Function at 0x100147b
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xff8
push esi
push edi
push 0x1001190
xor edi, edi
push edi
call dword [sym.imp.msvcrt.dll_setlocale]
mov esi, dword [ebp + 8]
pop ecx
pop ecx
push esi
call fcn.01002158
cmp eax, edi
jne 0x10014b0
push 0x68
call fcn.01001bc8
pop ecx
jmp 0x1001751
push 8
push section..data
add eax, 4
push eax
dec esi
push esi
call fcn.01001dfa
cmp word [0x10042d0], di
movzx eax, ax
je 0x10014db
push edi
call fcn.01001448
xor eax, eax
jmp 0x1001754
cmp eax, edi
jne 0x100174a
mov ax, word [0x10042c4]
cmp ax, di
jne 0x1001500
cmp word [0x10042c8], di
jne 0x100150d
cmp word [0x10042cc], di
jmp 0x100153c
cmp word [0x10042c8], di
jne 0x100174a
cmp word [0x10042cc], di
jne 0x100174a
cmp ax, di
je 0x100152c
test byte [0x1004014], 2
je 0x100174a
cmp word [0x10042c8], di
je 0x1001542
test byte [0x1004034], 2
je 0x100174a
mov ecx, dword [0x1004024]
mov al, byte [0x1004044]
and ecx, 2
cmp cx, di
jne 0x1001562
test al, 2
je 0x100174a
cmp cx, di
je 0x100156a
test al, 2
jne 0x100174a
test al, 2
push ebx
je 0x1001579
mov dword [0x10042c0], edi
xor ebx, ebx
jmp 0x1001593
push 0x10042c0
push 0x1004740
push edi
call sub.NETAPI32.dll_NetGetDCName
mov ebx, eax
cmp ebx, edi
jne 0x1001734
cmp word [0x10042c8], di
jne 0x100169b
cmp word [0x10042cc], di
jne 0x100169b
cmp word [0x10042c4], di
je 0x1001740
lea eax, [ebp - 4]
push eax
mov esi, 0x9e8
push esi
lea eax, [ebp - 0xff8]
push eax
mov edi, 0x1004960
push edi
push dword [0x10042c0]
call sub.REGAPI.dll_RegUserConfigQuery
mov ebx, eax
test ebx, ebx
jne 0x100172e
cmp word [0x10042cc], ax
je 0x1001653
lea eax, [ebp - 0xa1c]
push 0x100
mov dword [ebp - 8], eax
lea eax, [ebp - 0x210]
push eax
push 0xcd
push 0
mov dword [ebp - 0x10], 0x1004740
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x10]
push eax
push 0x200
lea eax, [ebp - 0x610]
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x610]
push eax
call fcn.01001a18
pop ecx
jmp 0x1001740
test byte [0x1004034], 2
je 0x1001670
lea eax, [ebp - 0xa1c]
push 0x1004520
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xff8]
push eax
push 0x1004300
push dword [0x10042c0]
call sub.REGAPI.dll_RegUserConfigSet
mov ebx, eax
test ebx, ebx
je 0x1001740
push ebx
push ebx
push 0x67
jmp 0x1001738
mov esi, 0x9e8
mov edi, 0x1004960
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xff8]
push eax
push edi
push dword [0x10042c0]
call sub.REGAPI.dll_RegUserConfigQuery
mov ebx, eax
test ebx, ebx
je 0x10016e0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xff8]
push eax
push dword [0x10042c0]
call fcn.01002c83
mov ebx, eax
test ebx, ebx
jne 0x100172e
cmp word [0x10042cc], 0
lea eax, [ebp - 0xa1c]
jne 0x10015f5
push 0x1004520
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xff8]
push eax
push edi
push dword [0x10042c0]
call sub.REGAPI.dll_RegUserConfigSet
mov ebx, eax
test ebx, ebx
jne 0x1001692
mov word [0x10042cc], 1
jmp 0x10016a5
push ebx
push ebx
push 0x66
jmp 0x1001738
push ebx
push ebx
push 0x65
call fcn.01001bc8
add esp, 0xc
xor eax, eax
test ebx, ebx
setne al
pop ebx
jmp 0x1001754
push 1
call fcn.01001448
xor eax, eax
inc eax
pop edi
pop esi
leave
ret