Function at 0x1800213c0
Capabilities:
List user account groups
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rbx, rcx
lea rcx, [rbp + 0x161]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x160], 0
call fcn.1800292e0
xor r14d, r14d
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x50], r14d
mov byte [rbp + 0x60], r14b
call fcn.1800292e0
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x60], r14b
call fcn.1800292e0
cmp dword [0x18009caf4], 5
jl 0x180021460
lea rcx, str.ShowLocalGroupMembers
call fcn.1800169b0
nop word [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetLocalGroupEnum
mov rsi, qword [rsp + 0x48]
mov edi, eax
test eax, eax
je 0x1800214dc
cmp eax, 5
je 0x1800214d3
cmp eax, 0xea
je 0x1800214ca
cmp eax, 0x84b
je 0x1800214c1
cmp eax, 0x92f
jne 0x1800214e8
lea rcx, [0x180073b08]
jmp 0x1800214e3
lea rcx, str.NERR_BufTooSmall
jmp 0x1800214e3
lea rcx, [0x180073a30]
jmp 0x1800214e3
lea rcx, [0x180073a40]
jmp 0x1800214e3
lea rcx, [0x180073a58]
call fcn.1800169b0
cmp dword [0x18009caf4], 5
jl 0x18002151b
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x40]
lea rcx, str.NetLocalGroupEnum:_dwEntriesRead___d__dwTotalEntries___d_
call fcn.1800169b0
cmp dword [0x18009caf4], 5
jl 0x18002151b
lea rcx, str.grabbed_list_of_groups__now_checking_members
call fcn.1800169b0
cmp dword [rsp + 0x40], r14d
je 0x1800216a3
nop word [rax + rax]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x60]
mov r8, qword [r8]
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xfe
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rbp + 0x60]
lea r9, [0x180072294]
lea rcx, [rbp + 0x160]
or r8, 0xffffffffffffffff
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.180029e64
lea rax, [rbp + 0x160]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x180021591
lea rdx, [rbp + 0x160]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x38], r14
mov r8, qword [r8 + 8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xfe
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r14b
jne 0x1800215f0
test rax, rax
jne 0x180021618
lea r8, [0x1800722ac]
lea rcx, [rsp + 0x60]
or r9, 0xffffffffffffffff
mov edx, 0xff
call fcn.18002a5b4
lea rax, [rsp + 0x60]
lea r9, [0x1800722d4]
lea rcx, [rbp + 0x160]
or r8, 0xffffffffffffffff
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.180029e64
lea rax, [rbp + 0x160]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x180021650
lea rdx, [rbp + 0x160]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.180021720
xor r9d, r9d
lea rdx, [0x1800722fc]
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
add qword [rsp + 0x48], 0x10
dec dword [rsp + 0x40]
jne 0x180021530
test rsi, rsi
je 0x1800216b0
mov rcx, rsi
call sub.NETAPI32.dll_NetApiBufferFree
cmp edi, 0xea
je 0x180021460
cmp dword [0x18009caf4], 5
jl 0x1800216d1
lea rcx, str.finished_ShowLocalGroupMembers
call fcn.1800169b0
xor r9d, r9d
lea rdx, [0x1800726e4]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret