Function at 0x1400b8998
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rax, str.replPropertyMetaData
mov rdi, rcx
xor ecx, ecx
mov qword [r11 - 0x78], rax
lea rax, str.objectSid
mov rbx, r8
mov qword [r11 - 0x70], rax
lea rax, str.objectGUID
mov rbp, rdx
mov rdx, qword [rbx]
mov qword [r11 - 0x68], rax
lea rax, str.parentGUID
mov qword [r11 - 0x60], rax
lea rax, str.1.2.840.113556.1.4.417
mov esi, ecx
mov qword [r11 - 0x38], rax
xor eax, eax
mov dword [rsp + 0x118], ecx
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
lea rax, [rsp + 0x60]
mov qword [r11 - 0x58], rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x3e8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
lea rax, [r11 - 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
lea rax, [r11 - 0x78]
mov qword [rsp + 0x60], rcx
mov dword [r11 - 0x30], ecx
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x74], ecx
lea r9, str._objectclass_
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x3c
call qword [sym.imp.WLDAP32.dll_Ordinal_203]
test eax, eax
jne 0x1400b8cb3
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_36]
cmp eax, 1
jne 0x1400b8c8e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400b82dc
mov rbp, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400b8bc4
mov rcx, qword [rax + 8]
xor eax, eax
cmp dword [rcx], 1
sete al
mov dword [rsp + 0x118], eax
test eax, eax
je 0x1400b8b9e
and dword [rsp + 0x68], esi
cmp dword [rbx + 0x44], esi
jbe 0x1400b8bac
mov ebp, dword [rsp + 0x68]
mov rdi, rcx
mov rax, qword [rbx + 0x48]
lea r8, [rsp + 0x68]
lea rcx, [0x1400dd000]
mov rdx, qword [rsi + rax]
xor r9d, r9d
mov rdx, qword [rdx + 8]
call fcn.140011a98
test eax, eax
je 0x1400b8b60
xor eax, eax
xor edx, edx
cmp dword [rdi + 8], eax
jbe 0x1400b8b7d
mov r8d, dword [rsp + 0x68]
lea rcx, [rdi + 0x10]
cmp r8d, dword [rcx]
je 0x1400b8b36
inc edx
inc rax
add rcx, 0x30
cmp edx, dword [rdi + 8]
jb 0x1400b8b21
jmp 0x1400b8b7d
mov rcx, qword [rbx + 0x48]
lea rdx, [rax + rax*2]
add rdx, rdx
mov eax, dword [rdi + rdx*8 + 0x14]
mov dword [rsi + rcx + 0x28], eax
mov rcx, qword [rdi + rdx*8 + 0x18]
mov rax, qword [rbx + 0x48]
imul rcx, rcx, 0x989680
mov qword [rsi + rax + 0x2c], rcx
jmp 0x1400b8b7d
mov rax, qword [rbx + 0x48]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___Unable_to_MakeAttid_from_SCHEMA_DEFAULT_PREFIX_TABLE_for_Oid:__S__version__u__can_be_problematic_n
mov rdx, qword [rsi + rax]
mov r8d, dword [rsi + rax + 0x28]
mov rdx, qword [rdx + 8]
call fcn.14000c020
inc ebp
add rsi, 0x50
cmp ebp, dword [rbx + 0x44]
jb 0x1400b8aeb
mov rdi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xa8]
jmp 0x1400b8bac
mov edx, dword [rcx]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___Repl_Blob_version_is_not_1___u__n
call fcn.14000c020
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400b8bbb
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov rsi, rax
test rax, rax
je 0x1400b8c03
mov rdx, qword [rax]
cmp dword [rdx], 0x1c
ja 0x1400b8c03
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
lea rcx, [rbx + 8]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b8c45
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b8c45
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x24], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x2c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b8c87
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b8c87
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x34], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x3c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov esi, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b8c9e
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov eax, esi
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
cmp eax, 0x20
jne 0x1400b8cdb
lea rcx, str.Object_does_not_exist_n
lea esi, [rax - 0x1f]
call fcn.14000c020
mov rdx, qword [rbx]
or dword [rbx + 0x50], esi
lea r8, [rbx + 0x34]
mov rcx, rdi
call fcn.1400b87a8
jmp 0x1400b8c8e
cmp eax, 0x22
jne 0x1400b8d16
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b86e0
test eax, eax
je 0x1400b8c8e
mov rdx, qword [rbx]
lea rcx, str.DN:_s_n
call fcn.14000c020
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b8998
mov esi, eax
jmp 0x1400b8c8e
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s_0x_x___u__n
mov r8d, eax
mov edx, eax
call fcn.14000c020
lea r8, [rsp + 0x118]
mov edx, Ordinal_54
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_12]
test eax, eax
jne 0x1400b8c8e
mov rdx, qword [rsp + 0x118]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s__s_n
call fcn.14000c020
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.WLDAP32.dll_Ordinal_147]
jmp 0x1400b8c8e