Got user flag, actually really simple, thanks to @xpwn for the tips.
Now to lose myself in my first Win PrivEsc… gulp!*