Function at 0x1800226d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2e00
call fcn.18002add0
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x2e38], rbx
mov qword [rsp + 0x2e40], rsi
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x2df0], rax
mov rdi, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0xe8], rcx
mov byte [rsp + 0x5f0], 0
xor edx, edx
mov r8d, 0x27ff
lea rcx, [rsp + 0x5f1]
call fcn.1800292e0
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x40], rbx
mov ecx, 0x208
call fcn.180027e84
mov rsi, rax
mov qword [rsp + 0xd0], rax
mov r14d, ebx
test rdi, rdi
je 0x1800227e1
cmp dword [0x18009caf4], 6
jl 0x180022783
lea rcx, str.DGWin2k:_Inside_ShowDomainUserGroupsWin2k.
call fcn.1800169b0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [0x18007f5c0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [0x180076308]
call sub.ACTIVEDS.dll_ADsOpenObject
test eax, eax
jns 0x1800227e8
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800227c4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call fcn.180027f2c
cmp dword [0x18009caf4], 6
jl 0x1800227e1
lea rcx, str.DGWin2k:_Could_not_open_RootDSE.
call fcn.1800169b0
xor eax, eax
jmp 0x1800231bf
cmp dword [0x18009caf4], 6
jl 0x1800227fd
lea rcx, str.DGWin2k:_Grabbed_RootDSE.
call fcn.1800169b0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x110]
lea rdx, [0x1800767e0]
call qword [rax + 0x78]
test eax, eax
js 0x18002319d
cmp dword [0x18009caf4], 6
jl 0x180022834
lea rcx, str.DGWin2k:_Grabbed_defaultNamingContext.
call fcn.1800169b0
lea r8, [0x180076858]
mov edx, 0x104
mov rcx, rsi
call fcn.18002caec
mov r8, qword [rsp + 0x118]
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bx
jne 0x180022854
cmp rax, 0x104
jae 0x18002315a
mov edx, 0x104
mov rcx, rsi
call fcn.18002ca64
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18007f5d0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call sub.ACTIVEDS.dll_ADsOpenObject
test eax, eax
js 0x180023125
cmp dword [0x18009caf4], 6
jl 0x1800228bd
lea rcx, str.DGWin2k:_Opened_object.
call fcn.1800169b0
mov dword [rsp + 0x150], 5
mov dword [rsp + 0x158], 7
mov dword [rsp + 0x160], 2
mov dword [rsp + 0x178], 7
mov dword [rsp + 0x180], 7
mov dword [rsp + 0x188], 0x3e8
mov ecx, 0x208
call fcn.180027e84
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, [rsp + 0x150]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jns 0x180022996
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180022943
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xc8]
call fcn.180027f2c
mov rcx, rsi
call fcn.180027f2c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180022968
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [0x18009caf4], 6
jl 0x1800227e1
lea rcx, str.DGWin2k:_Could_not_setsearchpreference.
call fcn.1800169b0
xor eax, eax
jmp 0x1800231bf
lea rax, [0x18007a3f0]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 1
lea r8, [rsp + 0xe0]
lea rdx, str.__objectCategoryperson__objectClassuser__
call qword [rax + 0x20]
mov ebx, eax
test eax, eax
js 0x1800230c0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
call qword [rax + 0x30]
mov ebx, eax
test eax, eax
js 0x1800230ab
lea rsi, [0x18007a670]
lea rdi, [0x18007f5e0]
test ebx, ebx
jne 0x1800230a3
mov dword [rsp + 0x58], 1
inc r14d
mov dword [rsp + 0x48], r14d
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x1a0]
lea r8, str.ADsPath
mov rdx, qword [rsp + 0x70]
call qword [rax + 0x50]
test eax, eax
js 0x18002308c
cmp dword [0x18009caf4], 6
jl 0x180022a55
lea rcx, str.Alloc_pADsUser
call fcn.1800169b0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1b0]
mov rcx, qword [rcx + 8]
call sub.ACTIVEDS.dll_ADsOpenObject
mov ebx, eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x1a0]
call qword [rax + 0x58]
test ebx, ebx
js 0x18002308c
mov r12d, 1
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x108], rsi
cmp dword [0x18009caf4], 6
jl 0x180022ac5
lea rcx, str.Alloc_username
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
call qword [rax + 0x38]
mov rax, qword [rsp + 0x90]
test rax, rax
jne 0x180022b0a
cmp dword [0x18009caf4], 6
jl 0x180022afa
lea rcx, str.DGWin2k:_Could_not_get_Name.
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180022a01
mov qword [rsp + 0x20], rax
lea r9, [0x180073ea4]
or r8, 0xffffffffffffffff
mov edx, 0x2800
lea rcx, [rsp + 0x5f0]
call fcn.180029e64
lea rax, [rsp + 0x5f0]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180022b40
mov qword [rsp + 0xb8], rdi
cmp dword [0x18009caf4], 6
jl 0x180022b66
lea rcx, str.Free_username
call fcn.1800169b0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [0x18009caf4], 6
jl 0x180022b89
lea rcx, str.Alloc_vTokenGroups_
call fcn.1800169b0
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0xa0]
mov edx, r12d
lea rcx, [rsp + 0x108]
call sub.ACTIVEDS.dll_ADsBuildVarArrayStr
mov ebx, eax
test eax, eax
jns 0x180022bda
cmp dword [0x18009caf4], 6
jl 0x180022bca
lea rcx, str.DGWin2k:_Couldnt_buildvararraystr.
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1800229fa
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x130], xmm0
movsd xmm1, qword [rsp + 0xb0]
movsd qword [rsp + 0x140], xmm1
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x130]
call qword [rax + 0x98]
mov ebx, eax
cmp dword [0x18009caf4], 6
jl 0x180022c2c
lea rcx, str.Free_vTokenGroups
call fcn.1800169b0
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x180022c53
cmp dword [0x18009caf4], 6
jl 0x180022bca
lea rcx, str.DGWin2k:_Couldnt_getinfoex.
jmp 0x180022bc5
cmp dword [0x18009caf4], 6
jl 0x180022c7d
lea rcx, str.DGWin2k:_Getting_tokengroups.
call fcn.1800169b0
cmp dword [0x18009caf4], 6
jl 0x180022c7d
lea rcx, str.Alloc_vtokengroups_again_
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r8, [rsp + 0xa0]
lea rdx, str.TokenGroups
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
jns 0x180022cd0
cmp dword [0x18009caf4], 6
jl 0x180022cb2
lea rcx, str.DGWin2k:_Could_not_get_tokengroups.
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1800229fa
mov r13, qword [rsp + 0xa8]
mov qword [rsp + 0x100], r13
mov r15d, dword [r13 + 0x18]
mov dword [rsp + 0x88], r15d
mov r14d, dword [r13 + 0x1c]
cmp dword [0x18009caf4], 6
jl 0x180022d05
lea rcx, str.Alloc_pArray
call fcn.1800169b0
lea rdx, [rsp + 0xf0]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov ebx, eax
test eax, eax
jns 0x180022d54
cmp dword [0x18009caf4], 6
jl 0x180022d31
lea rcx, str.DGWin2k:_Couldnt_SafeArrayAccessData.
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov r14d, dword [rsp + 0x48]
jmp 0x1800229fa
cmp dword [0x18009caf4], 6
jl 0x180022d6f
mov r8d, r15d
mov edx, r14d
lea rcx, str.DGWin2k:_about_to_loop_through_sids._lbound_is__d_nosids_is__d
call fcn.1800169b0
mov dword [rsp + 0x78], r14d
cmp r14d, r15d
jae 0x180022fc4
mov byte [rsp + 0x1d0], 0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x1d1]
call fcn.1800292e0
mov byte [rsp + 0x3e0], 0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x3e1]
call fcn.1800292e0
cmp dword [0x18009caf4], 6
jl 0x180022dcc
lea rcx, str.Alloc_psid
call fcn.1800169b0
mov eax, r14d
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0xf0]
lea rcx, [rax + rcx*8]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0xc0]
call fcn.180024890
test eax, eax
jns 0x180022e1e
cmp dword [0x18009caf4], 6
jl 0x180022fc4
mov rdx, qword [rsp + 0x90]
lea rcx, str.DGWin2k:_VarToBytes_bugged_out._The_UserName_is__S
call fcn.1800169b0
jmp 0x180022fc4
cmp dword [0x18009caf4], 6
jl 0x180022e34
lea rcx, str.Attempting_sid_translation
call fcn.1800169b0
nop
mov dword [rsp + 0x8c], 0x200
mov dword [rsp + 0x98], 0x200
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8c]
lea r8, [rsp + 0x1d0]
mov rsi, qword [rsp + 0xc0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
nop
mov rcx, qword [rsp + 0x80]
jmp 0x180022ed9
lea rax, [rsp + 0x1d0]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180022ee5
test rbx, rbx
je 0x180022f9a
lea rax, [rbx + rdi]
cmp rax, 0x27fe
jb 0x180022f44
xor r9d, r9d
cmp dword [rsp + 0x58], r9d
je 0x180022f29
lea r8d, [rdi - 3]
lea rdx, [rsp + 0x5f3]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x58], 0
jmp 0x180022f3a
mov r8d, edi
lea rdx, [rsp + 0x5f0]
call qword [sym.imp.WS2_32.dll_send]
mov byte [rsp + 0x5f0], 0
xor edi, edi
test r12d, r12d
jne 0x180022f69
or r9, 0xffffffffffffffff
lea r8, [0x180073f54]
mov edx, 0x2800
lea rcx, [rsp + 0x5f0]
call fcn.180029f1c
inc rdi
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x1d0]
mov edx, 0x2800
lea rcx, [rsp + 0x5f0]
call fcn.180029f1c
add rdi, rbx
mov qword [rsp + 0xb8], rdi
xor r12d, r12d
mov dword [rsp + 0x68], r12d
test rsi, rsi
je 0x180022fbc
cmp dword [0x18009caf4], 6
jl 0x180022fb4
lea rcx, str.Releasing_pSID
call fcn.1800169b0
mov rcx, rsi
call fcn.180029620
inc r14d
jmp 0x180022d6f
or r9, 0xffffffffffffffff
lea r8, [0x180073fac]
mov edx, 0x2800
lea rcx, [rsp + 0x5f0]
call fcn.180029f1c
xor r9d, r9d
mov rcx, qword [rsp + 0x80]
cmp dword [rsp + 0x58], r9d
je 0x180023001
lea r8d, [rdi - 2]
lea rdx, [rsp + 0x5f3]
jmp 0x18002300d
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x5f0]
call qword [sym.imp.WS2_32.dll_send]
cmp dword [0x18009caf4], 6
jl 0x180023028
lea rcx, str.Releasing_pArray
call fcn.1800169b0
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
cmp dword [0x18009caf4], 6
jl 0x180023046
lea rcx, str.Releasing_vTokenGroups
call fcn.1800169b0
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [0x18009caf4], 6
jl 0x180023069
lea rcx, str.Releasing_PADSUser
call fcn.1800169b0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180023079
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdi, [0x18007f5e0]
lea rsi, [0x18007a670]
mov r14d, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
call qword [rax + 0x38]
mov ebx, eax
jmp 0x180022a01
mov rsi, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1800230c0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1800230d2
call fcn.180027f2c
test ebx, ebx
js 0x1800230f2
test r14d, r14d
je 0x1800230e0
cmp ebx, 1
jne 0x18002313a
cmp dword [0x18009caf4], 6
jl 0x18002313a
lea rcx, str.No_user_object_could_be_found
jmp 0x180023135
cmp ebx, 0x8007203e
jne 0x18002310c
cmp dword [0x18009caf4], 6
jl 0x18002313a
lea rcx, str.Could_not_execute_query._An_invalid_filter_was_specified.
jmp 0x180023135
cmp dword [0x18009caf4], 6
jl 0x18002313a
mov edx, ebx
lea rcx, str.Query_failed_to_run._HRESULT:__x
call fcn.1800169b0
jmp 0x18002313a
cmp dword [0x18009caf4], 6
jl 0x18002313a
lea rcx, str.Could_not_execute_query._Could_not_bind_to_the_container.
call fcn.1800169b0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18002314a
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x18002319d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18002316a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call fcn.180027f2c
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [0x18009caf4], 6
jl 0x1800227e1
lea rcx, str.DGWin2k:_Tiny_buffer._Out_of_here.
call fcn.1800169b0
xor eax, eax
jmp 0x1800231bf
test rsi, rsi
je 0x1800231aa
mov rcx, rsi
call fcn.180027f2c
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800231ba
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, 1
mov rcx, qword [rsp + 0x2df0]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x2e00]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret