Function at 0x1000aa6a4
Capabilities:
Get domain information

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r12, rdx
xor r15d, r15d
mov r14d, r15d
mov dword [r11 - 0x70], r15d
mov r13d, r15d
mov qword [rsp + 0x60], r15
mov dword [r11 - 0x80], r15d
mov byte [r11 - 0x38], r15b
mov byte [r11 - 0x37], r15b
mov byte [r11 - 0x36], r15b
mov byte [r11 - 0x35], r15b
mov byte [r11 - 0x34], r15b
mov byte [r11 - 0x33], 5
mov qword [r11 - 0x50], r15
mov rbx, r15
mov qword [r11 - 0x78], rbx
mov rbp, r15
mov qword [r11 - 0x60], r15
mov qword [r11 - 0x48], r15
mov qword [r11 - 0x58], r15
mov rsi, r15
mov qword [r11 - 0x68], r15
lea r8, [r11 - 0x50]
lea edx, [r15 + 1]
xor ecx, ecx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
cmp eax, r15d
je 0x1000aa76e
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
xor r9d, r9d
mov r8d, edi
mov edx, 0xbf400ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000aaa78
mov rcx, qword [rsp + 0x98]
cmp dword [rcx], r15d
je 0x1000aaa61
cmp dword [rcx], 2
je 0x1000aaa61
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
lea edx, [r9 + 0x48]
mov rcx, qword [rcx + 0x18]
call fcn.1000d3e90
mov edi, eax
cmp eax, r15d
je 0x1000aa7d5
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0700ca
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
jmp 0x1000aaa78
lea rdx, [0x100026b18]
lea rcx, [rsp + 0x60]
call fcn.1000e3df0
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x1000aa848
cmp word [rcx], r15w
je 0x1000aa848
mov rsi, qword [rsp + 0x80]
cmp rsi, r15
je 0x1000aa85d
lea rcx, [rsp + 0x60]
call fcn.1000e3d54
mov edx, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
add edx, ecx
lea rcx, [rsp + 0x60]
call fcn.1000e3ce4
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x1000aa85d
mov edx, dword [rsp + 0x68]
shr rdx, 1
mov r8, rsi
call fcn.100038a50
jmp 0x1000aa85d
mov rsi, qword [rsp + 0x80]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1000e3df0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
mov r8d, Ordinal_36
mov dl, 2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r15d
jne 0x1000aa8d3
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0xc1700ca
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x70]
jmp 0x1000aaa78
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r15d
jne 0x1000aa944
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0xc2300ca
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x70]
jmp 0x1000aaa78
mov edx, 1
lea rcx, [0x100026b40]
call fcn.1000d39c4
mov edi, eax
cmp eax, r15d
je 0x1000aa978
xor r9d, r9d
mov r8d, eax
mov edx, 0xc2700ca
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x70]
jmp 0x1000aaa78
mov r14d, 1
mov r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.1000aa170
mov edi, eax
cmp eax, r15d
je 0x1000aa9b6
xor r9d, r9d
mov r8d, eax
mov edx, 0xc2d00ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000aaa78
mov r13d, r14d
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1000a9cbc
mov edi, eax
cmp eax, r15d
je 0x1000aa9f4
xor r9d, r9d
mov r8d, eax
mov edx, 0xc3200ca
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x88]
jmp 0x1000aaa78
lea r8, [rsp + 0x78]
mov rdx, r12
mov rbp, qword [rsp + 0x88]
mov rcx, rbp
call fcn.1000aa56c
mov edi, eax
cmp eax, r15d
je 0x1000aaa27
xor r9d, r9d
mov r8d, eax
mov edx, 0xc3800ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000aaa78
cmp dword [rsp + 0x78], r15d
jne 0x1000aaa78
mov dword [rsp + 0x20], r13d
mov r9, rbp
mov r8, r12
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1000aa364
mov edi, eax
cmp eax, r15d
je 0x1000aaa78
xor r9d, r9d
mov r8d, eax
mov edx, 0xc4000ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000aaa78
mov edi, 0x8000ffff
xor r9d, r9d
mov r8d, edi
mov edx, 0xbfb00ca
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0x98]
cmp rcx, r15
je 0x1000aaa8a
call sub.NETAPI32.dll_DsRoleFreeMemory
cmp rbp, r15
je 0x1000aaa98
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r13d, r15d
je 0x1000aaac4
mov r8, qword [rsp + 0x90]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1000aa170
xor r9d, r9d
mov r8d, eax
mov edx, 0xc5900ca
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r14d, r15d
je 0x1000aaaf3
xor edx, edx
lea rcx, [0x100026b40]
call fcn.1000d39c4
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1000d3f6c
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x1000aab16
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov eax, edi
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret