Function at 0x100044638
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
cmp edx, 2
lea rax, [0x10000ded0]
lea r14, [0x100010b60]
mov rbx, r8
mov r13d, edx
cmove r14, rax
mov rbp, rcx
mov qword [r11 + 0x20], r15
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x48], r15
mov qword [r11 + 0x18], r15
mov qword [r11 - 0x58], r15
mov rsi, r15
mov qword [r8], r15
cmp edx, 2
jne 0x10004478c
lea r9, [r11 + 0x18]
lea r8, [0x100010bb8]
lea edx, [r13 - 1]
call fcn.1000443dc
cmp eax, r15d
jne 0x10004478c
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], Ordinal_65
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov edi, eax
cmp eax, r15d
je 0x1000446e5
mov r8d, eax
mov edx, 0x134e0133
jmp 0x100044998
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
jmp 0x1000446f3
add rcx, 2
cmp word [rcx], 0x5c
je 0x1000446ef
lea r8, [rsp + 0xb8]
xor edx, edx
call qword [sym.imp.NTDSAPI.dll_DsBindW]
mov edi, eax
cmp eax, r15d
je 0x10004471d
mov r8d, eax
mov edx, 0x13570133
jmp 0x100044998
mov rcx, qword [rsp + 0xb8]
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
lea r9d, [rdx + 1]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 8]
mov dword [rsp + 0x20], 1
call qword [sym.imp.NTDSAPI.dll_DsCrackNamesW]
cmp eax, r15d
jne 0x10004478c
mov rcx, qword [rsp + 0x50]
cmp dword [rcx], r15d
jbe 0x10004478c
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 0x10]
cmp rcx, r15
je 0x10004478c
mov rdx, rbx
call fcn.1000b80c8
mov edi, eax
cmp eax, r15d
je 0x10004478c
mov r8d, eax
mov edx, 0x13650133
jmp 0x100044998
mov r12, r15
cmp qword [rbx], r15
jne 0x1000449a4
xor r8d, r8d
lea r9, [rsp + 0xb0]
mov rcx, rbp
cmp r13d, 2
jne 0x1000447fc
mov edx, r13d
call fcn.1000443dc
cmp eax, r15d
je 0x1000447f3
xor r9d, r9d
mov r8d, eax
mov edx, 0x13770133
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0xb0]
lea rdx, [0x100010bd0]
add rcx, 0x50
call fcn.1000b1598
cmp eax, r15d
je 0x1000447f3
mov edx, 0x137f0133
jmp 0x10004483e
lea r12, [0x10000fe48]
jmp 0x100044854
mov edx, 3
call fcn.1000443dc
cmp eax, r15d
je 0x10004484d
xor r9d, r9d
mov r8d, eax
mov edx, 0x138e0133
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0xb0]
add rcx, 0x50
xor edx, edx
call fcn.1000b16d0
cmp eax, r15d
je 0x10004484d
mov edx, 0x13960133
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100044854
lea r12, [0x100010178]
cmp qword [rsp + 0xb0], r15
je 0x100044986
xor r9d, r9d
lea r8, [rsp + 0x40]
xor ecx, ecx
lea edx, [r9 + 0xa]
mov qword [rsp + 0x20], r15
call fcn.10003e654
mov edi, eax
cmp eax, r15d
je 0x10004488e
mov r8d, eax
mov edx, 0x13a80133
jmp 0x100044998
cmp r13d, 2
jne 0x100044954
or r8, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r14
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0xb0]
not rcx
dec rcx
add rdx, rcx
mov rcx, r8
repne scasw ax, word [rdi]
lea rdi, [0x100010b78]
not rcx
dec rcx
add rdx, rcx
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
lea rdi, [rdx + rcx]
xor ecx, ecx
lea rdx, [rdi + rdi]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, r15
jne 0x10004490e
mov edi, 0x8007000e
mov edx, 0x13b70133
jmp 0x100044995
mov rax, qword [rsp + 0xb0]
lea r8, [0x100010b78]
mov r9, r14
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.100038358
mov rcx, qword [rsp + 0x40]
mov r8, rbx
mov rdx, rsi
call fcn.1000d600c
cmp eax, r15d
je 0x100044986
mov edx, 0x13c00133
mov rcx, rsi
jmp 0x10004497b
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
mov r8, rbx
call fcn.1000d612c
cmp eax, r15d
je 0x100044986
mov rcx, qword [rsp + 0xb0]
mov edx, 0x13c80133
xor r9d, r9d
mov r8d, eax
call fcn.1000b51b8
cmp qword [rbx], r15
jne 0x1000449a4
mov edi, 0x80092004
mov edx, 0x13d00133
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000449a7
mov edi, r15d
cmp qword [rsp + 0xb8], r15
je 0x1000449bf
lea rcx, [rsp + 0xb8]
call qword [sym.imp.NTDSAPI.dll_DsUnBindW]
mov rcx, qword [rsp + 0x48]
cmp rcx, r15
je 0x1000449ce
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x1000449de
call qword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r15
je 0x1000449f1
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call fcn.1000d3f6c
cmp rsi, r15
je 0x100044a0e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret