Function at 0x1087216
Capabilities:
Get domain information

Disassembly:
push 0x3c
mov eax, 0x10c2279
call fcn.01077de8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
call fcn.010b3ce7
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
xor edi, edi
inc edi
push edi
push ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
cmp eax, ebx
je 0x108728e
jle 0x1087281
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0xbf400ca
jmp 0x1087418
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x108740d
cmp ecx, 2
je 0x108740d
lea ecx, [ebp - 0x34]
push ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x48
push dword [eax + 0x10]
call fcn.010a7f5c
mov esi, eax
cmp esi, ebx
je 0x10872c8
push esi
push 0xc0700ca
jmp 0x1087418
push 0x101ac48
lea ecx, [ebp - 0x2c]
call fcn.010b3c3e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.010b3d25
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call esi
test eax, eax
jne 0x1087315
call fcn.01091f1e
mov esi, eax
push esi
push 0xc1700ca
jmp 0x1087418
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push edi
lea eax, [ebp - 0x18]
push eax
call esi
test eax, eax
jne 0x108733f
call fcn.01091f1e
mov esi, eax
push esi
push 0xc2300ca
jmp 0x1087418
push edi
push 0x101ac14
call fcn.010a72b9
mov esi, eax
cmp esi, ebx
je 0x108735b
push esi
push 0xc2700ca
jmp 0x1087418
push dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x48], edi
call fcn.01086dec
mov esi, eax
cmp esi, ebx
je 0x108737e
push esi
push 0xc2d00ca
jmp 0x1087418
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x44], edi
call fcn.01086a8b
mov esi, eax
cmp esi, ebx
je 0x108739f
push esi
push 0xc3200ca
jmp 0x1087418
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call fcn.010870b9
mov esi, eax
cmp esi, ebx
je 0x10873bc
push esi
push 0xc3800ca
jmp 0x1087418
cmp dword [ebp + 8], ebx
je 0x10873e7
cmp dword [ebp - 0x3c], ebx
jne 0x108741d
push edi
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x40]
push eax
push dword [ebp - 0x1c]
call fcn.01086f48
mov esi, eax
cmp esi, ebx
je 0x108741d
push esi
push 0xc4000ca
jmp 0x1087418
cmp dword [ebp - 0x3c], ebx
je 0x108741d
push ebx
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x40]
push eax
push dword [ebp - 0x1c]
call fcn.01086f48
mov esi, eax
cmp esi, ebx
je 0x108741d
push esi
push 0xc4900ca
jmp 0x1087418
mov esi, 0x8000ffff
push esi
push 0xbfb00ca
call fcn.0108c503
cmp dword [ebp - 0x24], ebx
je 0x108742a
push dword [ebp - 0x24]
call sub.NETAPI32.dll_DsRoleFreeMemory
lea eax, [ebp - 0x20]
push eax
call fcn.0109c95a
cmp dword [ebp - 0x44], ebx
je 0x1087452
push dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
call fcn.01086dec
push eax
push 0xc5900ca
call fcn.0108c503
push dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push dword [ebp - 0x38]
call edi
cmp dword [ebp - 0x48], ebx
je 0x1087472
push ebx
push 0x101ac14
call fcn.010a72b9
push dword [ebp - 0x34]
push ebx
push dword [ebp - 0x1c]
call fcn.010a740a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.010b3b70
mov eax, esi
call fcn.01077e7a
ret 8