Function at 0x7ff70202240
Capabilities:
Get domain controller name

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xe8
xor esi, esi
mov rbp, rcx
lea rcx, str.rpcrt4.dll
mov edi, r8d
mov ebx, 0xc00000da
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.I_RpcMapWin32Status
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea eax, [rsi + 0x5c]
cmp rbp, rsi
je 0x7ff702029d1
mov rdx, rbp
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x40000010
call qword [sym.imp.logoncli.dll_DsGetDcNameW]
mov esi, eax
cmp eax, 0x54b
jne 0x7ff70202380
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
test al, al
je 0x7ff70202308
cmp dword [rsp + 0x88], 2
je 0x7ff70202a48
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x7ff70202b24
xor al, al
jmp 0x7ff70202335
add rsp, 0xe8
pop rdi
pop rsi
pop rbp
pop rbx
ret
test esi, esi
jne 0x7ff70202308
movsxd rcx, dword [rsp + 0x40]
test ecx, ecx
jne 0x7ff70202b33
mov rdi, qword [rsp + 0x50]
mov eax, 2
cmp qword [rdi + 0x28], 0
mov rbp, qword [rdi]
mov dword [rsp + 0x40], eax
je 0x7ff70202b46
mov rdi, qword [rdi + 0x28]
jmp 0x7ff702023b3
mov qword [rsp + 0x98], rcx
test eax, eax
je 0x7ff70202e16
dec eax
mov dword [rsp + 0x40], eax
mov eax, 0x5c
jmp 0x7ff702023d0
cmp word [rbp], ax
jne 0x7ff702023dc
add rbp, 2
jmp 0x7ff702023d0
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, rbp
call fcn.7ff70201730
mov r9, qword [rsp + 0x60]
lea r11, [rsp + 0x80]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.NTDSAPI.dll_DsBindWithSpnExW]
mov rcx, qword [rsp + 0x60]
mov esi, eax
test rcx, rcx
je 0x7ff7020242a
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x60], 0
mov rdi, qword [rsp + 0x78]
test esi, esi
je 0x7ff70202461
cmp esi, 0x80000000
ja 0x7ff70202b63
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
test rdi, rdi
je 0x7ff70202461
mov ecx, esi
call rdi
mov ebx, eax
test eax, eax
jns 0x7ff70202b63
cmp qword [rsp + 0x98], 0
jne 0x7ff7020247c
mov rcx, qword [rsp + 0x50]
call sub.netutils.dll_NetApiBufferFree
and qword [rsp + 0x50], 0
test esi, esi
je 0x7ff70202b75
cmp dword [rsp + 0x40], 0
je 0x7ff702024ea
cmp esi, 0x6ba
jne 0x7ff70202bfd
mov rax, qword [rsp + 0x110]
test rax, rax
je 0x7ff70202c26
mov rdx, rax
jmp 0x7ff702024ad
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x40000011
call qword [sym.imp.logoncli.dll_DsGetDcNameW]
mov esi, eax
test eax, eax
je 0x7ff70202c3e
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7ff702024ee
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x7ff70202e1f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x7ff70202e2e
test edi, edi
setne al
jmp 0x7ff70202335
cmp edi, 2
jne 0x7ff70202a3c
mov rcx, qword [rsp + 0x118]
mov edx, eax
call qword [sym.imp.ntdll.dll_wcschr]
mov rdi, rax
cmp rax, rsi
je 0x7ff70202a3c
mov rdx, rax
lea ecx, [rsi + 0x40]
sub rdx, qword [rsp + 0x118]
sar rdx, 1
lea rdx, [rdx + rdx + 2]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x7ff70202a3c
mov r8, qword [rsp + 0x118]
mov rcx, rax
sub rdi, r8
sar rdi, 1
mov r9, rdi
lea rdx, [rdi + 1]
call sub.ntdll.dll_wcsncpy_s
mov rdx, rsi
jmp 0x7ff702022bb
lea rdx, [0x7ff70205a58]
jmp 0x7ff702022bb
and qword [rsp + 0x90], 0
and dword [rsp + 0xb0], 0
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rsp + 0xb8]
call sub.ntdll.dll_memset
and qword [rsp + 0x68], 0
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0xb0]
mov r8d, 1
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
js 0x7ff70202308
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x68]
mov edx, 0xc
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
mov ebx, eax
test eax, eax
js 0x7ff70202b11
lea rcx, [rsp + 0xa0]
mov rdx, rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0xa0]
mov r8b, 1
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
jne 0x7ff70202afd
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0xa0]
mov r8b, 1
add rcx, 0x10
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x7ff70202b07
mov dword [rsp + 0x40], 1
xor esi, esi
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x90]
call sub.ADVAPI32.dll_LsaClose
nop
jmp 0x7ff70202380
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff70202331
mov eax, 1
lea rbp, str.Localhost
xor edi, edi
jmp 0x7ff702023b3
mov rax, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x58]
test rax, rax
cmovne rdi, rax
mov eax, dword [rsp + 0x40]
jmp 0x7ff702023b3
mov dword [rsp + 0x44], 1
mov ebx, 0xc0000001
jmp 0x7ff70202461
mov r9d, dword [rsp + 0x128]
mov r8d, dword [rsp + 0x120]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.NTDSAPI.dll_DsCrackNamesW]
mov esi, eax
test eax, eax
je 0x7ff70202c70
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
test rdi, rdi
je 0x7ff70202be9
mov ecx, esi
call rdi
mov ebx, eax
test eax, eax
js 0x7ff70202be9
mov dword [rsp + 0x44], 1
mov ebx, 0xc0000001
lea rcx, [rsp + 0x80]
call qword [sym.imp.NTDSAPI.dll_DsUnBindW]
nop
jmp 0x7ff70202484
cmp esi, 0x6bb
je 0x7ff70202497
cmp esi, 0x6be
je 0x7ff70202497
cmp esi, 0x6bf
je 0x7ff70202497
jmp 0x7ff702024ea
mov rax, qword [rsp + 0x58]
lea rdx, [0x7ff70205a58]
test rax, rax
cmovne rdx, rax
jmp 0x7ff702024ad
mov rdi, qword [rsp + 0x50]
cmp qword [rdi + 0x28], 0
mov rbp, qword [rdi]
je 0x7ff70202c53
mov rdi, qword [rdi + 0x28]
jmp 0x7ff70202c67
mov rax, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x58]
test rax, rax
cmovne rdi, rax
mov eax, dword [rsp + 0x40]
jmp 0x7ff702023c3
mov rbp, qword [rsp + 0x70]
cmp dword [rbp], 1
jb 0x7ff70202db6
mov rcx, qword [rbp + 8]
cmp dword [rcx], 5
jne 0x7ff70202d29
cmp qword [rsp + 0x110], 0
je 0x7ff70202cc2
mov rax, qword [rcx + 8]
mov rbp, qword [rsp + 0x110]
sub rbp, rax
movzx edx, word [rax]
movzx edi, word [rax + rbp]
sub edx, edi
jne 0x7ff70202cb9
add rax, 2
test edi, edi
jne 0x7ff70202ca6
mov rbp, qword [rsp + 0x70]
test edx, edx
je 0x7ff70202d29
mov rax, qword [rsp + 0x138]
mov r9d, dword [rsp + 0x128]
mov r8d, dword [rsp + 0x120]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x20], rax
call sym.Secur32.dll_SecpTranslateName
mov dword [rsp + 0x44], 1
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov rbp, qword [rsp + 0x70]
jmp 0x7ff70202dba
cmp dword [rcx], 7
jae 0x7ff70202d3c
mov eax, dword [rcx]
lea rdx, [0x7ff70207660]
mov ebx, dword [rdx + rax*4]
jmp 0x7ff70202d41
mov ebx, 0xc0000001
test ebx, ebx
jne 0x7ff70202dfa
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x7ff70202dfa
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov rax, qword [rsp + 0x138]
not rcx
mov edi, ecx
mov rcx, qword [rsp + 0x130]
test rcx, rcx
jne 0x7ff70202d83
mov dword [rax], edi
lea edi, [rbx + 1]
jmp 0x7ff70202dba
cmp edi, dword [rax]
ja 0x7ff70202da4
mov r8, rdi
add r8, r8
call sub.ntdll.dll_memcpy
mov rax, qword [rsp + 0x138]
mov dword [rsp + 0x48], 1
jmp 0x7ff70202db4
and dword [rsp + 0x44], 0
xor edx, edx
mov ebx, 0xc0000023
mov dword [rsp + 0x48], edx
mov dword [rax], edi
mov edi, dword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.NTDSAPI.dll_DsUnBindW]
test edi, edi
jne 0x7ff70202509
cmp dword [rsp + 0x44], edi
jne 0x7ff702024ee
test ebx, ebx
je 0x7ff702024ee
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
jmp 0x7ff70202503
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
and dword [rsp + 0x44], 0
xor edi, edi
jmp 0x7ff70202d1f
mov edi, dword [rsp + 0x48]
jmp 0x7ff702024ee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff70202517
call sub.netutils.dll_NetApiBufferFree
nop
jmp 0x7ff70202525