Function at 0x7ff70201260
Capabilities:
Get domain controller name

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
xor ebx, ebx
mov rbp, rcx
lea rcx, str.rpcrt4.dll
mov edi, r8d
mov esi, 0xc00000da
mov dword [rsp + 0x40], 1
mov qword [rax - 0x68], rbx
mov qword [rax - 0x38], rbx
mov dword [rsp + 0x44], ebx
mov dword [rax - 0x60], ebx
mov qword [rsp + 0x70], rbx
mov qword [rax - 0x58], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.I_RpcMapWin32Status
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [rsp + 0xe0]
lea ecx, [rbx + 0x40]
shl rdx, 3
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], rax
cmp rax, rbx
je 0x7ff70202742
mov ecx, 0x5c
cmp rbp, rbx
je 0x7ff70202765
mov rax, rbx
jmp 0x7ff7020130b
cmp dword [rsp + 0xf0], ebx
jne 0x7ff702027df
cmp rbp, rbx
je 0x7ff70202871
mov rdx, rbp
jmp 0x7ff70201326
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x40010010
call qword [sym.imp.logoncli.dll_DsGetDcNameW]
mov ebp, eax
mov dword [rsp + 0x48], eax
cmp eax, ebx
je 0x7ff70201702
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x44], ebx
jmp 0x7ff70201375
mov rdi, qword [rsp + 0xe8]
cmp qword [rsp + 0x80], rbx
jne 0x7ff702016ee
mov rax, qword [rsp + 0x70]
cmp rax, rbx
jne 0x7ff702028fb
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
jne 0x7ff702016b3
cmp dword [rsp + 0x44], ebx
jne 0x7ff702016e7
cmp qword [rdi], rbx
je 0x7ff70201400
cmp dword [rsp + 0xe0], ebx
jbe 0x7ff702013f4
mov rax, qword [rsp + 0xe8]
mov ebp, dword [rsp + 0xe0]
mov rdi, rbx
mov rcx, qword [rax]
cmp qword [rdi + rcx], rbx
jne 0x7ff7020290a
add rdi, 8
sub rbp, 1
jne 0x7ff702013d1
mov ebp, dword [rsp + 0x48]
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rbx
cmp dword [rsp + 0x40], ebx
je 0x7ff70202921
mov rax, qword gs:[0x30]
mov ecx, ebp
mov dword [rax + 0x1250], 0xc0000001
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0xf8]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
jmp 0x7ff70201435
mov al, bl
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rcx + 0x28], rbx
je 0x7ff70202884
mov rdi, qword [rcx + 0x28]
jmp 0x7ff702014dc
mov rcx, qword [rcx]
lea r8, [rsp + 0x60]
mov rdx, rdi
call fcn.7ff70201730
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rcx]
lea r11, [rsp + 0x80]
mov r9, rsi
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NTDSAPI.dll_DsBindWithSpnExW]
mov ebp, eax
mov dword [rsp + 0x48], eax
cmp rsi, rbx
je 0x7ff7020152d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebp, ebx
jne 0x7ff70202341
mov esi, ebx
mov edi, ebx
mov dword [rsp + 0x78], ebx
cmp dword [rsp + 0xe0], ebx
jbe 0x7ff702016a6
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x88], rax
cmp esi, ebx
jl 0x7ff70201375
mov r9d, dword [rax]
mov r8d, dword [rsp + 0xd0]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xc8]
xor edx, edx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x20], 1
call qword [sym.imp.NTDSAPI.dll_DsCrackNamesW]
mov ebp, eax
mov dword [rsp + 0x48], eax
cmp eax, ebx
jne 0x7ff702028e9
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x40], ebx
cmp dword [rcx], 1
jb 0x7ff702028df
cmp edi, ebx
jne 0x7ff702015d2
mov rax, qword [rcx + 8]
cmp dword [rax], 5
je 0x7ff70202947
mov rdx, qword [rcx + 8]
cmp dword [rdx], 7
jae 0x7ff702028af
mov eax, dword [rdx]
lea rdi, [0x7ff70207660]
mov esi, dword [rdi + rax*4]
jmp 0x7ff702015ed
cmp esi, ebx
jne 0x7ff702028c3
mov rdi, qword [rdx + 0x10]
cmp rdi, rbx
je 0x7ff702028d8
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
mov edi, ecx
lea ecx, [rax + 0x40]
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0xe8]
mov r9, qword [rsp + 0x60]
mov rdx, rax
mov rax, qword [rcx]
mov qword [r9 + rax], rdx
mov rcx, qword [rcx]
cmp qword [r9 + rcx], rbx
je 0x7ff702028b9
mov rax, qword [rsp + 0x68]
mov rcx, qword [r9 + rcx]
mov r8, rdi
mov rdx, qword [rax + 8]
mov rdx, qword [rdx + 0x10]
call sub.ntdll.dll_memcpy
jmp 0x7ff7020165e
mov rcx, qword [rsp + 0x68]
jmp 0x7ff70201665
call qword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
mov edi, dword [rsp + 0x78]
jmp 0x7ff70201671
mov rax, qword [rsp + 0x88]
add qword [rsp + 0x60], 8
inc edi
add rax, 4
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x88], rax
cmp edi, dword [rsp + 0xe0]
jb 0x7ff7020155f
cmp esi, ebx
jl 0x7ff70201375
mov dword [rsp + 0x44], 1
jmp 0x7ff70201375
call sub.netutils.dll_NetApiBufferFree
nop
jmp 0x7ff702013a7
mov bl, 1
jmp 0x7ff70201435
lea rcx, [rsp + 0x80]
call qword [sym.imp.NTDSAPI.dll_DsUnBindW]
nop
jmp 0x7ff7020138b
mov rcx, qword [rsp + 0x50]
mov edx, 0x5c
mov rax, qword [rcx]
cmp word [rax], dx
jne 0x7ff702014cc
add rax, 2
mov qword [rcx], rax
mov rcx, qword [rsp + 0x50]
jmp 0x7ff7020170f
cmp ebp, 0x80000000
ja 0x7ff7020289d
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x1250]
mov rax, qword [rsp + 0x88]
cmp rax, rbx
je 0x7ff7020136f
mov ecx, ebp
call rax
cmp eax, ebx
mov esi, eax
jl 0x7ff7020136f
jmp 0x7ff7020289d
mov ecx, 0xc0000017
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x7ff70201437
cmp edi, 2
jne 0x7ff70201306
mov edx, ecx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x7ff702027d2
mov rdx, rax
mov ecx, 0x40
sub rdx, qword [rsp + 0xc8]
sar rdx, 1
lea rdx, [rdx + rdx + 2]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
cmp rax, rbx
je 0x7ff702027d5
mov r8, qword [rsp + 0xc8]
mov rcx, rax
sub rdi, r8
sar rdi, 1
mov r9, rdi
lea rdx, [rdi + 1]
call sub.ntdll.dll_wcsncpy_s
mov rax, qword [rsp + 0x70]
jmp 0x7ff702027d5
mov rax, rbx
mov ecx, 0x5c
jmp 0x7ff7020130b
mov edx, ecx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x7ff702027fd
add rdi, 2
jmp 0x7ff70202805
mov rdi, qword [rsp + 0xc8]
mov dx, 0x24
mov rcx, rdi
call qword [sym.imp.ntdll.dll_wcschr]
mov ecx, 0x3a00
cmp rax, rbx
mov eax, 0x200
cmovne eax, ecx
cmp rbp, rbx
je 0x7ff7020282c
mov rdx, rbp
jmp 0x7ff7020283f
mov rcx, qword [rsp + 0x70]
lea rdx, [0x7ff70205a58]
cmp rcx, rbx
cmovne rdx, rcx
lea rcx, [rsp + 0x50]
mov r9, rdx
mov r8d, eax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x40010010
xor ecx, ecx
mov rdx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.logoncli.dll_DsGetDcNameWithAccountW]
jmp 0x7ff70201346
lea rdx, [0x7ff70205a58]
cmp rax, rbx
cmovne rdx, rax
jmp 0x7ff70201326
mov rax, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0x70]
cmp rax, rbx
cmovne rdi, rax
jmp 0x7ff702014dc
mov esi, 0xc0000001
mov dword [rsp + 0x40], 1
jmp 0x7ff7020136f
mov esi, 0xc0000001
jmp 0x7ff702015ed
mov esi, 0xc0000017
jmp 0x7ff7020165e
cmp esi, 0xc0000064
jne 0x7ff702028d8
mov dword [rsp + 0x58], 1
jmp 0x7ff70201665
mov esi, ebx
jmp 0x7ff70201665
mov esi, 0xc00000da
jmp 0x7ff70201665
mov esi, 0xc0000001
mov dword [rsp + 0x40], 1
jmp 0x7ff70201671
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff70201399
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0xe8]
jmp 0x7ff702013de
cmp esi, ebx
jge 0x7ff7020140a
mov rax, qword gs:[0x30]
mov ecx, esi
mov dword [rax + 0x1250], esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
jmp 0x7ff7020141f
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0xd8]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov qword [rdi], rbx
mov rcx, qword [rax + 8]
lea rax, [rsp + 0x58]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call fcn.7ff70201260
movzx eax, al
mov dword [rsp + 0x44], eax
cmp eax, ebx
jne 0x7ff702029c1
mov rax, qword gs:[0x30]
mov dword [rsp + 0x40], ebx
mov esi, dword [rax + 0x1250]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
jmp 0x7ff7020137d