Function at 0x406f20
Capabilities:
Get domain controller name
Get user security identifier

Disassembly:
push 0xffffffffffffffff
push 0x435cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x448fb0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov eax, dword [eax - 0xc]
lea ebp, [edi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x407241
mov eax, dword [edi + 0xc]
lea esi, [edi + 0xc]
mov dword [esp + 0x2c], esi
cmp eax, ebx
je 0x406f73
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], ebx
cmp dword [edi + 8], ebx
je 0x406fa5
mov ebp, dword [ebp]
push esi
push ebp
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x407241
mov dword [esi], ebx
mov eax, 6
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
call fcn.0041583d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406fbf
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov dword [esp + 0x44], ebx
call fcn.0041583d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406fed
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x28], esi
mov eax, dword [ebp]
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
mov byte [esp + 0x44], 1
jl 0x407071
push 0x4397d4
push eax
call fcn.0042184b
add esp, 8
cmp eax, ebx
je 0x407071
sub eax, dword [ebp]
sar eax, 1
cmp eax, 0xffffffff
je 0x407071
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call fcn.00402f40
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 2
call fcn.00403eb0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x44], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40706d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x18]
cmp dword [edi - 0xc], ebx
je 0x407120
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x407120
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404c20
push 2
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x20]
call fcn.00402f40
push 0x4395c4
push eax
call fcn.00402470
add esp, 8
lea ecx, [esp + 0x30]
mov byte [esp + 0x17], al
call fcn.00402640
cmp byte [esp + 0x17], 0
je 0x40710a
mov edx, dword [esp + 0x18]
mov eax, dword [edx - 0xc]
add eax, 0xfffffffe
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
call fcn.00402ec0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 3
call fcn.00403eb0
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 1
call fcn.00402640
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40711c
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [esp + 0x1c], ebx
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp]
lea edx, [esp + 0x34]
push edx
lea edx, [esp + 0x24]
push edx
push ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov eax, dword [edi - 0xc]
lea edx, [esp + 0x30]
push edx
neg eax
push ebx
sbb eax, eax
and eax, edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov eax, dword [esp + 0x24]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov eax, dword [edi - 0xc]
neg eax
sbb eax, eax
and eax, edi
mov dword [esp + 0x38], eax
mov eax, dword [esi - 8]
sub eax, dword [esp + 0x20]
mov ecx, 1
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x40718e
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004026e0
mov esi, dword [esp + 0x28]
mov ebp, dword [ebp]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x4071c1
push ebx
call fcn.00401dd0
mov ecx, dword [esp + 0x30]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00421ff5
add esp, 8
test eax, eax
jl 0x407297
cmp eax, dword [esi - 8]
jg 0x407297
xor edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], dx
test ebx, ebx
je 0x4071f3
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x2c]
add esi, 0xfffffff0
or edx, 0xffffffff
cmp dword [eax], 0
mov byte [esp + 0x44], 0
lea ecx, [esi + 0xc]
je 0x407257
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40721d
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add edi, 0xfffffff0
mov dword [esp + 0x44], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407241
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40726a
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add edi, 0xfffffff0
mov dword [esp + 0x44], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406f8c
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
jmp 0x406f8c
push 0x80070057
call fcn.00401090
int3