Function at 0x140008b80
Capabilities:
Get domain controller name
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rdi, rcx
lea r12, [rcx + 8]
mov rax, qword [r12]
cmp dword [rax - 0x10], 0
jne 0x140008bb0
xor eax, eax
jmp 0x14000907e
lea rbp, [rcx + 0x18]
mov rcx, qword [rbp]
xor r14d, r14d
test rcx, rcx
je 0x140008bca
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp], r14
cmp dword [rdi + 0x10], r14d
je 0x140008bf5
mov rdx, rbp
mov rcx, qword [r12]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x140008bee
mov qword [rbp], r14
mov eax, 6
jmp 0x14000907e
xor eax, eax
jmp 0x14000907e
call fcn.14001f9e0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140008c15
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xc8], rsi
call fcn.14001f9e0
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140008c4a
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov rcx, qword [r12]
or rbx, 0xffffffffffffffff
cmp dword [rcx - 0x10], 0
jl 0x140008d42
lea rdx, [0x14004c074]
call fcn.1400305a4
test rax, rax
je 0x140008d42
sub rax, qword [r12]
sar rax, 1
cmp eax, ebx
je 0x140008d42
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.1400030b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x140008d07
cmp dword [rsi + 0x10], 0
jl 0x140008cf5
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140008cf5
call fcn.140002780
mov rdi, rax
mov ecx, ebx
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140008ce7
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0xc8], rax
jmp 0x140008d07
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xc8]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140008d35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
jmp 0x140008d42
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
cmp dword [rsi - 0x10], 0
je 0x140008ed9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x140008ed9
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140008d86
mov ecx, r14d
jmp 0x140008d97
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0xc8]
call fcn.140003420
mov r8d, 2
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xc8]
call fcn.1400030b0
xor edx, edx
lea rdi, [0x14004bcb0]
mov rsi, qword [rax]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140008dda
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete dil
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140008dff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140008ea9
mov rdi, qword [rsp + 0xc8]
mov r8d, dword [rdi - 0x10]
add r8d, 0xfffffffe
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
call fcn.140003010
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140008e8a
cmp dword [rdi + 0x10], 0
jl 0x140008e78
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140008e78
call fcn.140002780
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140008e6a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0xc8], rax
jmp 0x140008e8a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xc8]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140008ea9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140008ecc
call sub.NETAPI32.dll_NetApiBufferFree
mov qword [rsp + 0x48], r14
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
jmp 0x140008ed9
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0xb8], r14d
mov dword [rsp + 0xb0], r14d
mov rcx, rsi
cmp dword [rsi - 0x10], 0
cmove rcx, r14
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb8]
xor r8d, r8d
mov rdx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [rsp + 0xb8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
cmp dword [rsi - 0x10], 0
cmove rsi, r14
mov r8d, 1
sub r8d, dword [rdi - 8]
mov ecx, dword [rdi - 0xc]
mov edx, dword [rsp + 0xb0]
sub ecx, edx
or ecx, r8d
jge 0x140008f6f
lea rcx, [rsp + 0x40]
call fcn.140002720
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xb8]
mov r8, r13
mov rdx, qword [r12]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x140008fb6
mov rcx, r13
call fcn.140001ea0
mov qword [rbp], rax
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.140030ec8
test eax, eax
js 0x140009073
cmp eax, dword [rdi - 0xc]
jg 0x140009073
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r14w
test r13, r13
je 0x140008feb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rbp], 0
je 0x140009031
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000900d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000902d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14000907e
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000904c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14000906c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 6
jmp 0x14000907e
mov ecx, 0x80070057
call fcn.140001000
nop
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret