Function at 0x1009fff
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [0x1012ca8], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], 0x1f61
mov dword [ebp - 0x34], 0x1f62
mov dword [ebp - 0x30], 0x1f63
mov dword [ebp - 0x2c], 0x1f64
mov dword [ebp - 0x28], 0x1f65
je 0x100a05d
push dword [ebp + 8]
push 0x2ee1
call fcn.0100371a
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
push 0x10
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x100a1cd
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, edi
je 0x100a0b7
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
je 0x100a0af
mov word [eax], di
add eax, 2
cmp word [eax], di
mov dword [ebp - 8], eax
jne 0x100a0ab
push 0x57
pop eax
jmp 0x100a201
mov ebx, dword [esi]
jmp 0x100a0b7
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
push ebx
push dword [ebp - 8]
call dword [sym.imp.NTDSAPI.dll_DsMakePasswordCredentialsW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x100a1cd
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
push edi
push dword [eax]
call dword [sym.imp.NTDSAPI.dll_DsBindWithCredW]
push dword [ebp - 0x20]
mov dword [ebp - 4], eax
call dword [sym.imp.NTDSAPI.dll_DsFreePasswordCredentials]
cmp dword [ebp - 4], edi
jne 0x100a1cd
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.NTDSAPI.dll_DsListRolesW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x100a1cd
lea eax, [ebp - 0x38]
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
add eax, ecx
cmp dword [eax], edi
jne 0x100a1bb
push 0x2c
push dword [eax + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
je 0x100a146
inc ebx
inc ebx
jmp 0x100a153
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov ebx, dword [eax + ecx + 8]
cmp dword [ebp - 0x18], edi
jne 0x100a186
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
sub eax, ecx
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x486
push dword [esi + 4]
push dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, 4
push eax
call fcn.0100b0f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jne 0x100a1bb
lea eax, [ebp - 0x1c]
push eax
push 0x1001548
push ebx
push dword [ebp - 0x18]
call fcn.0100b1f0
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x100a1bb
push dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0100371a
pop ecx
pop ecx
push dword [ebp - 0x1c]
call sub.NETAPI32.dll_NetApiBufferFree
add dword [ebp + 8], 0xc
add dword [ebp + 0xc], 4
cmp dword [ebp + 8], 0x3c
jb 0x100a11c
cmp dword [ebp - 0x10], edi
je 0x100a1dc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.NTDSAPI.dll_DsUnBindW]
cmp dword [ebp - 0xc], edi
je 0x100a1ea
push dword [ebp - 0xc]
call dword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
mov eax, dword [ebp - 0x24]
cmp eax, edi
je 0x100a1f6
mov word [eax], 0x5c
push dword [ebp - 0x14]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8