Function at 0x4ee760
Capabilities:
List groups for user account
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x884
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.Get_users_infomation_...
mov ecx, 0xf558a0
mov dword [ebp - 4], ebx
mov dword [eax], ebx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push 0x80
call fcn.004f266a
mov edi, eax
mov ecx, 0x20
xor eax, eax
mov dword [ebp - 0x1c], edi
rep stosd dword es:[edi], eax
add esp, 4
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004ec240
add esp, 4
mov ecx, 0xf558a0
push str.the_result1_is
call fcn.004f0087
mov edx, dword [ebp - 0x1c]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x50]
push eax
lea edx, [ebp - 0x38]
push ecx
mov eax, 0x1f40
push edx
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, 2
push eax
mov eax, 1
push eax
push ebx
call sub.NETAPI32.dll_NetUserEnum
mov esi, eax
mov ecx, 0xf558a0
push esi
mov dword [ebp - 0x34], esi
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
cmp esi, ebx
je 0x4ee8a4
push esi
call fcn.004ec1b0
add esp, 4
mov ecx, 0xf558a0
push str.NetUserEnum:_Failed.
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
or ax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.er_
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x38]
cmp eax, ecx
jge 0x4eefb0
push 0x2c
call fcn.004f266a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4eef99
mov ecx, 0xb
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4ee915
mov dword [ebp - 0x2c], ebx
jmp 0x4ee91b
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x28], ebx
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x40]
push edx
mov edx, dword [ebp - 0x18]
push eax
mov eax, 0x7d0
push eax
lea ecx, [ebp - 0x3c]
mov eax, 1
push ecx
push eax
xor eax, eax
push eax
mov eax, dword [edx]
push eax
push 0
mov dword [ebp - 0x20], ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
mov dword [ebp - 0x48], eax
je 0x4ee987
push str.NetUserGetLocalGroups:_Failed.
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push esi
call fcn.004ec1b0
push 0x530574
call fcn.004fa6c0
add esp, 8
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x4ee998
push 0x530558
jmp 0x4eea53
mov ecx, dword [ebp - 0x3c]
mov edi, 0x530544
mov dword [ebp - 0x14], ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x890]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
jge 0x4eea4c
mov edx, dword [ebp - 0x14]
push 0x100
lea ecx, [ebp - 0x590]
mov eax, dword [edx]
push eax
push ecx
call fcn.004f35d0
lea edx, [ebp - 0x590]
lea eax, [ebp - 0x190]
push edx
push str.___s__
push eax
call fcn.004f175f
lea edi, [ebp - 0x190]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x890]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
add ecx, 4
inc eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jmp 0x4ee9cd
lea eax, [ebp - 0x890]
push eax
call fcn.004fa6c0
add esp, 4
mov dword [ebx + 0xc], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x18]
mov dword [ebx], eax
push 0x100
lea ecx, [ebp - 0x690]
mov eax, dword [edx]
push eax
push ecx
call fcn.004f35d0
lea edx, [ebp - 0x690]
push edx
call fcn.004fa6c0
mov dword [ebx + 4], eax
mov edi, 0x530524
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x150]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.__Guestf__
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 0xc]
and ecx, 1
cmp cl, 1
jne 0x4eeb28
mov edi, str.__Userf__
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
and ecx, 2
cmp cl, 2
jne 0x4eeb66
mov edi, str.__Administratorf__
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
mov ecx, eax
mov dword [ebp - 0x14], eax
and ecx, 1
cmp cl, 1
jne 0x4eebac
mov edi, 0x5304d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 2
cmp cl, 2
jne 0x4eebe9
mov edi, 0x5304c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x20
cmp cl, 0x20
jne 0x4eec26
mov edi, 0x5304ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x40
cmp cl, 0x40
jne 0x4eec63
mov edi, 0x530488
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
jne 0x4eeca0
mov edi, 0x530474
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x10000
cmp ecx, 0x10000
jne 0x4eece3
mov edi, 0x530460
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x200
cmp ecx, 0x200
jne 0x4eed26
mov edi, 0x53044c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x100
cmp ecx, 0x100
jne 0x4eed69
mov edi, 0x530438
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x1000
cmp ecx, 0x1000
jne 0x4eedac
mov edi, 0x530418
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
and ecx, 0x2000
cmp ecx, 0x2000
jne 0x4eedef
mov edi, 0x5303f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and eax, 0x800
cmp eax, 0x800
jne 0x4eee2b
mov edi, 0x5303d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x150]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0x18]
mov dword [ebx + 8], eax
push 0x5303c4
mov edx, dword [ecx + 8]
mov dword [ebx + 0x14], edx
call fcn.004fa6c0
mov dword [ebx + 0x10], eax
mov edi, str.NULL
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x290]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x100
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x290]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
push eax
call fcn.004f35d0
add esp, 0x14
mov ecx, 0xf558a0
push str.gcos
call fcn.004f0087
lea ecx, [ebp - 0x290]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x290]
push edx
call fcn.004fa6c0
mov dword [ebx + 0x20], eax
mov edi, str.NULL
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x390]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x100
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x390]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
push edx
push eax
call fcn.004f35d0
lea ecx, [ebp - 0x390]
push ecx
call fcn.004fa6c0
mov dword [ebx + 0x1c], eax
mov edi, str.NULL
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x490]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x100
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x490]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x1c]
push edx
push eax
call fcn.004f35d0
lea ecx, [ebp - 0x490]
push ecx
call fcn.004fa6c0
push 0x5303b0
mov dword [ebx + 0x18], eax
call fcn.004fa6c0
add esp, 0x28
mov dword [ebx + 0x24], eax
mov edx, dword [ebp - 0x3c]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x34]
test eax, eax
jne 0x4ee8ea
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
add ecx, 0x20
inc eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], eax
xor ebx, ebx
jmp 0x4ee8dc
mov eax, dword [ebp - 0x30]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
cmp esi, ebx
jne 0x4ee811
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
push eax
mov dword [ecx], edx
call fcn.004f265f
add esp, 4
mov ecx, 0xf558a0
push str.Success.
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret