100401080
test eax, eax
jne 0x100401878
mov r13d, 1
jmp 0x1004019aa
lea r12, [rsp + 0xb0]
lea rdx, [rbx + 1]
mov r8d, 0x101
mov rcx, r12
call fcn.100402320
mov byte [rbx], 0
mov rcx, rsi
call sub.cygwin1.dll_strlwr
mov rbp, qword [0x1004057a0]
mov r13d, dword [rbp]
test r13d, r13d
je 0x100401755
call sub.cygwin1.dll_getpid
movsxd rbx, eax
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov r9d, 0x162
lea r8, str.ext_lm_group_acl.cc
lea rdx, str._s__d_:_pid_ld_:
call sub.cygwin1.dll_fprintf
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r9, r12
mov r8, rsi
lea rdx, str.Valid_Global_Groups:_checking_group_membership_of__s_s._n
call sub.cygwin1.dll_fprintf
jmp 0x100401755
mov r11d, dword [0x100409028]
lea r8, [rsp + 0x50]
mov rdx, r13
xor ecx, ecx
test r11d, r11d
jne 0x100401a58
call sub.NETAPI32.dll_NetGetAnyDCName
test eax, eax
je 0x100401ab7
mov rsi, qword [0x100409010]
mov rbx, qword [0x100409020]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r9, rsi
mov r8, rbx
lea rdx, str._s:_ERROR:_Cant_find_DC_for_local_domain__s_n
call sub.cygwin1.dll_fprintf
xor r13d, r13d
jmp 0x1004019aa
mov rbx, qword [0x100409020]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r8, rbx
lea rdx, str._s:_ERROR:_NetUserGetGroups___failed._n
call sub.cygwin1.dll_fprintf
xor r13d, r13d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1004019b9
call sub.NETAPI32.dll_NetApiBufferFree
mov r12, qword [rsp + 0x60]
test r12, r12
je 0x1004019cb
mov rcx, r12
call sub.NETAPI32.dll_NetApiBufferFree
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test r8, r8
je 0x1004019ec
cmp r8, rcx
je 0x100401a10
mov rcx, r8
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x100401a10
mov eax, r13d
add rsp, 0x4f0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1004019f1
mov rbx, qword [0x100409020]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r8, rbx
lea rdx, str._s:_ERROR:_NetServerGetInfo___failed._n
call sub.cygwin1.dll_fprintf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x100401a4e
call sub.NETAPI32.dll_NetApiBufferFree
xor r13d, r13d
jmp 0x1004019f1
call sub.NETAPI32.dll_NetGetDCName
jmp 0x10040194f
call sub.cygwin1.dll_getpid
movsxd r12, eax
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], r12
mov r9d, 0x175
lea r8, str.ext_lm_group_acl.cc
lea rdx, str._s__d_:_pid_ld_:
call sub.cygwin1.dll_fprintf
call sub.cygwin1.dll___getreent
mov r9, qword [rax + 0x18]
mov r8d, 0x11
mov edx, 1
lea rcx, str.Running_on_a_DC._n
call sub.cygwin1.dll_fwrite
mov r10d, dword [rbp]
test r10d, r10d
je 0x1004017f2
call sub.cygwin1.dll_getpid
movsxd r12, eax
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], r12
mov r9d, 0x180
lea r8, str.ext_lm_group_acl.cc
lea rdx, str._s__d_:_pid_ld_:
call sub.cygwin1.dll_fprintf
mov r12, qword [rsp + 0x50]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r9, r13
mov r8, r12
lea rdx, str.Using__S_as_DC_for__S_local_domain._n
call sub.cygwin1.dll_fprintf
jmp 0x1004017f2
mov rcx, rsi
lea r12, [rsp + 0x90]
call sub.cygwin1.dll_strlen
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], r12
lea r9d, [rax + 1]
mov r8, rsi
xor edx, edx
xor ecx, ecx
call rbx
mov r9d, dword [0x100409028]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
mov rdx, r12
test r9d, r9d
je 0x100401c40
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
je 0x100401813
mov rbx, qword [0x100409020]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r9, rsi
mov r8, rbx
lea rdx, str._s:_ERROR:_Cant_find_DC_for_users_domain__s_n
call sub.cygwin1.dll_fprintf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x100401ba5
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100401bb4
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x100401a49
jmp 0x100401a4e
call sub.cygwin1.dll_getpid
movsxd rbx, eax
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov r9d, 0x193
lea r8, str.ext_lm_group_acl.cc
lea rdx, str._s__d_:_pid_ld_:
call sub.cygwin1.dll_fprintf
mov rbx, qword [rsp + 0x58]
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov r9, rsi
mov r8, rbx
lea rdx, str.Using__S_as_DC_for__s_users_domain._n
call sub.cygwin1.dll_fprintf
jmp 0x10040181e
mov rcx, qword [rsp + 0x68]
xor r13d, r13d
test rcx, rcx
jne 0x1004019b4
jmp 0x1004019cb
call sub.NETAPI32.dll_NetGetAnyDCName
jmp 0x100401b6c
mov rcx, qword [rsp + 0x68]
xor r13d, r13d
test rcx, rcx
jne 0x1004019b4
jmp 0x1004019c3