Function at 0x1009d9d
Capabilities:
Get domain trust relationships

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
push 0xb
pop ecx
xor esi, esi
push esi
push esi
xor eax, eax
push esi
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.01005ee9
cmp eax, esi
mov dword [ebp + 0x10], eax
jne 0x1009f73
cmp dword [ebp + 0x14], esi
jne 0x1009f5b
cmp dword [ebp - 0x4c], esi
je 0x1009f5b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x23
push dword [ebp - 0x68]
call dword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsW]
cmp eax, esi
mov dword [ebp + 0x10], eax
jne 0x1009f6a
cmp dword [ebp - 0xc], esi
je 0x1009e21
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x1f74
push eax
call fcn.0100371a
pop ecx
cmp dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
jbe 0x1009f51
mov dword [ebp - 8], esi
push ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, ecx
mov ecx, dword [eax + 4]
cmp ecx, esi
mov ebx, ecx
jne 0x1009e44
mov ebx, dword [eax]
mov eax, dword [ebp - 0x64]
push dword [eax + 4]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1009f3d
push 0xb
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
test byte [edi + eax + 8], 0x22
jne 0x1009e97
push 1
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
push esi
push ebx
call fcn.01005ee9
or dword [ebp - 0x24], 0x14
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], 3
jmp 0x1009ec9
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call fcn.010094cf
cmp eax, esi
mov dword [ebp + 0x10], eax
jne 0x1009ec6
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.01009b76
mov dword [ebp + 8], eax
jmp 0x1009ec9
mov dword [ebp + 0x14], esi
cmp dword [ebp + 8], esi
jne 0x1009f15
cmp dword [ebp + 0x18], esi
je 0x1009ef6
test byte [ebp - 0x24], 0xa
jne 0x1009ef6
mov eax, dword [ebp - 4]
test byte [edi + eax + 8], 2
je 0x1009ef6
push esi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.010088e7
mov dword [ebp + 8], eax
jmp 0x1009efa
or dword [ebp + 8], 0xffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push dword [ebp + 0x14]
push esi
push eax
call fcn.01009cc3
lea eax, [ebp - 0x3c]
push eax
call fcn.01005e60
jmp 0x1009f3d
cmp dword [ebp + 0x18], esi
jne 0x1009f1e
or dword [ebp + 8], 0xffffffff
mov eax, dword [ebp - 4]
add eax, edi
mov ecx, dword [eax + 4]
cmp ecx, esi
je 0x1009f2e
mov eax, ecx
jmp 0x1009f30
mov eax, dword [eax]
push dword [ebp + 8]
push dword [ebp + 0x14]
push eax
push esi
call fcn.01009cc3
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x2c
cmp eax, dword [ebp - 0xc]
jb 0x1009e31
pop ebx
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1009f6a
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 8]
call fcn.010096a9
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x68]
push eax
call fcn.01005e60
mov eax, dword [ebp + 0x10]
pop edi
pop esi
leave
ret 0x14