Function at 0x140002720
Capabilities:
List domain servers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
movzx ebp, cl
lea rdx, [0x1400220ec]
mov rcx, rdi
mov r14, r8
mov ebx, 1
call fcn.140009e20
mov rsi, rax
test rax, rax
jne 0x1400025a6
call fcn.140008c34
lea rdx, [0x1400220f0]
mov r8, rdi
lea rcx, [rax + 0x60]
call fcn.140008fbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003030
jmp 0x14000262f
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 0x208
call fcn.140009c70
test rax, rax
je 0x140002627
xor edi, edi
nop
lea rcx, [rsp + 0x20]
mov edx, 0xa
call fcn.140009708
test rax, rax
je 0x1400025e6
lea rcx, [rsp + 0x20]
mov edx, 0xa
call fcn.140009708
mov word [rax], di
cmp word [rsp + 0x20], di
je 0x140002610
test bpl, bpl
je 0x140002603
lea rdx, [rsp + 0x20]
lea rcx, str._s:_n
call fcn.140007f24
lea rcx, [rsp + 0x20]
call r14
test eax, eax
cmove ebx, edi
lea rcx, [rsp + 0x20]
mov r8, rsi
mov edx, 0x208
call fcn.140009c70
test rax, rax
jne 0x1400025c0
mov rcx, rsi
call fcn.1400098c0
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140008390
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov rbx, rdx
movzx esi, cl
mov edi, 1
xor r14d, r14d
nop dword [rax + rax]
mov edx, 0x2c
mov rcx, rbx
call fcn.140009708
test rax, rax
je 0x1400026b3
mov edx, 0x2c
mov rcx, rbx
call fcn.140009708
mov word [rax], r14w
test sil, sil
je 0x1400026c7
lea rcx, str._s:_n
mov rdx, rbx
call fcn.140007f24
mov rcx, rbx
call rbp
test eax, eax
cmove edi, r14d
or rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rcx*2 + 2], r14w
lea rcx, [rcx + 1]
jne 0x1400026e0
lea rbx, [rbx + rcx*2]
add rbx, 2
cmp word [rbx], r14w
jne 0x140002690
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor r15d, r15d
movzx ebp, cl
lea rcx, str.Enumerating_domain..._n
mov r14, rdx
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r15d
lea edi, [r15 + 1]
call fcn.140003100
lea rax, [rsp + 0x64]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea edx, [rdi + 0x64]
or r9d, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetServerEnum
mov ebx, eax
test eax, eax
je 0x1400027e2
cmp eax, 0xea
je 0x1400027e2
call fcn.140008c34
lea rdx, str.A_system_error_has_occurred:__d_n
mov r8d, ebx
lea rcx, [rax + 0x60]
call fcn.140009928
mov rbx, qword [rsp + 0x58]
jmp 0x140002861
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14000286e
mov qword [rsp + 0x2b0], rsi
mov esi, r15d
cmp dword [rsp + 0x50], r15d
jbe 0x140002859
test rbx, rbx
je 0x140002854
mov rdx, qword [rbx + 8]
lea rax, [rsp + 0x70]
movzx ecx, word [rdx]
lea rax, [rax + 2]
lea rdx, [rdx + 2]
mov word [rax - 2], cx
test cx, cx
jne 0x140002810
test bpl, bpl
je 0x14000283a
lea rdx, [rsp + 0x70]
lea rcx, str._s:_n
call fcn.140007f24
lea rcx, [rsp + 0x70]
call r14
test eax, eax
cmove edi, r15d
inc esi
add rbx, 0x28
cmp esi, dword [rsp + 0x50]
jb 0x140002802
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x2b0]
test rbx, rbx
je 0x14000286e
mov rcx, rbx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140008390
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp word [rdx], 0x40
mov rdi, r8
mov rbx, rdx
movzx esi, cl
jne 0x1400028d6
add rdx, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140002530
movzx eax, word [rdx]
cmp ax, word [0x140022118]
jne 0x14000290a
movzx eax, word [rdx + 2]
cmp ax, word [0x14002211a]
jne 0x14000290a
mov rdx, r8
movzx ecx, sil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140002720
mov edx, 0x2c
mov rcx, rbx
call fcn.140009708
test rax, rax
je 0x14000293a
mov r8, rdi
mov rdx, rbx
movzx ecx, sil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140002660
mov rcx, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax