Function at 0x1000a2498
Capabilities:
Get domain controller name

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, reloc.certcli.dll_Ordinal_256
xor r12d, r12d
lea rcx, [rax - 0x70]
xor edx, edx
lea r8d, [r12 + 0x30]
mov rbx, r9
mov qword [rax - 0x98], r12
mov rbp, r12
mov qword [rax - 0xa8], r12
mov qword [rax - 0x80], r12
mov rsi, r12
mov qword [rax - 0xb0], r12
mov r14, r12
mov qword [rax - 0xa0], r12
mov qword [rax - 0x88], r12
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rbx
call fcn.1000dcdbc
mov edi, eax
cmp eax, r12d
je 0x1000a252e
xor r9d, r9d
mov r8d, eax
mov edx, 0x11500c9
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a28cc
mov rdx, qword [rsp + 0x160]
cmp rdx, r12
jne 0x1000a2584
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x168]
mov rcx, rbx
call fcn.1000a23cc
mov edi, eax
cmp eax, r12d
je 0x1000a2579
xor r9d, r9d
mov r8d, eax
mov edx, 0x11f00c9
xor ecx, ecx
call fcn.1000b51b8
mov rsi, qword [rsp + 0x88]
jmp 0x1000a28ab
mov rsi, qword [rsp + 0x88]
mov rdx, rsi
lea rax, [rsp + 0xc8]
lea r9, [rsp + 0xc4]
lea r8, [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.1000a22dc
mov edi, eax
cmp eax, r12d
je 0x1000a25c9
mov edx, 0x12e00c9
jmp 0x1000a289e
lea rax, [rsp + 0xa0]
lea r9, [0x100004660]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1000dc884
mov edi, eax
cmp eax, r12d
je 0x1000a2602
mov edx, 0x13700c9
lea rcx, [0x100004660]
jmp 0x1000a28a0
lea rax, [rsp + 0x88]
lea r9, [0x100017328]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1000dc924
mov edi, eax
cmp eax, r12d
je 0x1000a263b
mov edx, 0x14100c9
lea rcx, [0x100017328]
jmp 0x1000a28a0
lea rax, [rsp + 0xa8]
lea r9, [0x1000263c0]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1000dc924
mov edi, eax
cmp eax, r12d
je 0x1000a2674
mov edx, 0x14b00c9
lea rcx, [0x1000263c0]
jmp 0x1000a28a0
lea rax, [rsp + 0x90]
lea r9, [0x1000263d0]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1000dc884
mov edi, eax
cmp eax, r12d
je 0x1000a26c0
lea rcx, [0x1000263d0]
xor r9d, r9d
mov r8d, eax
mov edx, 0x15500c9
call fcn.1000b51b8
mov rbp, qword [rsp + 0x90]
jmp 0x1000a28ab
mov rbp, qword [rsp + 0x90]
mov r15d, dword [rsp + 0x168]
mov r9d, dword [rsp + 0x80]
lea rax, [rsp + 0xb8]
lea rcx, [0x1000263f0]
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov r8, rbx
mov dword [rsp + 0x20], r15d
call fcn.1000ddee0
mov edi, eax
cmp eax, 0x80070002
je 0x1000a2714
cmp eax, r12d
je 0x1000a2714
mov edx, 0x16000c9
jmp 0x1000a289e
mov r13d, dword [rsp + 0x170]
mov r12d, dword [rsp + 0xa8]
test r13d, r13d
jne 0x1000a2807
test r12d, r12d
je 0x1000a2807
lea rax, [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x40001000
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x1000a2780
xor r12d, r12d
movzx edi, ax
mov edx, 0x17300c9
or edi, 0x80070000
cmp eax, r12d
cmovle edi, eax
xor ecx, ecx
mov r8d, edi
jmp 0x1000a28a3
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x1000a298d
cmp qword [rax], r14
je 0x1000a298d
mov rdx, qword [rax]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1000a298d
and qword [rsp + 0x20], rax
lea rcx, [rdx + 4]
lea r8, [rsp + 0x98]
xor r9d, r9d
mov edx, Ordinal_203
call fcn.1000d3e90
mov edi, eax
test eax, eax
je 0x1000a27ff
xor r9d, r9d
mov r8d, eax
mov edx, 0x18300c9
xor ecx, ecx
call fcn.1000b51b8
mov r14, qword [rsp + 0x98]
xor r12d, r12d
jmp 0x1000a28ab
mov r14, qword [rsp + 0x98]
mov rax, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x148]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x178]
mov r9, rbx
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call fcn.1000ac39c
xor r12d, r12d
mov edi, eax
cmp eax, r12d
je 0x1000a28ab
mov edx, 0x19700c9
xor ecx, ecx
mov r8d, eax
xor r9d, r9d
call fcn.1000b51b8
cmp rsi, r12
je 0x1000a28b9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa0]
cmp rcx, r12
je 0x1000a28cc
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb8]
cmp rcx, r12
je 0x1000a28df
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbp, r12
je 0x1000a28ed
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r12
je 0x1000a28ff
call sub.NETAPI32.dll_NetApiBufferFree
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1000d3f6c
mov rcx, qword [rsp + 0xd0]
cmp rcx, r12
je 0x1000a2927
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xd0], r12
mov rcx, qword [rsp + 0xc8]
cmp rcx, r12
je 0x1000a2942
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x38], r12
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x30], r12
lea ecx, [r9 - 0x1f]
mov r8d, edi
mov edx, 0x1b0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
call fcn.1000d708c
mov rbx, qword [rsp + 0x150]
mov eax, edi
add rsp, reloc.certcli.dll_Ordinal_256
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, 0x8000ffff
xor r9d, r9d
mov edx, 0x17a00c9
mov r8d, edi
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a27f7