Function at 0x100023bb
Capabilities:
Get domain controller name
Get domain information
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3134
call fcn.10035de0
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x3107]
push 0x27ff
mov esi, ecx
mov byte [ebp - 0x3108], bl
push ebx
push eax
mov dword [ebp - 0x3130], esi
call fcn.10023400
add esp, 0xc
mov dword [ebp - 0x3114], ebx
mov edi, 0xff
mov byte [ebp - 0x308], bl
lea eax, [ebp - 0x307]
push edi
push ebx
push eax
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x408], bl
lea eax, [ebp - 0x407]
push edi
push ebx
push eax
call fcn.10023400
add esp, 0xc
lea eax, [ebp - 0x3114]
push eax
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_NetGetDCName]
test eax, eax
jne 0x10002bf3
push edi
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], bl
push ebx
push eax
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x108], bl
lea eax, [ebp - 0x107]
push edi
push ebx
push eax
call fcn.10023400
add esp, 0xc
cmp dword [ebp - 0x3114], ebx
je 0x10002c07
or edi, 0xffffffff
lea eax, [ebp - 0x908]
push edi
push dword [ebp - 0x3114]
push 0x100
push eax
call fcn.1001fb15
add esp, 0x10
mov dword [ebp - 0x3110], ebx
lea eax, [ebp - 0x3110]
push eax
push 1
push ebx
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x100024fe
xor ecx, ecx
lea eax, [ebp - 0x408]
push ecx
push ecx
push 0x100
push eax
mov eax, dword [ebp - 0x3110]
push edi
push dword [eax + 8]
push ecx
push ecx
call ebx
push edi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.10021c86
add esp, 0x10
jmp 0x10002514
cmp dword [0x100c1c2c], 6
jl 0x10002514
push eax
push str.Could_not_retrieve_DC_Role_info:__d
call fcn.100144ba
pop ecx
pop ecx
cmp dword [ebp - 0x3110], 0
je 0x10002529
push dword [ebp - 0x3110]
call dword [sym.imp.NETAPI32.dll_DsRoleFreeMemory]
xor ecx, ecx
lea eax, [ebp - 0x308]
push ecx
push ecx
push 0x100
push eax
push edi
lea eax, [ebp - 0x908]
push eax
push ecx
push ecx
call ebx
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000254e
sub ecx, edx
jne 0x10002575
push edi
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.10021c86
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
push str.SERVER:__s_n
push edi
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.1001f145
lea ecx, [ebp - 0x108]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000259f
push 0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp dword [ebp - 0x3114], 0
mov ebx, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
je 0x100025d0
push dword [ebp - 0x3114]
call ebx
mov esi, 0xff
mov byte [ebp - 0x608], 0
push esi
lea eax, [ebp - 0x607]
push 0
push eax
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x508], 0
lea eax, [ebp - 0x507]
push esi
push 0
push eax
call fcn.10023400
add esp, 0xc
lea eax, [ebp - 0x3118]
xor esi, esi
and dword [ebp - 0x3118], esi
push eax
push esi
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.NETAPI32.dll_NetUserModalsGet]
test eax, eax
jne 0x10002661
cmp dword [0x100c1c2c], 6
jl 0x10002650
mov eax, dword [ebp - 0x3118]
xor edx, edx
mov ecx, 0x15180
mov eax, dword [eax + 4]
div ecx
push eax
push str.Maximum_password_age__d_:__d_n
call fcn.100144ba
pop ecx
pop ecx
mov eax, dword [ebp - 0x3118]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x311c], ecx
jmp 0x10002681
cmp dword [0x100c1c2c], 6
jl 0x10002675
push str.Could_not_find_MaxPasswordAge
call fcn.100144ba
pop ecx
mov eax, dword [ebp - 0x3118]
mov dword [ebp - 0x311c], edi
test eax, eax
je 0x10002688
push eax
call ebx
and dword [ebp - 0x3110], 0
lea eax, [ebp - 0x3110]
push eax
lea eax, [ebp - 0x3124]
push eax
push edi
push 0x2710
push esi
push 1
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.NETAPI32.dll_NetQueryDisplayInformation]
mov edi, eax
mov dword [ebp - 0x3120], edi
cmp edi, 5
je 0x10002b8c
xor ecx, ecx
mov dword [ebp - 0x3128], ecx
cmp dword [ebp - 0x3124], ecx
jbe 0x10002b6b
mov edi, dword [ebp - 0x3110]
add edi, 0xc
jmp 0x100026e5
xor ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x608]
push ecx
push ecx
push 0xff
push eax
push 0xffffffffffffffff
push dword [edi - 0xc]
mov dword [ebp - 0x310c], ecx
push 0x200
push ecx
call esi
xor ecx, ecx
lea eax, [ebp - 0x508]
push ecx
push ecx
push 0xff
push eax
push 0xffffffffffffffff
push dword [edi - 8]
push 0x200
push ecx
call esi
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x312c], 0x100
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000273c
sub ecx, edx
je 0x1000276b
lea ecx, [ebp - 0x308]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002750
sub ecx, edx
je 0x1000276b
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x408]
push eax
jmp 0x1000276f
push 0
push 0
lea eax, [ebp - 0x312c]
push eax
lea edx, [ebp - 0x708]
lea ecx, [ebp - 0x608]
call fcn.1000c8f8
add esp, 0xc
lea eax, [ebp - 0x508]
cmp byte [ebp - 0x508], 0
je 0x100027b3
mov cl, byte [eax]
cmp cl, 9
je 0x100027aa
cmp cl, 0xa
je 0x100027aa
cmp cl, 0xd
jne 0x100027ad
mov byte [eax], 0x20
inc eax
cmp byte [eax], 0
jne 0x10002799
lea eax, [ebp - 0x708]
or esi, 0xffffffff
push eax
lea eax, [ebp - 0x508]
push eax
push dword [edi]
lea eax, [ebp - 0x608]
push eax
push str._s_t_S___s__t_s
push esi
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f145
add esp, 0x20
lea eax, [ebp - 0x310c]
push eax
push 2
push dword [edi - 0xc]
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x10002aec
mov eax, dword [ebp - 0x310c]
test eax, eax
je 0x10002aec
test byte [eax + 0x18], 2
je 0x1000283c
push esi
push str._tACCOUNTDISABLE
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test byte [eax + 0x18], 0x20
je 0x10002862
push esi
push str._tPASSWD_NOTREQD
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test byte [eax + 0x18], 0x40
je 0x10002888
push esi
push str._tPASSWD_CANT_CHANGE
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test byte [eax + 0x18], 0x10
je 0x100028ae
push esi
push str._tLOCKOUT
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x10000
je 0x100028d7
push esi
push str._tDONT_EXPIRE_PASSWD
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x800
je 0x10002900
push esi
push str._tINTERDOMAIN_TRUST_ACCOUNT
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x2000
je 0x10002929
push esi
push str._tSERVER_TRUST_ACCOUNT
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x1000
je 0x10002952
push esi
push str._tWORKSTATION_TRUST_ACCOUNT
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x100
je 0x1000297b
push esi
push str._tTEMP_DUPLICATE_ACCOUNT
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test byte [eax + 0x18], 0x80
je 0x100029a1
push esi
push str._tENCRYPTED_TEXT_PASSWORD_ALLOWED
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x100000
je 0x100029ca
push esi
push str._tNOT_DELEGATED
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x40000
je 0x100029f3
push esi
push str._tSMARTCARD_REQUIRED
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x200000
je 0x10002a1c
push esi
push str._tUSE_DES_KEY_ONLY
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x400000
je 0x10002a45
push esi
push str._tDONT_REQUIRE_PREAUTH
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x80000
je 0x10002a6e
push esi
push str._tTRUSTED_FOR_DELEGATION
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x800000
je 0x10002a97
push esi
push str._tPASSWORD_EXPIRED
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
test dword [eax + 0x18], 0x1000000
je 0x10002ac0
push esi
push str._tTRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
lea eax, [ebp - 0x3108]
push 0x2800
push eax
call fcn.1001f294
mov eax, dword [ebp - 0x310c]
add esp, 0x10
push dword [eax + 0x34]
push dword [eax + 0x3c]
push dword [ebp - 0x311c]
push dword [eax + 8]
lea eax, [ebp - 0x3108]
push eax
push str._s_t_d:_d:_d:_d_n
push esi
push 0x2800
push eax
call fcn.1001f145
add esp, 0x24
jmp 0x10002b0d
push dword [ebp - 0x311c]
lea eax, [ebp - 0x3108]
push eax
push str._s_t_1:_d:_1:_1_n
push esi
push 0x2800
push eax
call fcn.1001f145
add esp, 0x18
lea ecx, [ebp - 0x3108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b16
push 0
sub ecx, edx
lea eax, [ebp - 0x3108]
push ecx
push eax
push dword [ebp - 0x3130]
call dword [sym.imp.WS2_32.dll_send]
cmp dword [ebp - 0x310c], 0
je 0x10002b46
push dword [ebp - 0x310c]
call ebx
mov eax, dword [ebp - 0x3128]
mov esi, dword [edi + 8]
add edi, 0x18
inc eax
mov dword [ebp - 0x3128], eax
cmp eax, dword [ebp - 0x3124]
jb 0x100026e3
mov edi, dword [ebp - 0x3120]
cmp dword [ebp - 0x3110], 0
je 0x10002b7c
push dword [ebp - 0x3110]
call ebx
cmp edi, 0xea
jne 0x10002bee
or edi, 0xffffffff
jmp 0x10002688
push 0x1b
pop ecx
mov esi, str.Access_Denied._Cannot_query_domain_users_while_SNARE_is_running_with_the_privileges_of_the_local_administrator
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0x91
lea eax, [ebp - 0x99]
push 0
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
call fcn.10023400
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002bbe
push 0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push dword [ebp - 0x3130]
call dword [sym.imp.WS2_32.dll_send]
cmp dword [ebp - 0x3110], 0
je 0x10002bee
push dword [ebp - 0x3110]
call ebx
xor eax, eax
inc eax
jmp 0x10002c09
cmp dword [ebp - 0x3114], ebx
je 0x10002c07
push dword [ebp - 0x3114]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret